TrustedFirmware Git Browser
Code Review Sign In
review.trustedfirmware.org / mirror / mbed-crypto / 13b68fa836e90e953ac11ec8422f7d2b606e61da
commit13b68fa836e90e953ac11ec8422f7d2b606e61da[log] [tgz]
authorGilles Peskine <Gilles.Peskine@arm.com>Wed Apr 22 20:09:12 2020 +0200
committerGilles Peskine <Gilles.Peskine@arm.com>Thu Apr 23 17:56:09 2020 +0200
tree63e633313399b461904cfe554889755c0d32a7b0
parent457b58c439977cea60ab2f39a4843de74bb514f8 [diff]
Document that Mbed Crypto has moved into Mbed TLS

State this prominently in README.md and provide a little migration
guidance.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2 files changed
tree: 63e633313399b461904cfe554889755c0d32a7b0
  1. .github/
  2. 3rdparty/
  3. ChangeLog.d/
  4. configs/
  5. docs/
  6. doxygen/
  7. include/
  8. library/
  9. programs/
  10. scripts/
  11. tests/
  12. visualc/
  13. .gitignore
  14. .globalrc
  15. .pylintrc
  16. .travis.yml
  17. ChangeLog.md
  18. CMakeLists.txt
  19. CONTRIBUTING.md
  20. DartConfiguration.tcl
  21. dco.txt
  22. LICENSE
  23. Makefile
  24. README.md
README.md

The development of Mbed Crypto has moved to Mbed TLS. No updates will be made to the mbed-crypto repository anymore.

Mbed TLS and Mbed Crypto have the same APIs, and the same build system, so most users only need to change the URL to clone or download the library from.

To save build time and possibly avoid system dependencies, you may want to exclude the X.509 and TLS parts of the library by running

scripts/config.py crypto

or

scripts/config.py crypto_full

before building Mbed TLS.

See https://github.com/ARMmbed/mbed-crypto/issues/374 for more details on this migration.

PSA cryptography API

The cryptography library in Mbed TLS is a reference implementation of the cryptography interface of the Arm Platform Security Architecture (PSA). This is a preview release of Mbed Crypto, provided for evaluation purposes only.

Arm's Platform Security Architecture (PSA) is a holistic set of threat models, security analyses, hardware and firmware architecture specifications, and an open source firmware reference implementation. PSA provides a recipe, based on industry best practice, that allows security to be consistently designed in, at both a hardware and firmware level.

The PSA cryptography API provides access to a set of cryptographic primitives. It has a dual purpose. First, it can be used in a PSA-compliant platform to build services, such as secure boot, secure storage and secure communication. Second, it can also be used independently of other PSA components on any platform.

The design goals of the PSA cryptography API include:

  • The API distinguishes caller memory from internal memory, which allows the library to be implemented in an isolated space for additional security. Library calls can be implemented as direct function calls if isolation is not desired, and as remote procedure calls if isolation is desired.
  • The structure of internal data is hidden to the application, which allows substituting alternative implementations at build time or run time, for example, in order to take advantage of hardware accelerators.
  • All access to the keys happens through handles, which allows support for external cryptoprocessors that is transparent to applications.
  • The interface to algorithms is generic, favoring algorithm agility.
  • The interface is designed to be easy to use and hard to accidentally misuse.

Arm welcomes feedback on the design of the API. If you think something could be improved, please open an issue on our Github repository. Alternatively, if you prefer to provide your feedback privately, please email us at mbed-crypto@arm.com. All feedback received by email is treated confidentially.