@@ -24,7 +24,7 @@ HUKS supports key lifecycle management, which covers the following:
- HUKS Core
A functional module that provides the key management service. This module must run in a secure environment, and the keys in plaintext must be kept inside the HUKS Core module throughout their lifecycle.
A functional module that provides the key management service. This module must run in a secure environment, and the keys in plaintext must be kept inside the HUKS Core module throughout the lifecycle.
- TEE
...
...
@@ -32,15 +32,15 @@ HUKS supports key lifecycle management, which covers the following:
- Init-Update-Finish
**Init**: initializes data for a key operation.
**Init**: initializes data for a key operation.
**Update**: operates data by segment and returns the result, or appends data.
**Update**: operates data by segment and returns the result, or appends data.
**Finish**: finalizes the **Update** operation, and returns the result.
### Working Principles
The following uses the key generation process as an example to describe communication between the HUKS Service and HUKS Core. Other key operations are similar.
The following uses the key generation process as an example to describe the communication between the HUKS Service and HUKS Core. Other key operations are similar.
The upper-layer application invokes the HUKS Service through the key management SDK. The HUKS Service invokes the HUKS Core, which invokes the key management module to generate a key. The HUKS Core uses a work key derived from the root key to encrypt the generated key and sends the encrypted key to the HUKS Service. The HUKS Service stores the encrypted key in a file.
...
...
@@ -84,55 +84,57 @@ The HUKS Core provides KeyStore (KS) capabilities for applications, including ke
| [HuksHdiAttestKey()](#hukshdiattestkey) | Obtains the key certificate. |The output parameter must be in the **certChain** format. | attestKey(keyAlias: string, options: HuksOptions)|
| [HuksHdiExportChipsetPlatformPublicKey()](#hukshdiexportchipsetplatformpublickey) | Exports the public key of a chipset key pair. | The output parameters are the raw data of ECC P-256 x-axis and y-axis values, each of which are of 32 bytes. | –|
@@ -440,23 +447,24 @@ Finalizes the key operation. This API is of the Init-Update-Final model.
<br></br>
<details>
<summary><strong>Return value</strong></summary>
<summary><strong>Return Value</strong></summary>
-**HKS_SUCCESS**: The operation is successful.
- Other value: The operation fails.
- Other value: The operation failed.
</details>
- - -
#### HuksHdiAbort
**API description**
**API Description**
Aborts Init-Update-Finish. When an error occurs in any of the **Init**, **Update**, and **Finish** operations, call this API to terminate the use of the key.
@@ -577,18 +588,51 @@ Exports the public key of a chipset key pair.
<summary><strong>Constraints</strong></summary>
1. The input parameter **salt** must be of 16 bytes, and the content of the last byte will be ignored and filled by HUKS based on **scene**.
Currently, the chipset key pairs of HUKS are implemented by software. An ECC P-256 key pair is hard-coded, and the **salt** value is ignored. That is, the derived keys are the same regardless of the **salt**. In the hardware-based implementation of chipset key pairs, **salt** is a factor used to derive the key. That is, the key pair derived varies with the **salt** value.
Currently, the chipset key pairs of HUKS are implemented by software. An ECC P-256 key pair is hard-coded, and the **salt** value is ignored. That is, the derived keys are the same regardless of the **salt**. In the hardware-based implementation of chipset key pairs, **salt** is a factor used to derive the key. That is, the key pair derived varies with the **salt** value.
</details>
<br></br>
<details>
<summary><strong>Return Value</strong></summary>
-**HKS_SUCCESS**: The operation is successful.
- Other value: The operation failed.
</details>
- - -
#### HuksHdiUpgradeKey
**API Description**
Updates the key file when the key file version is earlier than the latest version.
├── core_dependency # Dependencies of the implementation
└── core # Software implementation of the HUKS Core
├── BUILD.gn # Build script
└── core # Software implementation of the HUKS Core
├── BUILD.gn # Build script
├── include
└── src
├── hks_core_interfaces.c # Adaptation of the HDI to the HUKS Core
└── hks_core_service.c # Specific implementation
└── ... # Other function code
└── hks_core_service.c # Specific implementation
└── ... # Other function code
```
Init-Update-Finish must be used to implement HUKS Core APIs. The following provides the development procedure of Init-Update-Finish and sample code of the HUKS Core. You can refer to the following code to implement all HDI APIs.
