# Crypto - Platform
This module includes the platform abstraction for Crypto.
## Summary
| ### Enumerations ||
|---|---|
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga0411cd49bb5b71852cecd93bcbf0ca2d{ https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga0411cd49bb5b71852cecd93bcbf0ca2da16cd431bbca41fe19ae7f2c3bcd88720 = 0, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga0411cd49bb5b71852cecd93bcbf0ca2da9fcd4ddef67de3634d5096e633b1cf0f = 1 << 0, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga0411cd49bb5b71852cecd93bcbf0ca2da6ebeecc0a696950b7898e03c7997bd34 = 1 << 1, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga0411cd49bb5b71852cecd93bcbf0ca2da40497ebdeac197927f4286e617fb0a3a = 1 << 2, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga0411cd49bb5b71852cecd93bcbf0ca2da4df005c350ef30ba91ce835bee9a71ba = 1 << 3, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga0411cd49bb5b71852cecd93bcbf0ca2da409164ccc8ece9aa363144970ed282a5 = 1 << 4, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga0411cd49bb5b71852cecd93bcbf0ca2dad76fd9550e3fdf67bf5f46fecd6d4bc6 = 1 << 5 }` | enumDefines the key usage flags. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga182e8bbd84ef18daa43e3bf895bbef98{ https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga182e8bbd84ef18daa43e3bf895bbef98ae60839edf49cdc785c4652dd9f35f01c, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga182e8bbd84ef18daa43e3bf895bbef98a18d43e91ae30937ef357ed95c6adca07, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga182e8bbd84ef18daa43e3bf895bbef98a231509b4374aa0596d393bbdff864b51, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga182e8bbd84ef18daa43e3bf895bbef98ac43767be44dd55f51e042409eba81ba8, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga182e8bbd84ef18daa43e3bf895bbef98a09d4b555b2e61d057fc3c7dd0f71ab47 }` | enumDefines the key algorithms. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gae7e215fdded7dd9d4941dc80201f9386{ https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ggae7e215fdded7dd9d4941dc80201f9386a0940512c492258c7b07fd9d4334bb476, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ggae7e215fdded7dd9d4941dc80201f9386a136142aafc0945d66366ea35473ccb86 }` | enumDefines the key storage types. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga90be03423b68a623b485f074309c07c4{ https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga90be03423b68a623b485f074309c07c4ab97d0ee0a1ede54c8354521bdf5d3616, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga90be03423b68a623b485f074309c07c4ae12c6a3f1421cbc0c0a18a46558a91bf, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga90be03423b68a623b485f074309c07c4afc5838a3119d4da5e51be0bd182c50ed, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga90be03423b68a623b485f074309c07c4af5fb24ff925c1fb2308c02d6afc06fbc, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gga90be03423b68a623b485f074309c07c4a5b5dbeade5b173fb53bb566340e8d201 }` | enumDefines the key types. |
| ### Typedefs ||
|---|---|
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga8f25f99d90a2d41fabcfc9dd38fbcb7c` | typedef `struct https://openthread.io/reference/struct/ot-crypto-context` |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga46fa575b15dbd0804f8df6808568ca67` | typedef `struct https://openthread.io/reference/struct/ot-crypto-key` |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b` | typedef `uint32_t` This datatype represents the key reference. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga9c12c5014ef86d3c393b33e2ce86751a` | typedef `struct https://openthread.io/reference/struct/ot-plat-crypto-aes-ccm-config` |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga18b982f5f5065a01a8b1a457f8bafd1e` | typedef `struct https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-key-pair` |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gadbbd176afd6940f6b87896003af6c23a` | typedef `struct https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-public-key` |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga1c4583a632200b302bbf6a05c5b77307` | typedef `struct https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-signature` |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gace427073beea7a52ea6c417872e8e915` | typedef `struct https://openthread.io/reference/struct/ot-plat-crypto-sha256-hash` Represents a SHA-256 hash. |
| ### Variables ||
|---|---|
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gacc1d36efacba6597f0a8cbf247e34836` | `https://openthread.io/reference/group/plat-toolchain#group__plat-toolchain_1gaba6ad63129c3a790957a9b149a65891b struct https://openthread.io/reference/struct/ot-plat-crypto-sha256-hash` |
| ### Functions ||
|---|---|
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga5e77bd2484471434e34b9ebc95d29daa(bool aEncrypt, const https://openthread.io/reference/struct/ot-plat-crypto-aes-ccm-config *aConfig, const uint8_t *aHeader, uint8_t *aData)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Performs in-place AES-CCM\* authenticated encryption or decryption in a single call. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga5509faf2b67b9e61ecd6f34b89d59a50(https://openthread.io/reference/struct/ot-crypto-context *aContext, const uint8_t *aInput, uint8_t *aOutput)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Encrypt the given data. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga680409053b4dfc240c329689cec37f38(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Free the AES context. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga87f934f602dad47af0ef7e6d58d5072b(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Initialise the AES operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gaff3663d4ff18b5c21cbe79a63670115d(https://openthread.io/reference/struct/ot-crypto-context *aContext, const https://openthread.io/reference/struct/ot-crypto-key *aKey)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Set the key for AES operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gabbe58c19c8dfbe269c1644d02ff8abad(size_t aNum, size_t aSize)` | `void *` Dynamically allocates new memory for the Crypto subsystem. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gab3b212fa8afdb3781c9cffd65775d1b8(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b aKeyRef)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Destroy a key stored in PSA ITS. