Intel® Dynamic Application Loader (Intel® DAL) Developer Guide
                    
                        ID
                        773482
                    
                
                
                    Date
                    3/24/2023
                
                
                    Public
                
            
                                                                        
                                                                        
                                                                            
                                                                            
                                                                                For API Level 1 - Intel® ME 7.x - Sandy Bridge
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 1.1 - Intel® ME 8.x lite - Sandy Bridge
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 2 - Intel® ME 8.0 - Ivy Bridge
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 3 - Intel® ME 8.1 - Ivy Bridge
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 3 - SEC1.0, SEC1.1, SEC1.2, SEC2.0
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 4 - Intel® ME 9.5, Intel ME 9.5.55 - Haswell
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 4 - Intel® ME 9.1, Intel ME 9.1.35 - Haswell
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 5 - Intel® ME 10.0.0 - Haswell
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 6 - Intel® ME 10.0.20 - Broadwell
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 7 - ME 11.0 - Skylake_LP and Skylake_H
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 8 - TXE3.0 - Broxton, ME 11.5/11.8 - Kabylake_LP, Kabylake_H
                                                                            
                                                                            
                                                                        
                                                                            
                                                                            
                                                                                For API Level 9 - Intel® ME 12.0 - Cannon Lake
                                                                            
                                                                            
                                                                        
                                                                    
                                                                
                                                
                                                
                                                    
                                                    
                                                        Trusted Application Validation Guidelines
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Validating the Manifest
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Memory and Performance
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Error Handling and Recovery
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Functional Validation and Multi-Instance Support
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Pack and DALP Generation and Validation
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Host-Side Software Validation Guidelines
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Trusted Application Management Flows
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Error Handling and Recovery Flows
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Multi-Instance and Interoperability Testing of Trusted Application Management
                                                    
                                                    
                                                
                                                    
                                                    
                                                        General and Platform-Related Events
                                                    
                                                    
                                                
                                                    
                                                    
                                                        End-to-End and Setup Validation Guidelines
                                                    
                                                    
                                                
                                                    
                                                    
                                                        Cross Trusted Application Interoperability Functional Testing
                                                    
                                                    
                                                
                                            
                                        
                                    
                                    
                                        
                                        
                                            Creating a New Project
                                        
                                        
                                    
                                        
                                        
                                            Importing an Existing Project
                                        
                                        
                                    
                                        
                                        
                                            Converting an Existing Project
                                        
                                        
                                    
                                        
                                        
                                            Building and Packaging Your Project and Running in Emulated Environment
                                        
                                        
                                    
                                        
                                        
                                            Running Your Project
                                        
                                        
                                    
                                        
                                        
                                            Running and Testing on Emulation and on Silicon
                                        
                                        
                                    
                                        
                                        
                                            Debugging Trusted Applications
                                        
                                        
                                    
                                        
                                        
                                            Preparing and Submitting Your Project for Signing
                                        
                                        
                                    
                                        
                                        
                                            Signing an Applet
                                        
                                        
                                    
                                        
                                        
                                            Signing New Versions
                                        
                                        
                                    
                                
                            Secure Data Migration Sample
This sample demonstrates how to decrypt data that has been encrypted using the platform-binding (PBind) key and this key has changed during a firmware update that incremented the firmware secure version number (SVN).
This sample is applicable for API level 8 and above.
To demonstrate the complete process, this sample contains two versions of the Trusted Application (TA):
- SecureData TA: The original applet that uses the basic encryption\decryption APIs provided by Intel® Dynamic Application Loader (Intel® DAL).
 - SecureDataMigration TA: The modified applet that has a recovery flow to decrypt data that was encrypted using an old PBind key.
 
Note: The SecureDataMigration TA uses the DataMigration API (com.intel.crypto.DataMigration), which is supported starting Intel® Trusted Execution Engine (Intel® TXE) 3.1.50.x firmware and Intel® Management Engine (Intel® ME) 11.8.x firmware.
Sample flow
- Encrypt data using the PBind key and save it in a file in the file system.
 - Decrypt the encrypted data using the SymmetricBlockCipher (com.intel.crypto.SymmetricBlockCipherAlg) API.
 - Perform firmware update with a firmware SVN increment (► the PBind key changes).
 - Decrypt the encrypted data: Decryption using the SymmetricBlockCipher API fails because the PBind key has changed since the data encryption, so use the Intel® Dynamic Application Loader (Intel® DAL) DataMigration (com.intel.crypto.DataMigration) API to decrypt the data using the old PBind key. In this step, you need to use the SecureDataMigration TA; decryption using the old version of this applet (SecureDataTA) will result in incorrect data format because the key used to encrypt is not the same as the decryption key.