PSA Certified
Crypto API 1.5ΒΆ
Document number: |
IHI 0086 |
Release Quality: |
Final |
Issue Number: |
0 |
Confidentiality: |
Non-confidential |
Date of Issue: |
June 2026 |
Abstract
This document is part of the PSA Certified API specifications. It defines interfaces to provide cryptographic operations and key storage services.
Contents
- 1 Introduction
- 2 Design goals
- 3 Functionality overview
- 4 Sample architectures
- 5 Library conventions
- 6 Implementation considerations
- 7 Usage considerations
- 8 Library management reference
- 9 Key management reference
- 9.1 Key attributes
- 9.2 Key types
- 9.3 Unstructured key types
- 9.4 Structured key types
- 9.5 Asymmetric key types
- 9.5.1 RSA keys
- 9.5.2 Elliptic Curve keys
- 9.5.3 Diffie Hellman keys
- 9.5.4 Leighton-Micali Signature keys
- 9.5.5 XMSS and XMSSMT keys
- 9.5.6 Module Lattice-based signature keys
- 9.5.7 Stateless Hash-based signature keys
- 9.5.8 Module Lattice-based key-encapsulation keys
- 9.5.9 SPAKE2+ keys
- 9.5.10 Support macros
- 9.6 Key lifetimes
- 9.7 Key identifiers
- 9.8 Key policies
- 9.9 Key management functions
- 10 Cryptographic operation reference
- 10.1 Algorithms
- 10.2 Message digests (Hashes)
- 10.3 Extendable-output functions (XOF)
- 10.4 Message authentication codes (MAC)
- 10.5 Unauthenticated ciphers
- 10.6 Authenticated encryption with associated data (AEAD)
- 10.7 Key wrapping
- 10.8 Key derivation
- 10.9 Asymmetric signature
- 10.9.1 RSA signature algorithms
- 10.9.2 ECDSA signature algorithms
- 10.9.3 EdDSA signature algorithms
- 10.9.4 Stateless Hash-based signature algorithms
- 10.9.5 Module Lattice-based signature algorithms
- 10.9.6 Leighton-Micali Signature algorithms
- 10.9.7 XMSS and XMSSMT algorithms
- 10.9.8 Single-part asymmetric signature functions
- 10.9.9 Multi-part asymmetric signature operations
- 10.9.10 Support macros
- 10.10 Asymmetric encryption
- 10.11 Key agreement
- 10.12 Key encapsulation
- 10.13 Password-authenticated key exchange (PAKE)
- 10.13.1 Common API for PAKE
- 10.13.2 PAKE primitives
- 10.13.3 PAKE cipher suites
- 10.13.4 PAKE roles
- 10.13.5 PAKE step types
- 10.13.6 Multi-part PAKE operations
- 10.13.7 PAKE support macros
- 10.13.8 The J-PAKE protocol
- 10.13.9 J-PAKE algorithms
- 10.13.10 The SPAKE2+ protocol
- 10.13.11 SPAKE2+ algorithms
- 10.13.12 The WPA3-SAE protocol
- 10.13.13 WPA3-SAE algorithms
- 10.14 Other cryptographic services
- A Example header file
- B Algorithm and key type encoding
- B.1 Algorithm identifier encoding
- B.1.1 Algorithm categories
- B.1.2 Hash algorithm encoding
- B.1.3 XOF algorithm encoding
- B.1.4 MAC algorithm encoding
- B.1.5 Cipher algorithm encoding
- B.1.6 AEAD algorithm encoding
- B.1.7 Key-wrapping algorithm encoding
- B.1.8 Key-derivation algorithm encoding
- B.1.9 Asymmetric signature algorithm encoding
- B.1.10 Asymmetric encryption algorithm encoding
- B.1.11 Key-agreement algorithm encoding
- B.1.12 Key-encapsulation algorithm encoding
- B.1.13 PAKE algorithm encoding
- B.2 Key type encoding
- B.1 Algorithm identifier encoding
- C Example macro implementations
- D Security Risk Assessment
- E Changes to the API
- E.1 Document change history
- E.1.1 Changes between 1.4.1 and 1.5
- E.1.2 Changes between 1.4.0 and 1.4.1
- E.1.3 Changes between 1.3.2 and 1.4.0
- E.1.4 Changes between 1.3.1 and 1.3.2
- E.1.5 Changes between 1.3.0 and 1.3.1
- E.1.6 Changes between 1.2.1 and 1.3.0
- E.1.7 Changes between 1.2.0 and 1.2.1
- E.1.8 Changes between 1.1.2 and 1.2.0
- E.1.9 Changes between 1.1.1 and 1.1.2
- E.1.10 Changes between 1.1.0 and 1.1.1
- E.1.11 Changes between 1.0.1 and 1.1.0
- E.1.12 Changes between 1.0.0 and 1.0.1
- E.1.13 Changes between 1.0 beta 3 and 1.0.0
- E.1.14 Changes between 1.0 beta 2 and 1.0 beta 3
- E.1.15 Changes between 1.0 beta 1 and 1.0 beta 2
- E.2 Planned changes for version 1.5.x
- E.3 Future additions
- E.1 Document change history