Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Update storage overview #240

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: Update storage overview #240

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/storage.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,14 @@ This section describes how the storage is used in the current stable firmware.

Trussed stores the RNG state on the internal filesystem (see `ServiceResources::rng`). During provisioning, a Trussed device key and certificate are also generated on the internal filesystem.

### trussed-auth

The trussed-auth extension uses the internal filesystem to store a device salt and application PINs with their metadata.

### fido-authenticator

fido-authenticator stores its state, a KEK and the resident keys on the internal filesystem. During provisioning, the FIDO2 attestation key and certificate are stored on the internal filesystem. The KEK is generated on first use. If there is not enough free space to generate the KEK, the application cannot be used.

### secrets-app

secrets-app stores the user data on the external filesystem. It uses trussed-auth for one PIN with a derived key.
Copy link
Member

@szszszsz szszszsz Apr 20, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be useful to explicitly tell it does not use permanent key store, and mention encryption types:

Suggested change
secrets-app stores the user data on the external filesystem. It uses trussed-auth for one PIN with a derived key.
secrets-app stores the user data on the external filesystem. Keeps no data in the permanent Trussed key store. It uses trussed-auth for one PIN with a salt for the derived key.
User data are encrypted either with Hardware or PIN-based encryption key.