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga7e3d7ffcd7c93f4bdac23fbb61a74a2a(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b aKeyRef, https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-public-key *aPublicKey)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Get the associated public key from the key reference passed. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga1d7be8b6ed7e2889176a85c691e011f0(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b aKeyRef)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Generate and import a new ECDSA key-pair at reference passed. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gacd16478a842f077a9a6c14689a9e8d77(https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-key-pair *aKeyPair)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Generate and populate the output buffer with a new ECDSA key-pair. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga18e51e2524a6253353aea3d322f02b66(const https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-key-pair *aKeyPair, https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-public-key *aPublicKey)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Get the associated public key from the input context. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga11a771d1a5b4c6b4269f39bab532c9ee(const https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-key-pair *aKeyPair, const https://openthread.io/reference/struct/ot-plat-crypto-sha256-hash *aHash, https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-signature *aSignature)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Calculate the ECDSA signature for a hashed message using the private key from the input context. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gade5be028483e28fcb29a95a9cb3d0679(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b aKeyRef, const https://openthread.io/reference/struct/ot-plat-crypto-sha256-hash *aHash, https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-signature *aSignature)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Calculate the ECDSA signature for a hashed message using the Key reference passed. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga761f13d9d46540cba3753813b7bd809d(const https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-public-key *aPublicKey, const https://openthread.io/reference/struct/ot-plat-crypto-sha256-hash *aHash, const https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-signature *aSignature)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Use the key from the input context to verify the ECDSA signature of a hashed message. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga6a0c447a92df927a0719e21ce426ccd4(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b aKeyRef, const https://openthread.io/reference/struct/ot-plat-crypto-sha256-hash *aHash, const https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-signature *aSignature)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Use the keyref to verify the ECDSA signature of a hashed message. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gad71d8dbf6237bfe5494c203782733820(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b aKeyRef, uint8_t *aBuffer, size_t aBufferLen, size_t *aKeyLen)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Export a key stored in PSA ITS. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gad1cf9741e3c85a06ccd2504e056e7dc9(void *aPtr)` | `void` Frees memory that was dynamically allocated by `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gabbe58c19c8dfbe269c1644d02ff8abad`. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga7a26c7693fd96ed92b45611ac48509a7(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b aKeyRef)` | `bool` Check if the key ref passed has an associated key in PSA ITS. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga7a090879f76969fb70bdc8d8a7ed8038(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Uninitialize the HKDF context. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga6cc9399664d4890c5017d4a8f7bc9c52(https://openthread.io/reference/struct/ot-crypto-context *aContext, const uint8_t *aInfo, uint16_t aInfoLength, uint8_t *aOutputKey, uint16_t aOutputKeyLength)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Perform HKDF Expand step. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga2d7015f37cc29d01486de492f32f960a(https://openthread.io/reference/struct/ot-crypto-context *aContext, const uint8_t *aSalt, uint16_t aSaltLength, const https://openthread.io/reference/struct/ot-crypto-key *aInputKey)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Perform HKDF Extract step. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gad69193ef236d54d7389770988335e22b(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Initialise the HKDF context. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gaec839ff620a02af803b2877e7c18b41c(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Uninitialize the HMAC operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gab916cece1d3fa952ca72a9b2ec9c7de5(https://openthread.io/reference/struct/ot-crypto-context *aContext, uint8_t *aBuf, size_t aBufLength)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Complete the HMAC operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga54548af27e1818eca1e14d69b20b8ab7(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Initialize the HMAC operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga4d2251a636206907fb3295f4199eaa3a(https://openthread.io/reference/struct/ot-crypto-context *aContext, const https://openthread.io/reference/struct/ot-crypto-key *aKey)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Start HMAC operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga22be491d7ac1333e77a79d576abf82f3(https://openthread.io/reference/struct/ot-crypto-context *aContext, const void *aBuf, uint16_t aBufLength)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Update the HMAC operation with new input. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gadea5b2f825d866c19edd2a40b3154f27(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b *aKeyRef, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga90be03423b68a623b485f074309c07c4 aKeyType, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga182e8bbd84ef18daa43e3bf895bbef98 aKeyAlgorithm, int aKeyUsage, https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gae7e215fdded7dd9d4941dc80201f9386 aKeyPersistence, const uint8_t *aKey, size_t aKeyLen)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Import a key into PSA ITS. