Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
@@ -1,17 +1,18 @@
<!--
SPDX-FileCopyrightText: Copyright 2022 Arm Limited and/or its affiliates
SPDX-FileCopyrightText: Copyright 2026 GlobalPlatform
SPDX-License-Identifier: CC-BY-SA-4.0
-->

# Contributing

The main copy of this project is hosted on GitHub: https://github.com/globalplatform/psa-api.

Anyone may contribute to the PSA Certified API project. Contributions are licensed under the same license that is used for distibution, and must be made with a [Developer Certificate of Origin][DCO] (DCO) attestation as described below. See the [LICENSE][license] file for details of the license.
Anyone may contribute to the PSA API project. Contributions are licensed under the same license that is used for distibution, and must be made with a [Developer Certificate of Origin][DCO] (DCO) attestation as described below. See the [LICENSE][license] file for details of the license.

PSA Certified API discussion and development uses this GitHub repository. See the [Issues][issues] and [Pull requests][prs] for a full list of current discussions, or to start a new one.
PSA API discussion and development uses this GitHub repository. See the [Issues][issues] and [Pull requests][prs] for a full list of current discussions, or to start a new one.

Alternatively, you can find issues related to a particular API on the API-specific project boards. Follow the links from the [main page][spec-list].
Issues and PRs are labeled with the relevant API specification.

## DCO Attestation

Expand Down Expand Up @@ -50,3 +51,8 @@ d) I understand and agree that this project and the contribution
[issues]: https://github.com/globalplatform/psa-api/issues
[prs]: https://github.com/globalplatform/psa-api/pulls
[spec-list]: https://github.com/globalplatform/psa-api#specifications

----

*Copyright 2022 Arm Limited and/or its affiliates*\
*Copyright 2026 GlobalPlatform*
91 changes: 49 additions & 42 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,46 +1,45 @@
<!--
SPDX-FileCopyrightText: Copyright 2022-2026 Arm Limited and/or its affiliates
SPDX-FileCopyrightText: Copyright 2026 GlobalPlatform
SPDX-License-Identifier: CC-BY-SA-4.0
-->

# PSA Certified API Specifications
# PSA API Specifications

This is the official place for the latest documents of the PSA Certified API.
This is the official place for the development the PSA API specifications.

This GitHub repository contains:
* Specification source files
* Reference copies of the PSA Certified API header files
* Examples of usage and implementation of the PSA Certified APIs
* Reference copies of the PSA API header files
* Examples of usage and implementation of the PSA APIs
* Build tooling for rendering the specifications
* Discussions of updates to the specifications
* Proposed changes to the specifications

Officially released specification documents can be found in the associated [PSA Certified API website](https://arm-software.github.io/psa-api/).
Officially released specification documents can be found at the [PSA API specifications website][PSA API website].

Note: The PSA APIs have previously been referred to as the PSA Certified APIs.

[PSA API website]: https://arm-software.github.io/psa-api/

## Specifications

The following specifications are part of the PSA Certified API.
The following specifications are part of the PSA API.

Specification | Published | Document source | Reference headers | Dashboard
-|-|-|-|-
Crypto API | [1.5.0][crypto-specs] | [doc/crypto/] | [headers/crypto/1.5/] | [Project board][crypto-dash]
Secure Storage API | [1.0.4][storage-specs] | [doc/storage/] | [headers/storage/1.0/] | [Project board][storage-dash] |
Attestation API | [2.0.0][attestation-specs] | [doc/attestation/] | [headers/attestation/2.0/] | [Project board][attestation-dash] |
Firmware Update API | [1.0.1][fwu-specs] | [doc/fwu/] | [headers/fwu/1.0/] | [Project board][fwu-dash]
Status code API | [1.0.5][status-specs] | [doc/status-code/] | [headers/status-code/1.0/] | [Project board][status-code-dash] |
Specification | Published | Document source | Reference headers
-|-|-|-
Crypto API | [1.5.0][crypto-specs] | [doc/crypto/] | [headers/crypto/1.5/]
Secure Storage API | [1.0.4][storage-specs] | [doc/storage/] | [headers/storage/1.0/]
Attestation API | [2.0.0][attestation-specs] | [doc/attestation/] | [headers/attestation/2.0/]
Firmware Update API | [1.0.1][fwu-specs] | [doc/fwu/] | [headers/fwu/1.0/]
Status code API | [1.0.5][status-specs] | [doc/status-code/] | [headers/status-code/1.0/]

[crypto-specs]: https://arm-software.github.io/psa-api/crypto/
[storage-specs]: https://arm-software.github.io/psa-api/storage/
[attestation-specs]: https://arm-software.github.io/psa-api/attestation/
[fwu-specs]: https://arm-software.github.io/psa-api/fwu/
[status-specs]: https://arm-software.github.io/psa-api/status-code/

