SNIP_ADAPTIVE_CRYPTO_FIGURE_Figure_7_1

Figure 7.1: Exemplary High-level FC Crypto architecture A CryptoProvider provides access to the implementation of a set of cryptographic primitives and a key storage. T ypically , an cryptographic module within a trusted execution environment is providing the actual implementation of primitives and key storage, and the CryptoProvider is providing a wrapper that allows access to different implementations using the same interface. A CryptoProvider is implemented by a stack vendor or a third party by implementing the ara::crypto::cryp::CryptoProvider class, as well as the classes for cryptographic contexts and the classes for cryptographic keys. It is possible to have multiple different CryptoProviders instantiated on one machine. However, although the interfaces are the same across multiple CryptoProvider implementations, there is no interoperability between different CryptoProviders. For instance, it is not possible to use a symmetric key that belongs to one CryptoProvider for encryption in another CryptoProvider. This is not a limitation of ara::crypto but an inherent and desired property of cryptographic modules. Every key managed by ara::crypto is managed by exactly one CryptoProvider. A ara:: crypto::cryp::KeySlot represents the interface from the application to access and use a persisted key . Each KeySlot is statically mapped to one CryptoProvider during deployment. Access to KeySlots is provided to applications through modelled ports using InstanceSpecifiers. The X.509 Provider provides access to persisted certificates and supports certificate management and verification functionality . In contrast to the CryptoProvider, there exists exactly one X.509 Provider instance on one machine.