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga8502d1a87279811d5acd8219acaeea13(void)` | `void` Initialize the Crypto module. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gacb1caecf3f580408059624b28970ea97(https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga829b526f41c89661fdcc649d5789603b aKeyRef)` | `bool` Check whether a given key reference is valid. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga55fb33124c036af79ad1d1db7cd24ac5(const uint8_t *aPassword, uint16_t aPasswordLen, const uint8_t *aSalt, uint16_t aSaltLen, uint32_t aIterationCounter, uint16_t aKeyLen, uint8_t *aKey)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Perform PKCS#5 PBKDF2 using CMAC (AES-CMAC-PRF-128). |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga51ea2cae090e3895a71a46e321323bda(void)` | `void` Deinitialize cryptographically-secure pseudorandom number generator (CSPRNG). |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga8e27e248e8b29b46d8b52200644a5d32(uint8_t *aBuffer, uint16_t aSize)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Fills a given buffer with cryptographically secure random bytes. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga826215f95c818b4aade3e7c0fe15a2bc(void)` | `void` Initialize cryptographically-secure pseudorandom number generator (CSPRNG). |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga72577148b321f302dc8e79a8e736e17c(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Uninitialize the SHA-256 operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga29e36e308d953b787b123a295a1fbaa0(https://openthread.io/reference/struct/ot-crypto-context *aContext, uint8_t *aHash, uint16_t aHashSize)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Finish SHA-256 operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gaebb675f6f744a0dae4c3a42faa3a1196(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Initialise the SHA-256 operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga5340a98088f065fe277f48aaf82c3ec1(https://openthread.io/reference/struct/ot-crypto-context *aContext)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Start SHA-256 operation. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gace5abc05cdf10817ffd9bfb62605bb1d(https://openthread.io/reference/struct/ot-crypto-context *aContext, const void *aBuf, uint16_t aBufLength)` | `https://openthread.io/reference/group/api-error#group__api-error_1gabaaa90aaa35da8f9d394a227a23a6a49` Update SHA-256 operation with new input. |
| ### Macros ||
|---|---|
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga4b43ae892122141aff052219e6452d2a 125` | Max buffer size (in bytes) for representing the EDCSA key-pair in DER format. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga16ee2f60aa8be85fda79262c7fd65acf 64` | Buffer size (in bytes) for representing the EDCSA public key. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga0f48a9baebbbcb85d83c044a23b03c28 64` | Buffer size (in bytes) for representing the EDCSA signature. |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gaa3e2fbede24add12a4000870d16fe066 30` | Max PBKDF2 SALT length: salt prefix (6) + extended panid (8) + network name (16) |
| `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gac8a16d3cf2f90352378e082056be0ef8 32` | Length of SHA256 hash (in bytes). |
| ### Structs ||
|---|---|
| [otCryptoContext](https://openthread.io/reference/struct/ot-crypto-context) | Stores the context object for platform APIs. |
| [otCryptoKey](https://openthread.io/reference/struct/ot-crypto-key) | Represents the Key Material required for Crypto operations. |
| [otPlatCryptoAesCcmConfig](https://openthread.io/reference/struct/ot-plat-crypto-aes-ccm-config) | Holds the parameters for a one-shot AES-CCM\* operation passed to `otPlatCryptoAesCcmProcessOneShot`. |
| [otPlatCryptoEcdsaKeyPair](https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-key-pair) | Represents an ECDSA key pair (public and private keys). |
| [otPlatCryptoEcdsaPublicKey](https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-public-key) | Represents a ECDSA public key. |
| [otPlatCryptoEcdsaSignature](https://openthread.io/reference/struct/ot-plat-crypto-ecdsa-signature) | Represents an ECDSA signature. |
| [otPlatCryptoSha256Hash](https://openthread.io/reference/struct/ot-plat-crypto-sha256-hash) | Represents a SHA-256 hash. |
## Enumerations
### Anonymous Enum 7
```
Anonymous Enum 7
```
Defines the key usage flags.
| Properties ||
|---|---|
| `OT_CRYPTO_KEY_USAGE_DECRYPT` | Key Usage: AES ECB. |
| `OT_CRYPTO_KEY_USAGE_DERIVE` | Key Usage: Derive. |
| `OT_CRYPTO_KEY_USAGE_ENCRYPT` | Key Usage: Encryption (vendor defined). |
| `OT_CRYPTO_KEY_USAGE_EXPORT` | Key Usage: Key can be exported. |
| `OT_CRYPTO_KEY_USAGE_NONE` | Key Usage: Key Usage is empty. |
| `OT_CRYPTO_KEY_USAGE_SIGN_HASH` | Key Usage: Sign Hash. |
| `OT_CRYPTO_KEY_USAGE_VERIFY_HASH` | Key Usage: Verify Hash. |
### otCryptoKeyAlgorithm
```
otCryptoKeyAlgorithm
```
Defines the key algorithms.
| Properties ||
|---|---|
| `OT_CRYPTO_KEY_ALG_AES_ECB` | Key Algorithm: AES ECB. |
| `OT_CRYPTO_KEY_ALG_ECDSA` | Key Algorithm: ECDSA. |
| `OT_CRYPTO_KEY_ALG_HKDF_SHA256` | Key Algorithm: HKDF SHA-256. |
| `OT_CRYPTO_KEY_ALG_HMAC_SHA_256` | Key Algorithm: HMAC SHA-256. |
| `OT_CRYPTO_KEY_ALG_VENDOR` | Key Algorithm: Vendor Defined. |
### otCryptoKeyStorage
```
otCryptoKeyStorage
```
Defines the key storage types.
| Properties ||
|---|---|
| `OT_CRYPTO_KEY_STORAGE_PERSISTENT` | Key Persistence: Key is persistent. |
| `OT_CRYPTO_KEY_STORAGE_VOLATILE` | Key Persistence: Key is volatile. |
### otCryptoKeyType
```
otCryptoKeyType
```
Defines the key types.
| Properties ||
|---|---|
| `OT_CRYPTO_KEY_TYPE_AES` | Key Type: AES. |
| `OT_CRYPTO_KEY_TYPE_DERIVE` | Key Type: Derive. |
| `OT_CRYPTO_KEY_TYPE_ECDSA` | Key Type: ECDSA. |
| `OT_CRYPTO_KEY_TYPE_HMAC` | Key Type: HMAC. |
| `OT_CRYPTO_KEY_TYPE_RAW` | Key Type: Raw Data. |
## Typedefs
### otCryptoContext
```
struct otCryptoContext otCryptoContext
```
### otCryptoKey
```
struct otCryptoKey otCryptoKey
```
### otCryptoKeyRef
```
uint32_t otCryptoKeyRef
```
This datatype represents the key reference.