[crypto-dash]: https://github.com/orgs/ARM-software/projects/5/views/3
[storage-dash]: https://github.com/orgs/ARM-software/projects/5/views/4
[attestation-dash]: https://github.com/orgs/ARM-software/projects/5/views/5
[fwu-dash]: https://github.com/orgs/ARM-software/projects/5/views/6
[status-code-dash]: https://github.com/orgs/ARM-software/projects/5/views/7

[doc/crypto/]: doc/crypto
[doc/storage/]: doc/storage
[doc/attestation/]: doc/attestation
Expand All @@ -57,32 +56,33 @@ Status code API | [1.0.5][status-specs] | [doc/status-code/] | [headers/status-

Extension specifications introduce new functionality that is not yet stable enough for inclusion in the main specification.

API | Extension | Published | Document source | Reference headers | Dashboard
-|-|-|-|-|-
Crypto API | PAKE | [*Integrated in 1.3.0*][crypto-specs] | *n/a* | *n/a* | *n/a*
Crypto API | PQC | [*Integrated in 1.5*][crypto-specs] | *n/a* | *n/a* | *n/a*
API | Extension | Published | Document source | Reference headers
-|-|-|-|-
Crypto API | PAKE | [*Integrated in 1.3.0*][crypto-specs] | *n/a* | *n/a*
Crypto API | PQC | [*Integrated in 1.5*][crypto-specs] | *n/a* | *n/a*

### In development

The following specifications are being developed towards an initial 1.0 version:

Specification | Published | Document source | Reference headers | Dashboard
-|-|-|-|-
Crypto Driver Interface | [1.0 Alpha-1][crypto-driver-specs] | [doc/crypto-driver/] | *n/a* | [Project board][crypto-driver-dash]
Specification | Published | Document source | Reference headers
-|-|-|-
Crypto Driver Interface | [1.0 Alpha-1][crypto-driver-specs] | [doc/crypto-driver/] | *n/a*

[crypto-driver-specs]: https://arm-software.github.io/psa-api/crypto-driver/
[crypto-driver-dash]: https://github.com/orgs/ARM-software/projects/5/views/8
[doc/crypto-driver/]: doc/crypto-driver

## Reference header files

Reference header files for each minor version of each API are provided in the [headers/](headers) folder.
Reference header files for each minor version of each API are provided in the [headers/] folder.

[headers/]: headers

## Building the specifications

This repository includes the documentation build tooling in [tools/](tools). The top-level `Makefile` uses that local tool copy by default, so a normal build does not require a separate checkout of the build tools.
This repository includes the documentation build tooling in [tools/]. The top-level `Makefile` uses that local tool copy by default, so a normal build does not require a separate checkout of the build tools.

The core HTML build path requires Python, Sphinx, and `make`. PDF output also requires a LaTeX toolchain with `pdflatex`. Regenerating figures can require additional tools, depending on the figure source format, including Graphviz, `wavedrompy`, PlantUML, Java, and `rsvg-convert`.
The HTML build requires Python, Sphinx, and `make`. PDF output also requires a LaTeX toolchain with `pdflatex`. Regenerating figures can require additional tools, depending on the figure source format, including Graphviz, `wavedrompy`, PlantUML, Java, and `rsvg-convert`.

Build one specification from the repository root with:

