3. Algorithm and key type encoding¶
These are encodings for a PAKE interface for PSA Certified Crypto API [PSA-CRYPT].
Note
These encodings will be integrated into a future version of [PSA-CRYPT].
3.1. Algorithm encoding¶
A new algorithm category is added for PAKE algorithms. The algorithm category table in [PSA-CRYPT] Appendix B is extended with the information in Table 4.
Algorithm category |
CAT |
Category details |
---|---|---|
PAKE |
|
3.1.1. PAKE algorithm encoding¶
The algorithm identifier for PAKE algorithms defined in this specification are encoded as shown in Figure 5.
Figure 5 PAKE algorithm encoding¶
The defined values for PAKE-TYPE are shown in Table 5.
The permitted values of HASH-TYPE depend on the specific PAKE algorithm.
PAKE algorithm |
PAKE-TYPE |
Algorithm identifier |
Algorithm value |
---|---|---|---|
J-PAKE |
|
|
|
SPAKE2+ with HMAC |
|
|
|
SPAKE2+ with CMAC |
|
|
|
SPAKE2+ for Matter |
|
|
hh
is the HASH-TYPE for the hash algorithm,hash
, used to construct the key derivation algorithm.
3.2. Key encoding¶
A new type of asymmetric key is added for the SPAKE2+ algorithms. The Asymmetric key sub-type values table in [PSA-CRYPT] Appendix B is extended with the information in Table 6.
Asymmetric key type |
ASYM-TYPE |
Details |
---|---|---|
SPAKE2+ |
4 |
Rationale
The ASYM-TYPE value 4 is selected as this has the same parity as the ECC sub-type, which have the value 1. The enables the same ECC-FAMILY and P values to be used when encoding a SPAKE2+ key type, as is used in the Elliptic Curve key types.
3.2.1. SPAKE2+ key encoding¶
The key type for SPAKE2+ keys defined in this specification are encoded as shown in Figure 6.
Figure 6 SPAKE2+ key encoding¶
PAIR is either 0 for a public key, or 3 for a key pair.
The defined values for ECC-FAMILY and P are shown in Table 7.
SPAKE2+ group |
ECC-FAMILY |
P |
ECC family a |
Public key value |
Key pair value |
---|---|---|---|---|---|
SECP R1 |
0x09 |
0 |
|
|
|
Twisted Edwards |
0x21 |
0 |
|
|
|
The key type value is constructed from the Elliptic Curve family using either
PSA_KEY_TYPE_SPAKE2P_PUBLIC_KEY
(
family
)
orPSA_KEY_TYPE_SPAKE2P_KEY_PAIR
(
family
)
as required.