### otPlatCryptoAesCcmConfig
```
struct otPlatCryptoAesCcmConfig otPlatCryptoAesCcmConfig
```
### otPlatCryptoEcdsaKeyPair
```
struct otPlatCryptoEcdsaKeyPair otPlatCryptoEcdsaKeyPair
```
### otPlatCryptoEcdsaPublicKey
```
struct otPlatCryptoEcdsaPublicKey otPlatCryptoEcdsaPublicKey
```
### otPlatCryptoEcdsaSignature
```
struct otPlatCryptoEcdsaSignature otPlatCryptoEcdsaSignature
```
### otPlatCryptoSha256Hash
```
struct otPlatCryptoSha256Hash otPlatCryptoSha256Hash
```
Represents a SHA-256 hash.
## Variables
### OT_TOOL_PACKED_END
```
OT_TOOL_PACKED_BEGIN struct otPlatCryptoSha256Hash OT_TOOL_PACKED_END
```
## Functions
### otPlatCryptoAesCcmProcessOneShot
```
otError otPlatCryptoAesCcmProcessOneShot(
bool aEncrypt,
const otPlatCryptoAesCcmConfig *aConfig,
const uint8_t *aHeader,
uint8_t *aData
)
```
Performs in-place AES-CCM\* authenticated encryption or decryption in a single call.
For encryption (`aEncrypt` == true):
- Plaintext at `aData` is replaced with ciphertext in-place.
- The authentication tag is written to `aData` + `aConfig->mPlainTextLength`.
For decryption (`aEncrypt` == false):
- Ciphertext at `aData` is replaced with plaintext in-place.
- The tag to verify must be at `aData` + `aConfig->mPlainTextLength`.
Requires `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_ONE_SHOT_ENABLE`.
Default weak mbedTLS and PSA implementations are provided.
Details Parameters `[in] aEncrypt` True to encrypt and generate tag; false to decrypt and verify tag. `[in] aConfig` CCM\* parameters (key, nonce, lengths). `[in] aHeader` Additional authenticated data (not encrypted). May be NULL if header length is 0. `[in,out] aData` Payload buffer (plaintext on encrypt entry, ciphertext on decrypt entry). The buffer must hold `aConfig->mPlainTextLength` + `aConfig->mTagLength` bytes. Return Values `OT_ERROR_NONE` Success. `OT_ERROR_SECURITY` Tag mismatch (decrypt only). `OT_ERROR_FAILED` Operation failed.
### otPlatCryptoAesEncrypt
```
otError otPlatCryptoAesEncrypt(
otCryptoContext *aContext,
const uint8_t *aInput,
uint8_t *aOutput
)
```
Encrypt the given data.
Details Parameters `[in] aContext` Context for AES operation. `[in] aInput` Pointer to the input buffer. `[in] aOutput` Pointer to the output buffer. Return Values `OT_ERROR_NONE` Successfully encrypted `aInput`. `OT_ERROR_FAILED` Failed to encrypt `aInput`. `OT_ERROR_INVALID_ARGS` `aContext` or `aKey` or `aOutput` were NULL
### otPlatCryptoAesFree
```
otError otPlatCryptoAesFree(
otCryptoContext *aContext
)
```
Free the AES context.
Details Parameters `[in] aContext` Context for AES operation. Return Values `OT_ERROR_NONE` Successfully freed AES context. `OT_ERROR_FAILED` Failed to free AES context. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoAesInit
```
otError otPlatCryptoAesInit(
otCryptoContext *aContext
)
```
Initialise the AES operation.
> [!NOTE]
> **Note:** If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, `aContext` is populated by the platform. Otherwise OpenThread core allocates and populates it.
> [!NOTE]
> **Note:** The platform driver shall point the context to the correct object such as psa_key_id or mbedtls_aes_context_t.
Details Parameters `[in] aContext` Context for AES operation. Return Values `OT_ERROR_NONE` Successfully Initialised AES operation. `OT_ERROR_FAILED` Failed to Initialise AES operation. `OT_ERROR_INVALID_ARGS` `aContext` was NULL `OT_ERROR_NO_BUFS` Cannot allocate the context.
### otPlatCryptoAesSetKey
```
otError otPlatCryptoAesSetKey(
otCryptoContext *aContext,
const otCryptoKey *aKey
)
```
Set the key for AES operation.
Details Parameters `[in] aContext` Context for AES operation. `[out] aKey` Key to use for AES operation. Return Values `OT_ERROR_NONE` Successfully set the key for AES operation. `OT_ERROR_FAILED` Failed to set the key for AES operation. `OT_ERROR_INVALID_ARGS` `aContext` or `aKey` was NULL
### otPlatCryptoCAlloc
```
void * otPlatCryptoCAlloc(
size_t aNum,
size_t aSize
)
```
Dynamically allocates new memory for the Crypto subsystem.
On platforms that support it, they should redirect to `calloc`. For those that don't support `calloc`, they should implement the standard `calloc` behavior.
See:
Is required for `OPENTHREAD_CONFIG_HEAP_EXTERNAL_ENABLE`.
Details Parameters `[in] aNum` The number of blocks to allocate `[in] aSize` The size of each block to allocate Return Values `void*` The pointer to the front of the memory allocated `NULL` Failed to allocate the memory requested.
### otPlatCryptoDestroyKey
```
otError otPlatCryptoDestroyKey(
otCryptoKeyRef aKeyRef
)
```
Destroy a key stored in PSA ITS.
> [!NOTE]
> **Note:** This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
Details Parameters `[in] aKeyRef` The key ref to be destroyed Return Values `OT_ERROR_NONE` Successfully destroyed the key. `OT_ERROR_FAILED` Failed to destroy the key.