Expand All @@ -102,24 +102,32 @@ make html
make pdf
```

Generated output is written under [build/](build). The build guide in [tools/docs/using-psa-api-tool.md](tools/docs/using-psa-api-tool.md) describes the available targets, dependencies, and validation flow. The editing reference in [tools/docs/psa-api-tool-notes.md](tools/docs/psa-api-tool-notes.md) describes the custom directives, roles, and source conventions used by the specifications.
Generated output is written under the untracked **build/** folder. The build guide in [tools/docs/using-psa-api-tool.md] describes the available targets, dependencies, and validation flow. The editing reference in [tools/docs/psa-api-tool-notes.md] describes the custom directives, roles, and source conventions used by the specifications.

[tools/]: tools
[tools/docs/using-psa-api-tool.md]: tools/docs/using-psa-api-tool.md
[tools/docs/psa-api-tool-notes.md]: tools/docs/psa-api-tool-notes.md

## Test Suite

Test suites are available to validate compliance of API implementations against the specifications for Crypto, Attestation, and Secure Storage APIs, from:
[github.com/ARM-software/psa-arch-tests](https://github.com/ARM-software/psa-arch-tests)
Test suites are available to validate compliance of API implementations against the specifications for Crypto, Attestation, and Secure Storage APIs, from: [github.com/ARM-software/psa-arch-tests].

Compliance badges can be obtained from [PSA Certified](https://www.psacertified.org/getting-certified/functional-api-certification/) to showcase compatible products.
Compliance badges can be obtained from [PSA Certified] to showcase compatible products.

[github.com/ARM-software/psa-arch-tests]: https://github.com/ARM-software/psa-arch-tests
[PSA Certified]: https://www.psacertified.org/getting-certified/functional-api-certification/

## Example source code

Source code examples of both usage, and implementation, of the PSA Certified APIs are provided in the [examples/](/examples) folder.
Source code examples of both usage, and implementation, of the PSA APIs are provided in the [examples/] folder.

[examples/]: examples

## Related Projects

Known projects that implement or use the PSA Certified APIs are listed in [related-projects](/related-projects.md).
Known projects that implement or use the PSA APIs are listed in [related-projects].

[related-projects]: /related-projects.md

## License

Expand All @@ -129,8 +137,6 @@ Text and illustrations in this project are licensed under Creative Commons [Attr

**Grant of patent license**. Subject to the terms and conditions of this license (both the CC BY-SA 4.0 Public License and this Patent License), each Licensor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Licensed Material, where such license applies only to those patent claims licensable by such Licensor that are necessarily infringed by their contribution(s) alone or by combination of their contribution(s) with the Licensed Material to which such contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Licensed Material or a contribution incorporated within the Licensed Material constitutes direct or contributory patent infringement, then any licenses granted to You under this license for that Licensed Material shall terminate as of the date such litigation is filed.

The Arm trademarks featured here are registered trademarks or trademarks of Arm Limited (or its subsidiaries) in the US and/or elsewhere. All rights reserved. Please visit [arm.com/company/policies/trademarks][trademarks] for more information about Arm's trademarks.

### About the license

The language in the additional patent license is largely identical to that in section 3 of [Apache License, Version 2.0][APACHE-2.0] (Apache 2.0) with two exceptions:
Expand All @@ -141,7 +147,6 @@ The language in the additional patent license is largely identical to that in se

[CC-BY-SA-4.0]: https://creativecommons.org/licenses/by-sa/4.0
[APACHE-2.0]: https://www.apache.org/licenses/LICENSE-2.0
[trademarks]: https://www.arm.com/company/policies/trademarks

### Source code

Expand All @@ -153,7 +158,7 @@ See the License for the specific language governing permissions and limitations

## Feedback

If you have questions or comments on any of the PSA Certified API specifications, or suggestions for enhancements, please [raise a new issue][psa-api-issue].
If you have questions or comments on any of the PSA API specifications, or suggestions for enhancements, please [raise a new issue][psa-api-issue].

Please indicate which specification the issue applies to. This can be done by:

Expand All @@ -164,11 +169,13 @@ Please indicate which specification the issue applies to. This can be done by:

## Contributing

Anyone may contribute to the PSA Certified API. Discussion of changes and enhancement happens in this repository's [Issues][issues] and [Pull requests][pulls]. See [CONTRIBUTING](CONTRIBUTING.md) for details.
Anyone may contribute to the PSA APIs. Discussion of changes and enhancement happens in this repository's [Issues][issues] and [Pull requests][pulls]. See [CONTRIBUTING] for details.

[issues]: https://github.com/globalplatform/psa-api/issues
[pulls]: https://github.com/globalplatform/psa-api/pulls
[CONTRIBUTING]: CONTRIBUTING.md

----

*Copyright 2022-2026 Arm Limited and/or its affiliates*
*Copyright 2022-2026 Arm Limited and/or its affiliates*\
*Copyright 2026 GlobalPlatform*
15 changes: 9 additions & 6 deletions doc/attestation/README.md
Original file line number Diff line number Diff line change
@@ -1,19 +1,22 @@
<!--
SPDX-FileCopyrightText: Copyright 2022 Arm Limited and/or its affiliates
SPDX-FileCopyrightText: Copyright 2026 GlobalPlatform
SPDX-License-Identifier: CC-BY-SA-4.0
-->

# PSA Certified Attestation API &mdash; specification sources
# PSA Attestation API &mdash; specification sources

The Attestation API specification source files are organized as follows:

