se_mac

# Secure Element Message Authentication Codes

psa_drv_se_mac_t
psa_status_t(* typedef psa_status_t(* psa_drv_se_mac_setup_t) (psa_drv_se_context_t *drv_context, void *op_context, psa_key_slot_number_t key_slot, psa_algorithm_t algorithm) )(psa_drv_se_context_t *drv_context, void *op_context, psa_key_slot_number_t key_slot, psa_algorithm_t algorithm) psa_drv_se_mac_setup_t

A function that starts a secure element MAC operation for a PSA Crypto Driver implementation.

drv_context

The driver context structure.

op_context

A structure that will contain the hardware-specific MAC context

key_slot

The slot of the key to be used for the operation

algorithm

The algorithm to be used to underly the MAC operation

PSA_SUCCESS

Success.

psa_status_t(* typedef psa_status_t(* psa_drv_se_mac_update_t) (void *op_context, const uint8_t *p_input, size_t input_length) )(void *op_context, const uint8_t *p_input, size_t input_length) psa_drv_se_mac_update_t

A function that continues a previously started secure element MAC operation.

op_context

A hardware-specific structure for the previously-established MAC operation to be updated

p_input

A buffer containing the message to be appended to the MAC operation

input_length

The size in bytes of the input message buffer

psa_status_t(* typedef psa_status_t(* psa_drv_se_mac_finish_t) (void *op_context, uint8_t *p_mac, size_t mac_size, size_t *p_mac_length) )(void *op_context, uint8_t *p_mac, size_t mac_size, size_t *p_mac_length) psa_drv_se_mac_finish_t

a function that completes a previously started secure element MAC operation by returning the resulting MAC.

op_context

A hardware-specific structure for the previously started MAC operation to be finished

p_mac

A buffer where the generated MAC will be placed

mac_size

The size in bytes of the buffer that has been allocated for the `output` buffer

p_mac_length

After completion, will contain the number of bytes placed in the `p_mac` buffer

PSA_SUCCESS

Success.

psa_status_t(* typedef psa_status_t(* psa_drv_se_mac_finish_verify_t) (void *op_context, const uint8_t *p_mac, size_t mac_length) )(void *op_context, const uint8_t *p_mac, size_t mac_length) psa_drv_se_mac_finish_verify_t

A function that completes a previously started secure element MAC operation by comparing the resulting MAC against a provided value.

op_context

A hardware-specific structure for the previously started MAC operation to be finished

p_mac

The MAC value against which the resulting MAC will be compared against

mac_length

The size in bytes of the value stored in `p_mac`

PSA_SUCCESS

The operation completed successfully and the MACs matched each other

PSA_ERROR_INVALID_SIGNATURE

The operation completed successfully, but the calculated MAC did not match the provided MAC

psa_status_t(* typedef psa_status_t(* psa_drv_se_mac_abort_t) (void *op_context) )(void *op_context) psa_drv_se_mac_abort_t

A function that aborts a previous started secure element MAC operation.

op_context

A hardware-specific structure for the previously started MAC operation to be aborted

psa_status_t(* typedef psa_status_t(* psa_drv_se_mac_generate_t) (psa_drv_se_context_t *drv_context, const uint8_t *p_input, size_t input_length, psa_key_slot_number_t key_slot, psa_algorithm_t alg, uint8_t *p_mac, size_t mac_size, size_t *p_mac_length) )(psa_drv_se_context_t *drv_context, const uint8_t *p_input, size_t input_length, psa_key_slot_number_t key_slot, psa_algorithm_t alg, uint8_t *p_mac, size_t mac_size, size_t *p_mac_length) psa_drv_se_mac_generate_t

A function that performs a secure element MAC operation in one command and returns the calculated MAC.

drv_context

The driver context structure.

p_input

A buffer containing the message to be MACed

input_length

The size in bytes of `p_input`

key_slot

The slot of the key to be used

alg

The algorithm to be used to underlie the MAC operation

p_mac

A buffer where the generated MAC will be placed

mac_size

The size in bytes of the `p_mac` buffer

p_mac_length

After completion, will contain the number of bytes placed in the `output` buffer

PSA_SUCCESS

Success.

psa_status_t(* typedef psa_status_t(* psa_drv_se_mac_verify_t) (psa_drv_se_context_t *drv_context, const uint8_t *p_input, size_t input_length, psa_key_slot_number_t key_slot, psa_algorithm_t alg, const uint8_t *p_mac, size_t mac_length) )(psa_drv_se_context_t *drv_context, const uint8_t *p_input, size_t input_length, psa_key_slot_number_t key_slot, psa_algorithm_t alg, const uint8_t *p_mac, size_t mac_length) psa_drv_se_mac_verify_t

A function that performs a secure element MAC operation in one command and compares the resulting MAC against a provided value.

drv_context

The driver context structure.

p_input

A buffer containing the message to be MACed

input_length

The size in bytes of `input`

key_slot

The slot of the key to be used

alg

The algorithm to be used to underlie the MAC operation

p_mac

The MAC value against which the resulting MAC will be compared against

mac_length

The size in bytes of `mac`

PSA_SUCCESS

The operation completed successfully and the MACs matched each other

PSA_ERROR_INVALID_SIGNATURE

The operation completed successfully, but the calculated MAC did not match the provided MAC

Generation and authentication of Message Authentication Codes (MACs) using a secure element can be done either as a single function call (via the `psa_drv_se_mac_generate_t` or `psa_drv_se_mac_verify_t` functions), or in parts using the following sequence:

- `psa_drv_se_mac_setup_t`

- `psa_drv_se_mac_update_t`

- `psa_drv_se_mac_update_t`

- ...

- `psa_drv_se_mac_finish_t` or `psa_drv_se_mac_finish_verify_t`

If a previously started secure element MAC operation needs to be terminated, it should be done so by the `psa_drv_se_mac_abort_t`. Failure to do so may result in allocated resources not being freed or in other undefined behavior.