### otPlatCryptoEcdsaExportPublicKey
```
otError otPlatCryptoEcdsaExportPublicKey(
otCryptoKeyRef aKeyRef,
otPlatCryptoEcdsaPublicKey *aPublicKey
)
```
Get the associated public key from the key reference passed.
The public key is stored differently depending on the crypto backend library being used (OPENTHREAD_CONFIG_CRYPTO_LIB).
This API must make sure to return the public key as a byte sequence representation of an uncompressed curve point (RFC 6605 - sec 4)
> [!NOTE]
> **Note:** This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
Details Parameters `[in] aKeyRef` Key Reference to the slot where the key-pair is stored. `[out] aPublicKey` A pointer to an ECDSA public key structure to store the public key. Return Values `OT_ERROR_NONE` Public key was retrieved successfully, and `aBuffer` is updated. `OT_ERROR_PARSE` The key-pair DER format could not be parsed (invalid format). `OT_ERROR_INVALID_ARGS` The `aContext` is NULL.
### otPlatCryptoEcdsaGenerateAndImportKey
```
otError otPlatCryptoEcdsaGenerateAndImportKey(
otCryptoKeyRef aKeyRef
)
```
Generate and import a new ECDSA key-pair at reference passed.
> [!NOTE]
> **Note:** This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
Details Parameters `[in] aKeyRef` Key Reference to the slot where the key-pair is stored. Return Values `OT_ERROR_NONE` A new key-pair was generated successfully. `OT_ERROR_NO_BUFS` Failed to allocate buffer for key generation. `OT_ERROR_NOT_CAPABLE` Feature not supported. `OT_ERROR_FAILED` Failed to generate key-pair.
### otPlatCryptoEcdsaGenerateKey
```
otError otPlatCryptoEcdsaGenerateKey(
otPlatCryptoEcdsaKeyPair *aKeyPair
)
```
Generate and populate the output buffer with a new ECDSA key-pair.
Details Parameters `[out] aKeyPair` A pointer to an ECDSA key-pair structure to store the generated key-pair. Return Values `OT_ERROR_NONE` A new key-pair was generated successfully. `OT_ERROR_NO_BUFS` Failed to allocate buffer for key generation. `OT_ERROR_NOT_CAPABLE` Feature not supported. `OT_ERROR_FAILED` Failed to generate key-pair.
### otPlatCryptoEcdsaGetPublicKey
```
otError otPlatCryptoEcdsaGetPublicKey(
const otPlatCryptoEcdsaKeyPair *aKeyPair,
otPlatCryptoEcdsaPublicKey *aPublicKey
)
```
Get the associated public key from the input context.
Details Parameters `[in] aKeyPair` A pointer to an ECDSA key-pair structure where the key-pair is stored. `[out] aPublicKey` A pointer to an ECDSA public key structure to store the public key. Return Values `OT_ERROR_NONE` Public key was retrieved successfully, and `aBuffer` is updated. `OT_ERROR_PARSE` The key-pair DER format could not be parsed (invalid format). `OT_ERROR_INVALID_ARGS` The `aContext` is NULL.
### otPlatCryptoEcdsaSign
```
otError otPlatCryptoEcdsaSign(
const otPlatCryptoEcdsaKeyPair *aKeyPair,
const otPlatCryptoSha256Hash *aHash,
otPlatCryptoEcdsaSignature *aSignature
)
```
Calculate the ECDSA signature for a hashed message using the private key from the input context.
Uses the deterministic digital signature generation procedure from RFC 6979.
Details Parameters `[in] aKeyPair` A pointer to an ECDSA key-pair structure where the key-pair is stored. `[in] aHash` A pointer to a SHA-256 hash structure where the hash value for signature calculation is stored. `[out] aSignature` A pointer to an ECDSA signature structure to output the calculated signature. Return Values `OT_ERROR_NONE` The signature was calculated successfully, `aSignature` was updated. `OT_ERROR_PARSE` The key-pair DER format could not be parsed (invalid format). `OT_ERROR_NO_BUFS` Failed to allocate buffer for signature calculation. `OT_ERROR_INVALID_ARGS` The `aContext` is NULL.
### otPlatCryptoEcdsaSignUsingKeyRef
```
otError otPlatCryptoEcdsaSignUsingKeyRef(
otCryptoKeyRef aKeyRef,
const otPlatCryptoSha256Hash *aHash,
otPlatCryptoEcdsaSignature *aSignature
)
```
Calculate the ECDSA signature for a hashed message using the Key reference passed.
Uses the deterministic digital signature generation procedure from RFC 6979.
> [!NOTE]
> **Note:** This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
Details Parameters `[in] aKeyRef` Key Reference to the slot where the key-pair is stored. `[in] aHash` A pointer to a SHA-256 hash structure where the hash value for signature calculation is stored. `[out] aSignature` A pointer to an ECDSA signature structure to output the calculated signature. Return Values `OT_ERROR_NONE` The signature was calculated successfully, `aSignature` was updated. `OT_ERROR_PARSE` The key-pair DER format could not be parsed (invalid format). `OT_ERROR_NO_BUFS` Failed to allocate buffer for signature calculation. `OT_ERROR_INVALID_ARGS` The `aContext` is NULL.
### otPlatCryptoEcdsaVerify
```
otError otPlatCryptoEcdsaVerify(
const otPlatCryptoEcdsaPublicKey *aPublicKey,
const otPlatCryptoSha256Hash *aHash,
const otPlatCryptoEcdsaSignature *aSignature
)
```
Use the key from the input context to verify the ECDSA signature of a hashed message.
