PSA Certified
Crypto API 1.1 PAKE Extension

Document number:	AES 0058
Release Quality:	Beta
Issue Number:	1
Confidentiality:	Non-confidential
Date of Issue:	17/10/2022

BETA RELEASE

This is a proposed update to the PSA Certified Crypto API [PSA-CRYPT] specification.

This is a BETA release in order to enable wider review and feedback on the changes proposed to be included in a future version of the specification.

At this quality level, the proposed changes and interfaces are complete, and suitable for initial product development. However, the specification is still subject to change.

Abstract

This document is part of the PSA Certified API specifications. It defines an extension to the Crypto API, to introduce support for Password-authenticated key exchange (PAKE) algorithms.

Contents

• About this document
  • Release information
  • License
  • References
  • Terms and abbreviations
  • Conventions
  • Current status and anticipated changes
  • Feedback

• 1. Introduction
  • 1.1. About Platform Security Architecture
  • 1.2. About the Crypto API PAKE Extension
  • 1.3. Objectives for the PAKE Extension
    • 1.3.1. Scheme review
    • 1.3.2. Scope of the PAKE Extension
• 2. Password-authenticated key exchange (PAKE)
  • 2.1. Algorithm encoding
    • 2.1.1. PAKE algorithm encoding
  • 2.2. Changes and additions to the Programming API
    • 2.2.1. PAKE algorithms
    • 2.2.2. PAKE primitives
    • 2.2.3. PAKE cipher suites
    • 2.2.4. PAKE roles
    • 2.2.5. PAKE step types
    • 2.2.6. Multi-part PAKE operations
    • 2.2.7. Support macros

• A. Example header file
  • A.1. psa/crypto.h
• B. Example macro implementations
• C. Changes to the API
  • C.1. Document change history
    • C.1.1. Changes between Beta 0 and Beta 1