{"action":"created","issue":{"url":"https://api.github.com/repos/jforissier/secvideo_demo/issues/1","repository_url":"https://api.github.com/repos/jforissier/secvideo_demo","labels_url":"https://api.github.com/repos/jforissier/secvideo_demo/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/jforissier/secvideo_demo/issues/1/comments","events_url":"https://api.github.com/repos/jforissier/secvideo_demo/issues/1/events","html_url":"https://github.com/jforissier/secvideo_demo/issues/1","id":147359983,"number":1,"title":"Storing key in secure storage","user":{"login":"hybridNeo","id":2843781,"avatar_url":"https://avatars.githubusercontent.com/u/2843781?v=3","gravatar_id":"","url":"https://api.github.com/users/hybridNeo","html_url":"https://github.com/hybridNeo","followers_url":"https://api.github.com/users/hybridNeo/followers","following_url":"https://api.github.com/users/hybridNeo/following{/other_user}","gists_url":"https://api.github.com/users/hybridNeo/gists{/gist_id}","starred_url":"https://api.github.com/users/hybridNeo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hybridNeo/subscriptions","organizations_url":"https://api.github.com/users/hybridNeo/orgs","repos_url":"https://api.github.com/users/hybridNeo/repos","events_url":"https://api.github.com/users/hybridNeo/events{/privacy}","received_events_url":"https://api.github.com/users/hybridNeo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-11T08:54:47Z","updated_at":"2016-04-11T15:32:55Z","closed_at":null,"body":"In this application you have put the key in the TA code itself, I am building a real world app, I wanted to know how to put the key in secure storage and access it. Because secure storage can be accessed only in runtime."},"comment":{"url":"https://api.github.com/repos/jforissier/secvideo_demo/issues/comments/208403668","html_url":"https://github.com/jforissier/secvideo_demo/issues/1#issuecomment-208403668","issue_url":"https://api.github.com/repos/jforissier/secvideo_demo/issues/1","id":208403668,"user":{"login":"jforissier","id":8288195,"avatar_url":"https://avatars.githubusercontent.com/u/8288195?v=3","gravatar_id":"","url":"https://api.github.com/users/jforissier","html_url":"https://github.com/jforissier","followers_url":"https://api.github.com/users/jforissier/followers","following_url":"https://api.github.com/users/jforissier/following{/other_user}","gists_url":"https://api.github.com/users/jforissier/gists{/gist_id}","starred_url":"https://api.github.com/users/jforissier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jforissier/subscriptions","organizations_url":"https://api.github.com/users/jforissier/orgs","repos_url":"https://api.github.com/users/jforissier/repos","events_url":"https://api.github.com/users/jforissier/events{/privacy}","received_events_url":"https://api.github.com/users/jforissier/received_events","type":"User","site_admin":false},"created_at":"2016-04-11T15:32:55Z","updated_at":"2016-04-11T15:32:55Z","body":"One option is to store the key into secure storage at the time of manufacture, as software is loaded onto the device. For instance, implement a \"set key\" command in the TA, which would simply write the key using `TEE_CreatePersistentObject()`. Invoke it once using a special client application when the device is still in a controlled environment. This technique is not very flexible, though (what if one needs to re-install the software in the device?).\r\n\r\nAnother option is to pass the key at runtime, encrypted with a device-specific key that is known to OP-TEE, i.e., a key derived from the one-time-programmable, master hardware unique key (`tee_otp_get_hw_unique_key()`). Real-world DRM applications would typically contain complex key derivation mechanisms but please check the OP-TEE specific extensions to `TEE_DeriveKey()`: Concat KDF, HKDF, PBKDF2. They may come in handy."}}