CA and TA APIs

Secure Storage

• Starting with CCOS 1.7.1, the following secure storage APIs support configuring the encryption block size when creating persistent objects. If the flags parameter is bitwise ORed with TEE_DATA_FLAG_LARGE_CRYPTO_UNIT, the secure storage encryption block size is 3 KB. If this flag is not set, the default block size is 1 KB.

  TEE_Result TEE_CreatePersistentObject(uint32_t storageID, const void *objectID, size_t objectIDLen, uint32_t flags, TEE_ObjectHandle attributes, const void *initialData, size_t initialDataLen, TEE_ObjectHandle *object);
  TEE_Result TEE_OpenPersistentObject(uint32_t storageID, const void *objectID, size_t objectIDLen, uint32_t flags, TEE_ObjectHandle *object);

  The encryption block sizes used by the current TEE OS versions are as follows:

  1. The default block encryption size is 1 KB for the iTrustee OS and CCOS 1.7.1 (and later).
  2. For CCOS 1.7.0 and earlier, the block encryption size is 3 KB.

  If you need to migrate the secure storage files generated on the iTrustee OS to the CCOS, use CCOS 1.7.1 or later.

  If you need to migrate the secure storage files generated on CCOS 1.7.0 or earlier to a later version, add the 3 KB flag configuration to the API.

  Configuration details:

  #define TEE_DATA_FLAG_LARGE_CRYPTO_UNIT 0x80000000
  ret = TEE_OpenPersistentObject(storageID, objectID, objectIDLen, flags | TEE_DATA_FLAG_LARGE_CRYPTO_UNIT, &object);