Create a Mbed Crypto Secure Element driver calling Parsec Rust Client

[hug-dev]

This component would allow Parsec to be used where clients directly call Mbed Crypto through PSA Crypto API in C.
This task is about creating a C wrapper complying with the Mbed Crypto Secure Element Driver interface and calling the Parsec Rust Client in Rust (see #127).
It might be needed to isolate this component into its own repository, if so please ask.

See an example of Secure Element Driver here.

Testing could be done using the Mbed Crypto tests with a Mbed Crypto library where Parsec is used via the SE driver. The PSA Developper APIs tests here might be useful for testing.

[hug-dev]

I did some more analysis on this task. In more details:

• the C application using Mbed Crypto has to call the psa_register_se_driver function to register the SE element driver to use, before calling psa_crypto_init. See an example here of an application using the ATECC608A Secure Element Driver.
• the psa_register_se_driver function takes a const psa_drv_se_t * parameter which is a structure of function pointers, containing pointers to the crypto and key management functions to implement.
• this task is about creating a (static for now) library (parsec_tpm_se.a) and a header file (parsec_tpm_se.h) exposing a symbol parsec_tpm_se of type const psa_drv_se_t *. The library can be linked with the application which can use the symbol to call the register function.

About the execution:

• a Rust library crate, in its own repo will be created. This crate will generate the static library, to be linked with C code. It will expose the parsec_tpm_se symbol through C FFI. It will have dependence on the Parsec Client. It will use direct authentication and the TPM provider.
• the Rust driver will not implement all SE functions: only some of the key management (psa_drv_se_key_management_t) and asymmetric crypto (psa_drv_se_asymmetric_t: sign and verify) ones. Not all parameters will be supported as Parsec does not support all parameters for key attributes and algorithms.
• For testing on the fly, a C application will be created that links with Mbed Crypto and the Parsec SE driver, it will register the Parsec driver and try some Mbed Crypto operations making sure it goes through Parsec (check with logs). This can be tested with the software TPM library (both on x86 and Aarch64) and on real hardware (raspberry pi with a hardware TPM).
• For more complete testing, the PSA Developper APIs test will be used.
• The Rust crate must compile on Linux on Aarch64 target. A usual CI combaination of GitHub actions and Travis can be set to test both architecture.

[hug-dev]

The repository has been created here. It contains a basic shell to be able to build the crate as a static library and link it to a C application.
A test/example of a C application using it is in c-tests. The ci.sh script details the steps needed to build the Mbed Crypto library, the Parsec SE driver, the C example and link all three together. To run it needs a Parsec service running on the system with the TPM provider.
This will be added on the CI.
To complete the key_management and asymmetric methods, there will need to be a way to translate between the PSA C structures (psa_key_attributes_t, psa_algorithm_t) to the Parsec Rust ones of the interface (KeyAttributes, Algorithm).
This step might be helped by the rust-psa-crypto crate under development.

[hug-dev]

The Secure Element Driver is functionally complete, in the same repository. Testing using the PSA Functionnal APIs has been tried in ARM-software/psa-arch-tests#220

[hug-dev]

Closing as done.