Folder | Content
-- | --
Current directory | Configuration and front-matter
`overview` | Informative chapters 1-3
`api` | API reference chapter 4
`appendix` | Appendix chapters
Current directory | Configuration and table of contents
`about` | Front matter
`overview` | Informative chapters
`api` | API reference
`appendix` | Appendices

----

*Copyright 2022, Arm Limited and/or its affiliates*
*Copyright 2022 Arm Limited and/or its affiliates*\
*Copyright 2026 GlobalPlatform*
7 changes: 4 additions & 3 deletions doc/attestation/about/intro
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
.. SPDX-FileCopyrightText: Copyright 2018-2020, 2022-2026 Arm Limited and/or its affiliates
.. SPDX-FileCopyrightText: Copyright 2026 GlobalPlatform
.. SPDX-License-Identifier: CC-BY-SA-4.0 AND LicenseRef-Patent-license

.. introduction::
Expand All @@ -7,7 +8,7 @@

.. rubric:: About the |API|

The interface described in this document is a PSA Certified API, that provides a verifiable report of the state of the platform. The platform attestation service is provided by the :term:`Platform Root of Trust` and is described in :cite-title:`PSM`.
The interface described in this document is a PSA API, that provides a verifiable report of the state of the platform. The platform attestation service is provided by the :term:`Platform Root of Trust` and is described in :cite-title:`PSM`.

The format of the attestation report that is produced by the |API| is specified in :rfc-title:`9783`.

Expand All @@ -20,9 +21,9 @@
* A set of common use cases. See :secref:`use cases`.
* The associated Application Programming Interface (API). See :secref:`api`.

The |API| can be used either to directly produce verifiable evidence about the platform state in the context of a challenge-response interaction, or as a way to bootstrap trust in other attestation schemes. The PSA Certified framework provides the generic security features allowing OEM and service providers to integrate various attestation schemes on top of the Platform Root of Trust.
The |API| can be used either to directly produce verifiable evidence about the platform state in the context of a challenge-response interaction, or as a way to bootstrap trust in other attestation schemes. The PSA framework provides the generic security features allowing OEM and service providers to integrate various attestation schemes on top of the Platform Root of Trust.

You can find additional resources relating to the |API| here at :url:`arm-software.github.io/psa-api/attestation`, and find other PSA Certified APIs here at :url:`arm-software.github.io/psa-api`.
You can find additional resources relating to the |API| here at :url:`arm-software.github.io/psa-api/attestation`, and find other PSA APIs here at :url:`arm-software.github.io/psa-api`.

.. audience::

Expand Down
3 changes: 2 additions & 1 deletion doc/attestation/about/references
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
.. SPDX-FileCopyrightText: Copyright 2018-2020, 2022-2025 Arm Limited and/or its affiliates
.. SPDX-FileCopyrightText: Copyright 2026 GlobalPlatform
.. SPDX-License-Identifier: CC-BY-SA-4.0 AND LicenseRef-Patent-license

.. reference:: PSA STAT
:title: PSA Certified Status code API
:title: PSA Status code API
:kind: normative
:doc_id: Arm IHI 0097
:url: arm-software.github.io/psa-api/status-code
Expand Down
5 changes: 3 additions & 2 deletions doc/attestation/about/releases
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
.. SPDX-FileCopyrightText: Copyright 2018-2020, 2022-2025 Arm Limited and/or its affiliates
.. SPDX-FileCopyrightText: Copyright 2026 GlobalPlatform
.. SPDX-License-Identifier: CC-BY-SA-4.0 AND LicenseRef-Patent-license

.. Releases of this specification
Expand All @@ -15,9 +16,9 @@

First stable release with 1.0 API finalized.

Uses the PSA Certified API common error status codes.
Uses the PSA API common error status codes.

Modified the API parameters to align with other PSA Certified APIs.
Modified the API parameters to align with other PSA APIs.

Updated the claims and lifecycle to match the latest Platform Security Model.

Expand Down
7 changes: 4 additions & 3 deletions doc/attestation/api/api.rst
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
.. SPDX-FileCopyrightText: Copyright 2018-2020, 2022-2026 Arm Limited and/or its affiliates
.. SPDX-FileCopyrightText: Copyright 2026 GlobalPlatform
.. SPDX-License-Identifier: CC-BY-SA-4.0 AND LicenseRef-Patent-license

.. _api:
Expand All @@ -14,7 +15,7 @@ API reference
:system-include: stddef.h stdint.h

/* This file is a reference template for implementation of the
* PSA Certified Attestation API v2.0
* PSA Attestation API v2.0
*/

The |API| defines a header file that is provided by the implementation. The header is :file:`psa/initial_attestation.h`.
Expand All @@ -34,7 +35,7 @@ Pointers to input parameters may be in read-only memory. Output parameters must
Status codes
------------

The |API| uses the status code definitions that are shared with the other PSA Certified APIs.
The |API| uses the status code definitions that are shared with the other PSA APIs.

The following elements are defined in :file:`psa/error.h` from :cite-title:`PSA STAT`:

Expand All @@ -53,7 +54,7 @@ These definitions must be available to an application that includes the :file:`p

.. admonition:: Implementation note

An implementation is permitted to define the status code interface elements within :file:`psa/initial_attestation.h`, or to define them via inclusion of a :file:`psa/error.h` header file that is shared with the implementation of other PSA Certified APIs.
An implementation is permitted to define the status code interface elements within :file:`psa/initial_attestation.h`, or to define them via inclusion of a :file:`psa/error.h` header file that is shared with the implementation of other PSA APIs.


General definitions
Expand Down
Loading