◆ mbedtls_ccm_setkey_shadow_key_derived()

int mbedtls_ccm_setkey_shadow_key_derived	(	mbedtls_ccm_context *const	ctx,
		mbedtls_cipher_id_t	cipher,
		uint32_t	slot_id,
		unsigned int	keybits,
		uint8_t const *	label,
		size_t	label_size,
		uint8_t const *	context,
		size_t	context_size )

Function to configure AES CCM to use a key derived from one or more slots in KMU for encryption.

See mbedtls_derive_kmu_key for details on the KDF function.

Note: A shadow key is not directly accessible, only reference information is stored in the context type; Replaces the API mbedtls_ccm_setkey.; The key derivation is executed before each request to decrypt. This function only configures the context to use a derived key.; When deriving the key from KMU registers, the derived keys exist in SRAM for a brief period of time, before being loaded into the write-only CryptoCell HW registers for AES keys before decryption.

Parameters

ctx	AES context to set the decryption key by KMU slot.
cipher	Cipher id to use.
slot_id	Identifier of the key slot (0 - 127).
keybits	Key size in bits.
label	Label to use for KDF.
label_size	Size of the label to use for KDF.
context	Context info to use for KDF.
context_size	Context info size to use for KDF.