Build secure key management services in OP-TEE
summary
An open source PKCS#11-compatible client library and an OP-TEE TA prototype map PKCS#11 calls onto GlobalPlatform APIs, using OP-TEE’s crypto and secure storage; current implementation supports a few AES flavors, enforces key attribute checks and session state, and works around the four-parameter GP limit by packing attribute lists into single buffers. The code is early, not merged, lacks certificate handling, some key extraction/KDF functions and a mature test harness, but the basic import/generate/use flow is implemented.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker intro
- 1:09What are secure key services
- 6:35Why OP-TEE for secure keys
- 10:53Client API requirements
- 15:18PKCS#11 integration plans
- 21:42Key attributes and mechanisms
- 27:32Processing secrets in OP-TEE
- 30:30Current implementation status
- 36:30Future enhancements and market needs
- 40:32Platform and library considerations
- 45:07Cryptographic acceleration in OP-TEE
- 48:05Integration with OpenSSL
- 50:27Use cases and Q&A
related talks
50mUsing OP-TEE as a Cryptography Engine
20mPortable Implementation of GlobalPlatform API for TEE
41mOP-TEE - Using TrustZone to Protect Our Own Secrets
11mOP-TEE open-source security for the mass-market
34mA Journey To the Secure World of OPTEE From the Non-secure World of Linux
15mPKCS#11 providers: security modules used as cryptographic backends
40mGetting Started with the TPM2 Software Stack (TSS2)
49mA More Open Trust Protocol