Details Parameters `[in] aPublicKey` A pointer to an ECDSA public key structure where the public key for signature verification is stored. `[in] aHash` A pointer to a SHA-256 hash structure where the hash value for signature verification is stored. `[in] aSignature` A pointer to an ECDSA signature structure where the signature value to be verified is stored. Return Values `OT_ERROR_NONE` The signature was verified successfully. `OT_ERROR_SECURITY` The signature is invalid. `OT_ERROR_INVALID_ARGS` The key or hash is invalid. `OT_ERROR_NO_BUFS` Failed to allocate buffer for signature verification.
### otPlatCryptoEcdsaVerifyUsingKeyRef
```
otError otPlatCryptoEcdsaVerifyUsingKeyRef(
otCryptoKeyRef aKeyRef,
const otPlatCryptoSha256Hash *aHash,
const otPlatCryptoEcdsaSignature *aSignature
)
```
Use the keyref to verify the ECDSA signature of a hashed message.
> [!NOTE]
> **Note:** This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
Details Parameters `[in] aKeyRef` Key Reference to the slot where the key-pair is stored. `[in] aHash` A pointer to a SHA-256 hash structure where the hash value for signature verification is stored. `[in] aSignature` A pointer to an ECDSA signature structure where the signature value to be verified is stored. Return Values `OT_ERROR_NONE` The signature was verified successfully. `OT_ERROR_SECURITY` The signature is invalid. `OT_ERROR_INVALID_ARGS` The key or hash is invalid. `OT_ERROR_NO_BUFS` Failed to allocate buffer for signature verification.
### otPlatCryptoExportKey
```
otError otPlatCryptoExportKey(
otCryptoKeyRef aKeyRef,
uint8_t *aBuffer,
size_t aBufferLen,
size_t *aKeyLen
)
```
Export a key stored in PSA ITS.
> [!NOTE]
> **Note:** This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
Details Parameters `[in] aKeyRef` The key ref to be used for crypto operations. `[out] aBuffer` Pointer to the buffer where key needs to be exported. `[in] aBufferLen` Length of the buffer passed to store the exported key. `[out] aKeyLen` Pointer to return the length of the exported key. Return Values `OT_ERROR_NONE` Successfully exported `aKeyRef`. `OT_ERROR_FAILED` Failed to export `aKeyRef`. `OT_ERROR_INVALID_ARGS` `aBuffer` was NULL
### otPlatCryptoFree
```
void otPlatCryptoFree(
void *aPtr
)
```
Frees memory that was dynamically allocated by `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1gabbe58c19c8dfbe269c1644d02ff8abad`.
Is required for `OPENTHREAD_CONFIG_HEAP_EXTERNAL_ENABLE`.
Details Parameters `[in] aPtr` A pointer the memory blocks to free. The pointer may be NULL.
### otPlatCryptoHasKey
```
bool otPlatCryptoHasKey(
otCryptoKeyRef aKeyRef
)
```
Check if the key ref passed has an associated key in PSA ITS.
> [!NOTE]
> **Note:** This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
Details Parameters `[in] aKeyRef` The Key Ref to check. Return Values `TRUE` There is an associated key with `aKeyRef`. `FALSE` There is no associated key with `aKeyRef`.
### otPlatCryptoHkdfDeinit
```
otError otPlatCryptoHkdfDeinit(
otCryptoContext *aContext
)
```
Uninitialize the HKDF context.
Details Parameters `[in] aContext` Context for HKDF operation. Return Values `OT_ERROR_NONE` Successfully un-initialised HKDF operation. `OT_ERROR_FAILED` Failed to un-initialised HKDF operation. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoHkdfExpand
```
otError otPlatCryptoHkdfExpand(
otCryptoContext *aContext,
const uint8_t *aInfo,
uint16_t aInfoLength,
uint8_t *aOutputKey,
uint16_t aOutputKeyLength
)
```
Perform HKDF Expand step.
Details Parameters `[in] aContext` Operation context for HKDF operation. `[in] aInfo` Pointer to the Info sequence. `[in] aInfoLength` Length of the Info sequence. `[out] aOutputKey` Pointer to the output Key. `[in] aOutputKeyLength` Size of the output key buffer. Return Values `OT_ERROR_NONE` HKDF Expand was successful. `OT_ERROR_FAILED` HKDF Expand failed. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoHkdfExtract
```
otError otPlatCryptoHkdfExtract(
otCryptoContext *aContext,
const uint8_t *aSalt,
uint16_t aSaltLength,
const otCryptoKey *aInputKey
)
```
Perform HKDF Extract step.
Details Parameters `[in] aContext` Operation context for HKDF operation. `[in] aSalt` Pointer to the Salt for HKDF. `[in] aSaltLength` Length of Salt. `[in] aInputKey` Pointer to the input key. Return Values `OT_ERROR_NONE` HKDF Extract was successful. `OT_ERROR_FAILED` HKDF Extract failed.
### otPlatCryptoHkdfInit
```
otError otPlatCryptoHkdfInit(
otCryptoContext *aContext
)
```
Initialise the HKDF context.
> [!NOTE]
> **Note:** If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, `aContext` is populated by the platform. Otherwise OpenThread core allocates and populates it.
> [!NOTE]
> **Note:** The platform driver shall point the context to the correct object such as psa_key_derivation_operation_t or HmacSha256::Hash
Details Parameters `[in] aContext` Context for HKDF operation. Return Values `OT_ERROR_NONE` Successfully Initialised HKDF operation. `OT_ERROR_FAILED` Failed to Initialise HKDF operation. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoHmacSha256Deinit
```
otError otPlatCryptoHmacSha256Deinit(
otCryptoContext *aContext
)
```
Uninitialize the HMAC operation.
