1# Copyright (c) 2024 Nordic Semiconductor
2# SPDX-License-Identifier: Apache-2.0
3
4menuconfig SECURE_STORAGE
5	bool "Secure storage subsystem"
6	depends on !BUILD_WITH_TFM
7	select EXPERIMENTAL
8	help
9	  The secure storage subsystem provides an implementation of the PSA Secure Storage API
10	  functions on board targets that don't already have one.
11	  It allows making use of the PSA Secure Storage API and persistent keys in the PSA Crypto
12	  API in a standard and portable way.
13	  It is configurable and different implementations can be used to accommodate the varying
14	  capabilities of different devices.
15	  In addition to providing functional support for the PSA Secure Storage API, depending on
16	  the device-specific security features that are available and used, the subsystem may
17	  secure the data stored through it at rest.
18	  This is however highly dependent on the device and configuration in use, and not a
19	  guarantee of the subsystem.
20
21if SECURE_STORAGE
22
23module = SECURE_STORAGE
24module-str = secure_storage
25source "subsys/logging/Kconfig.template.log_config"
26
27choice SECURE_STORAGE_ITS_IMPLEMENTATION
28	prompt "Internal Trusted Storage (ITS) API implementation"
29
30config SECURE_STORAGE_ITS_IMPLEMENTATION_ZEPHYR
31	bool "Zephyr's ITS implementation"
32	select SECURE_STORAGE_ITS_TRANSFORM_MODULE
33	select SECURE_STORAGE_ITS_STORE_MODULE
34	help
35	  Use Zephyr's implementation of the ITS API.
36	  It calls into the transform and store modules, which
37	  can be configured and have custom implementations.
38
39config SECURE_STORAGE_ITS_IMPLEMENTATION_CUSTOM
40	bool "Custom ITS implementation"
41	help
42	  A custom implementation of the ITS API is present.
43	  Implement the functions declared in <zephyr/secure_storage/its.h>.
44	  The header is made available when this Kconfig option is enabled.
45
46endchoice # SECURE_STORAGE_ITS_IMPLEMENTATION
47
48config SECURE_STORAGE_ITS_MAX_DATA_SIZE
49	int "Maximum data size of an ITS entry in bytes"
50	default 128
51	help
52	  The maximum size, in bytes, that the data of an ITS entry can be.
53	  Increasing this value increases the stack usage when serving PSA ITS API calls.
54
55menuconfig SECURE_STORAGE_ITS_TRANSFORM_MODULE
56	bool "ITS transform module"
57	help
58	  The module that handles the transformation and validation of the
59	  ITS data before it's written to and after it's read from NVM.
60	  Zephyr's ITS implementation calls into it.
61
62if SECURE_STORAGE_ITS_TRANSFORM_MODULE
63rsource "Kconfig.its_transform"
64endif
65
66menuconfig SECURE_STORAGE_ITS_STORE_MODULE
67	bool "ITS store module"
68	imply FLASH # for FLASH_HAS_DRIVER_ENABLED
69	help
70	  The module that handles the storage/retrieval of the ITS data to/from NVM.
71	  Zephyr's ITS implementation calls into it.
72
73if SECURE_STORAGE_ITS_STORE_MODULE
74rsource "Kconfig.its_store"
75endif
76
77choice SECURE_STORAGE_PS_IMPLEMENTATION
78	prompt "Protected Storage (PS) API implementation"
79	default SECURE_STORAGE_PS_IMPLEMENTATION_ITS
80
81config SECURE_STORAGE_PS_IMPLEMENTATION_ITS
82	bool "PS calls directly into the ITS"
83	help
84	  The PS API doesn't have an implementation of its own, and directly calls into the ITS API.
85	  This means that the implementation of the PS API will be identical to that of the ITS API.
86
87config SECURE_STORAGE_PS_IMPLEMENTATION_CUSTOM
88	bool "Custom PS implementation"
89	help
90	  A custom implementation of the PS API is present.
91	  Implement the functions declared in <zephyr/secure_storage/ps.h>.
92	  The header is made available when this Kconfig option is enabled.
93
94endchoice # SECURE_STORAGE_PS_IMPLEMENTATION
95
96config SECURE_STORAGE_PS_SUPPORTS_SET_EXTENDED
97	bool "PS API implementation supports psa_ps_create() and psa_ps_set_extended()"
98	depends on SECURE_STORAGE_PS_IMPLEMENTATION_CUSTOM
99	help
100	  Whether the psa_ps_create() and psa_ps_set_extended() functions are implemented.
101
102endif # SECURE_STORAGE
103