Secure Storage in Raspberry Pi.

[ChandlerBingg]

Hi,

I've wrote a TA that stores random generated keys into the secure storage, following the examples available, able to read it out as well within the same TA. However, if I were to write another application to act as a "server" listening for request to retrieve a key in secure storage, when given the appropriate ID of the key stored. I'm unable to do so, receiving the following error. read_raw_object:79 Failed to open persistent object, res=0xffff0008 So I guess my question is, is it possible to read into secure storage via another TA, and not the initial TA that wrote into the secure storage, if so I'm probably doing something wrong.

Sorry, for creating an issue here, I'm not sure if there's any forum that I could ask in regards to OP-TEE other than here.

Thanks in advance!

[jbech-linaro]

Hi @ChandlerBingg , it's OK to ask here, but usually people submit questions that doesn't fit anywhere else to the "OP-TEE OS" git (see here for more details).

I'm a bit puzzled here. My initial reply to you was going to be: _Each TA have a unique key (see here), so that is by design that you cannot load things from secure storage from another TA. Remember that a TA should basically work as a sandboxed application. What you can do if you need to retrieve the information from another TA is to use the "TA2TA" interface, to let two TA's talk to each other directly._

But when looking more closely into this, it seems like it all still rely on the FEK as the initial secure storage implementation did. In that case it looks like another TA should (incorrectly IMHO) be able to retrieve another TA's data. Need to dig into the details here a bit more as well as discuss with others.

[jforissier]

@jbech-linaro the FEK is per-TA since commit fde4a756bfc8 ("storage: encrypt the FEK with a TA-specific key"), but even if we put that aside, the location were data are stored are separated for each TA if I'm not mistaken. So the per-key TA is an additional security but I expect the error code to really mean "not found" (and not "invalid key").

[ChandlerBingg]

@jbech-linaro What you're saying is that, my TA cannot access the keys stored in secure storage, because it was stored by another TA? Then would it be possible to create another CA, that calls to the same TA, copied from my initial TA, but I compile it as another application name, all while keeping the same UUID? So, I would have two TA with the same UUID, but different application name.
If not, how do I go about using TA2TA interface, and what would I need to get parsed back for this to work?

[jforissier]

my TA cannot access the keys stored in secure storage, because it was stored by another TA?

Correct.

TA2TA interface

Sounds like a good option :)

[ChandlerBingg]

my TA cannot access the keys stored in secure storage, because it was stored by another TA?

Correct.

TA2TA interface

Sounds like a good option :)

Alright, I'll give it a shot, thank you! 👍