Details Parameters `[in] aContext` Context for HMAC operation. Return Values `OT_ERROR_NONE` Successfully uninitialized HMAC operation. `OT_ERROR_FAILED` Failed to uninitialized HMAC operation. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoHmacSha256Finish
```
otError otPlatCryptoHmacSha256Finish(
otCryptoContext *aContext,
uint8_t *aBuf,
size_t aBufLength
)
```
Complete the HMAC operation.
Details Parameters `[in] aContext` Context for HMAC operation. `[out] aBuf` A pointer to the output buffer. `[in] aBufLength` The length of `aBuf` in bytes. Return Values `OT_ERROR_NONE` Successfully completed HMAC operation. `OT_ERROR_FAILED` Failed to complete HMAC operation. `OT_ERROR_INVALID_ARGS` `aContext` or `aBuf` was NULL
### otPlatCryptoHmacSha256Init
```
otError otPlatCryptoHmacSha256Init(
otCryptoContext *aContext
)
```
Initialize the HMAC operation.
> [!NOTE]
> **Note:** If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, `aContext` is populated by the platform. Otherwise OpenThread core allocates and populates it.
> [!NOTE]
> **Note:** The platform driver shall point the context to the correct object such as psa_mac_operation_t or mbedtls_md_context_t.
Details Parameters `[in] aContext` Context for HMAC operation. Return Values `OT_ERROR_NONE` Successfully initialized HMAC operation. `OT_ERROR_FAILED` Failed to initialize HMAC operation. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoHmacSha256Start
```
otError otPlatCryptoHmacSha256Start(
otCryptoContext *aContext,
const otCryptoKey *aKey
)
```
Start HMAC operation.
Details Parameters `[in] aContext` Context for HMAC operation. `[in] aKey` Key material to be used for HMAC operation. Return Values `OT_ERROR_NONE` Successfully started HMAC operation. `OT_ERROR_FAILED` Failed to start HMAC operation. `OT_ERROR_INVALID_ARGS` `aContext` or `aKey` was NULL
### otPlatCryptoHmacSha256Update
```
otError otPlatCryptoHmacSha256Update(
otCryptoContext *aContext,
const void *aBuf,
uint16_t aBufLength
)
```
Update the HMAC operation with new input.
Details Parameters `[in] aContext` Context for HMAC operation. `[in] aBuf` A pointer to the input buffer. `[in] aBufLength` The length of `aBuf` in bytes. Return Values `OT_ERROR_NONE` Successfully updated HMAC with new input operation. `OT_ERROR_FAILED` Failed to update HMAC operation. `OT_ERROR_INVALID_ARGS` `aContext` or `aBuf` was NULL
### otPlatCryptoImportKey
```
otError otPlatCryptoImportKey(
otCryptoKeyRef *aKeyRef,
otCryptoKeyType aKeyType,
otCryptoKeyAlgorithm aKeyAlgorithm,
int aKeyUsage,
otCryptoKeyStorage aKeyPersistence,
const uint8_t *aKey,
size_t aKeyLen
)
```
Import a key into PSA ITS.
> [!NOTE]
> **Note:** If OT_CRYPTO_KEY_STORAGE_PERSISTENT is passed for aKeyPersistence then `aKeyRef` is input and platform should use the given aKeyRef and MUST not change it.
If OT_CRYPTO_KEY_STORAGE_VOLATILE is passed for aKeyPersistence then `aKeyRef` is output, the initial value does not matter and platform API MUST update it to return the new key ref.
Details Parameters `[in,out] aKeyRef` Pointer to the key ref to be used for crypto operations. `[in] aKeyType` Key Type encoding for the key. `[in] aKeyAlgorithm` Key algorithm encoding for the key. `[in] aKeyUsage` Key Usage encoding for the key (combinations of `OT_CRYPTO_KEY_USAGE_*`). `[in] aKeyPersistence` Key Persistence for this key `[in] aKey` Actual key to be imported. `[in] aKeyLen` Length of the key to be imported. Return Values `OT_ERROR_NONE` Successfully imported the key. `OT_ERROR_FAILED` Failed to import the key. `OT_ERROR_INVALID_ARGS` `aKey` was set to NULL.
This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
### otPlatCryptoInit
```
void otPlatCryptoInit(
void
)
```
Initialize the Crypto module.
### otPlatCryptoIsKeyRefValid
```
bool otPlatCryptoIsKeyRefValid(
otCryptoKeyRef aKeyRef
)
```
Check whether a given key reference is valid.
This API does not check whether a key is currently stored under `aKeyRef`. Instead, use `https://openthread.io/reference/group/plat-crypto#group__plat-crypto_1ga7a26c7693fd96ed92b45611ac48509a7` for existence checks.
> [!NOTE]
> **Note:** This API is only used by OT core when `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
Details Parameters `[in] aKeyRef` The Key Ref to check. Return Values `TRUE` `aKeyRef` is valid. `FALSE` `aKeyRef` is not valid.
### otPlatCryptoPbkdf2GenerateKey
```
otError otPlatCryptoPbkdf2GenerateKey(
const uint8_t *aPassword,
uint16_t aPasswordLen,
const uint8_t *aSalt,
uint16_t aSaltLen,
uint32_t aIterationCounter,
uint16_t aKeyLen,
uint8_t *aKey
)
```
Perform PKCS#5 PBKDF2 using CMAC (AES-CMAC-PRF-128).
