From 7136b952364deee23e7380f209333169639ceebe Mon Sep 17 00:00:00 2001
From: Annie_wang <annie.wangli@huawei.com>
Date: Mon, 10 Jul 2023 15:12:26 +0800
Subject: [PATCH] update docs Signed-off-by: Annie_wang
 <annie.wangli@huawei.com>

---
 .../changelogs/v4.0-beta1/Readme-EN.md        |  2 +
 .../changelogs/v4.0-beta1/changelogs-huks.md  | 49 +++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 en/release-notes/changelogs/v4.0-beta1/changelogs-huks.md

diff --git a/en/release-notes/changelogs/v4.0-beta1/Readme-EN.md b/en/release-notes/changelogs/v4.0-beta1/Readme-EN.md
index 4bf1b52482..eba4246524 100644
--- a/en/release-notes/changelogs/v4.0-beta1/Readme-EN.md
+++ b/en/release-notes/changelogs/v4.0-beta1/Readme-EN.md
@@ -13,5 +13,7 @@
 | ArkUI          | UX changed      | [The hover effect of the \<Button> component is changed from scale-up by 100% to 105% to overlay of 0% to 5% opacity.](changelogs-arkui.md)|
 | ArkUI          | UX changed      | [The alignment mode of multi-line text in toasts is changed from center-aligned to left-aligned.](changelogs-arkui.md)|
 | Bundle management subsystem        | Mechanism changed    | [The HAP is no longer decompressed during HAP installation.](changelogs-bundlemanager.md)|
+| Security-HUKS | Behavior changed | [HuksKeyStorageType must be passed in for key derivation or key agreement.](changelogs-huks.md) |
+| Security-HUKS | Behavior changed | [Permission is required for Using attestKeyItem.](changelogs-huks.md) |
 | Web            | Input parameter added | [The input parameter type Resource is added for the setResponseData API.](changelogs-web.md) |
 | Resource scheduler subsystem      | Behavior changed    | [The reminder agent allows you to customize buttons for system applications. Clicking a custom button will redirect you to the specified application page.](changelogs-resourceschedule.md)|
diff --git a/en/release-notes/changelogs/v4.0-beta1/changelogs-huks.md b/en/release-notes/changelogs/v4.0-beta1/changelogs-huks.md
new file mode 100644
index 0000000000..a26b6826d8
--- /dev/null
+++ b/en/release-notes/changelogs/v4.0-beta1/changelogs-huks.md
@@ -0,0 +1,49 @@
+# HUKS Changelog
+
+OpenHarmony 4.0.6.1 has the following changes.
+
+## cl.huks.1 Change of the Permission for Using attestKeyItem
+
+The **attestKeyItem** interface attests a key using a public key encapsulated based on the device certificate chain. Any arbitrary export of the device certificate increases the risks on user privacy. Therefore, certain permissions are required for using this interface.
+
+**Change Impact**
+
+Applications without the **ohos.permission.ACCESS_IDS** permission or the system_basic or system_core permission cannot call **attestKeyItem()**.
+
+**Key API/Component Changes**
+
+- Involved APIs:
+
+  attestKeyItem(keyAlias: string, options: HuksOptions, callback: AsyncCallback\<HuksReturnResult\>): void;
+  attestKeyItem(keyAlias: string, options: HuksOptions): Promise\<HuksReturnResult\>;
+
+- Before change:
+
+  The AccessToken permission is verified only for the applications that pass in a tag related to **ATTESTATION_ID**.
+
+
+- After change:
+
+  **attestKeyItem()** can be called only by a system application with the system_basic or system_core permission or an application with the **ohos.permission.ACCESS_IDS** permission.
+
+**Adaptation Guide**
+
+Applications with the system_basic or system_core permission can call **attestKeyItem()**. If an application with the normal permission needs to call **attestKeyItem()**, it must have the **ohos.permission.ACCESS_IDS** permission. For details about how to apply for the permission, see [ACL](../../../application-dev/security/accesstoken-overview.md#acl).
+
+## cl.huks.2 Resolved the Issues in Storage or Export of Derived or Agreed Keys
+
+Before the change, the HUKS supports storage and export of derived keys and agreed keys, which poses security risks.
+
+After the change, the application needs to pass in **HuksKeyStorageType** for key derivation or key agreement. Only storage or export is allowed at a time. If this parameter is not passed in, both storage and export are supported by default, which poses security risks and is not recommended.
+
+**Change Impact**
+
+Behaviors of released JavaScript APIs have been changed.
+
+**Key API/Component Changes**
+
+Released JavaScript APIs remain unchanged, but the parameter set passed to the APIs are changed.
+
+**Adaptation Guide**
+
+For more information, see [HUKS Development](../../../application-dev/security/huks-guidelines.md) and [HUKS](../../../application-dev/reference/apis/js-apis-huks.md).
-- 
GitLab