Details Parameters `[in] aPassword` Password to use when generating key. `[in] aPasswordLen` Length of password. `[in] aSalt` Salt to use when generating key. `[in] aSaltLen` Length of salt. `[in] aIterationCounter` Iteration count. `[in] aKeyLen` Length of generated key in bytes. `[out] aKey` A pointer to the generated key. Return Values `OT_ERROR_NONE` A new key-pair was generated successfully. `OT_ERROR_NO_BUFS` Failed to allocate buffer for key generation. `OT_ERROR_NOT_CAPABLE` Feature not supported. `OT_ERROR_FAILED` Failed to generate key.
### otPlatCryptoRandomDeinit
```
void otPlatCryptoRandomDeinit(
void
)
```
Deinitialize cryptographically-secure pseudorandom number generator (CSPRNG).
### otPlatCryptoRandomGet
```
otError otPlatCryptoRandomGet(
uint8_t *aBuffer,
uint16_t aSize
)
```
Fills a given buffer with cryptographically secure random bytes.
Details Parameters `[out] aBuffer` A pointer to a buffer to fill with the random bytes. `[in] aSize` Size of buffer (number of bytes to fill). Return Values `OT_ERROR_NONE` Successfully filled buffer with random values. `OT_ERROR_FAILED` Operation failed.
### otPlatCryptoRandomInit
```
void otPlatCryptoRandomInit(
void
)
```
Initialize cryptographically-secure pseudorandom number generator (CSPRNG).
### otPlatCryptoSha256Deinit
```
otError otPlatCryptoSha256Deinit(
otCryptoContext *aContext
)
```
Uninitialize the SHA-256 operation.
Details Parameters `[in] aContext` Context for SHA-256 operation. Return Values `OT_ERROR_NONE` Successfully un-initialised SHA-256 operation. `OT_ERROR_FAILED` Failed to un-initialised SHA-256 operation. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoSha256Finish
```
otError otPlatCryptoSha256Finish(
otCryptoContext *aContext,
uint8_t *aHash,
uint16_t aHashSize
)
```
Finish SHA-256 operation.
Details Parameters `[in] aContext` Context for SHA-256 operation. `[in] aHash` A pointer to the output buffer, where hash needs to be stored. `[in] aHashSize` The length of `aHash` in bytes. Return Values `OT_ERROR_NONE` Successfully completed the SHA-256 operation. `OT_ERROR_FAILED` Failed to complete SHA-256 operation. `OT_ERROR_INVALID_ARGS` `aContext` or `aHash` was NULL
### otPlatCryptoSha256Init
```
otError otPlatCryptoSha256Init(
otCryptoContext *aContext
)
```
Initialise the SHA-256 operation.
> [!NOTE]
> **Note:** If `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT` is enabled, `aContext` is populated by the platform. Otherwise OpenThread core allocates and populates it.
> [!NOTE]
> **Note:** The platform driver shall point the context to the correct object such as psa_hash_operation_t or mbedtls_sha256_context.
Details Parameters `[in] aContext` Context for SHA-256 operation. Return Values `OT_ERROR_NONE` Successfully initialised SHA-256 operation. `OT_ERROR_FAILED` Failed to initialise SHA-256 operation. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoSha256Start
```
otError otPlatCryptoSha256Start(
otCryptoContext *aContext
)
```
Start SHA-256 operation.
Details Parameters `[in] aContext` Context for SHA-256 operation. Return Values `OT_ERROR_NONE` Successfully started SHA-256 operation. `OT_ERROR_FAILED` Failed to start SHA-256 operation. `OT_ERROR_INVALID_ARGS` `aContext` was NULL
### otPlatCryptoSha256Update
```
otError otPlatCryptoSha256Update(
otCryptoContext *aContext,
const void *aBuf,
uint16_t aBufLength
)
```
Update SHA-256 operation with new input.
Details Parameters `[in] aContext` Context for SHA-256 operation. `[in] aBuf` A pointer to the input buffer. `[in] aBufLength` The length of `aBuf` in bytes. Return Values `OT_ERROR_NONE` Successfully updated SHA-256 with new input operation. `OT_ERROR_FAILED` Failed to update SHA-256 operation. `OT_ERROR_INVALID_ARGS` `aContext` or `aBuf` was NULL
## Macros
### OT_CRYPTO_ECDSA_MAX_DER_SIZE
```
OT_CRYPTO_ECDSA_MAX_DER_SIZE 125
```
Max buffer size (in bytes) for representing the EDCSA key-pair in DER format.
### OT_CRYPTO_ECDSA_PUBLIC_KEY_SIZE
```
OT_CRYPTO_ECDSA_PUBLIC_KEY_SIZE 64
```
Buffer size (in bytes) for representing the EDCSA public key.
### OT_CRYPTO_ECDSA_SIGNATURE_SIZE
```
OT_CRYPTO_ECDSA_SIGNATURE_SIZE 64
```
Buffer size (in bytes) for representing the EDCSA signature.
### OT_CRYPTO_PBDKF2_MAX_SALT_SIZE
```
OT_CRYPTO_PBDKF2_MAX_SALT_SIZE 30
```
Max PBKDF2 SALT length: salt prefix (6) + extended panid (8) + network name (16)
### OT_CRYPTO_SHA256_HASH_SIZE
```
OT_CRYPTO_SHA256_HASH_SIZE 32
```
Length of SHA256 hash (in bytes).
## Resources
OpenThread API Reference topics originate from the source code, available
on [GitHub](https://github.com/openthread/openthread/tree/main/include/openthread).
For more information, or to contribute to our documentation, refer to
[Resources](https://openthread.io/resources).