forked from lowRISC/opentitan
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[signing] Add SiVAL public key material
1. Add sival root (rom->rom_ext) keys. 2. Add sival owner/application keys. 3. Add a sival owner configuration, signed owner binary configuration and FPGA `sku_creator_owner_init` function. 4. Update READMEs to document the hsmtool profile names and describe how keys were generated. Signed-off-by: Chris Frantz <[email protected]>
- Loading branch information
Showing
39 changed files
with
370 additions
and
523 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,115 @@ | ||
| # Copyright lowRISC contributors (OpenTitan project). | ||
| # Licensed under the Apache License, Version 2.0, see LICENSE for details. | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| load("//rules/opentitan:keyutils.bzl", "key_ecdsa") | ||
| load("//rules:signing.bzl", "keyset") | ||
| load("//rules:const.bzl", "CONST") | ||
| load( | ||
| "//rules:otp.bzl", | ||
| "otp_hex", | ||
| "otp_json_rot_keys", | ||
| "otp_partition", | ||
| ) | ||
|
|
||
| package(default_visibility = ["//visibility:public"]) | ||
|
|
||
| key_ecdsa( | ||
| name = "ecdsa_prod_0", | ||
| config = "EcdsaP256", | ||
| method = "hsmtool", | ||
| pub_key = "sv00-earlgrey-a1-root-ecdsa-prod-0.pub.der", | ||
| type = "ProdKey", | ||
| ) | ||
|
|
||
| key_ecdsa( | ||
| name = "ecdsa_prod_1", | ||
| config = "EcdsaP256", | ||
| method = "hsmtool", | ||
| pub_key = "sv00-earlgrey-a1-root-ecdsa-prod-1.pub.der", | ||
| type = "ProdKey", | ||
| ) | ||
|
|
||
| key_ecdsa( | ||
| name = "ecdsa_prod_2", | ||
| config = "EcdsaP256", | ||
| method = "hsmtool", | ||
| pub_key = "sv00-earlgrey-a1-root-ecdsa-prod-2.pub.der", | ||
| type = "ProdKey", | ||
| ) | ||
|
|
||
| key_ecdsa( | ||
| name = "ecdsa_test_0", | ||
| config = "EcdsaP256", | ||
| method = "hsmtool", | ||
| pub_key = "sv00-earlgrey-a1-root-ecdsa-test-0.pub.der", | ||
| type = "TestKey", | ||
| ) | ||
|
|
||
| key_ecdsa( | ||
| name = "ca_dice_0", | ||
| config = "EcdsaP256", | ||
| method = "hsmtool", | ||
| pub_key = "sv00-earlgrey-a1-ca-dice-0.pub.der", | ||
| type = "TestKey", | ||
| ) | ||
|
|
||
| # TODO(#22155, #18313): Decide on keyset vs. keyinfo for supplying signing info to the | ||
| # offline/token signing flows. Currently, only keyset supports tokens. | ||
| keyset( | ||
| name = "keyset", | ||
| build_setting_default = "", | ||
| keys = { | ||
| "sv00-earlgrey-a1-root-ecdsa-prod-0.pub.der": "sv00-earlgrey-a1-root-ecdsa-prod-0", | ||
| "sv00-earlgrey-a1-root-ecdsa-prod-1.pub.der": "sv00-earlgrey-a1-root-ecdsa-prod-1", | ||
| "sv00-earlgrey-a1-root-ecdsa-prod-2.pub.der": "sv00-earlgrey-a1-root-ecdsa-prod-2", | ||
| "sv00-earlgrey-a1-root-ecdsa-test-0.pub.der": "sv00-earlgrey-a1-root-ecdsa-test-0", | ||
| }, | ||
| profile = "earlgrey_a1_sival_root", | ||
| tool = "//signing:token", | ||
| ) | ||
|
|
||
| keyset( | ||
| name = "endorsement", | ||
| build_setting_default = "", | ||
| keys = { | ||
| "sv00-earlgrey-a1-ca-dice-0.pub.der": "sv00-earlgrey-a1-ca-dice-0", | ||
| }, | ||
| profile = "earlgrey_a1_sival_root", | ||
| tool = "//signing:token", | ||
| ) | ||
|
|
||
| otp_json_rot_keys( | ||
| name = "ecdsa_root_keys", | ||
| partitions = [ | ||
| otp_partition( | ||
| name = "ROT_CREATOR_AUTH_CODESIGN", | ||
| items = { | ||
| # sv00-earlgrey-a1-root-ecdsa-prod-0.pub.der | ||
| "ROT_CREATOR_AUTH_CODESIGN_ECDSA_KEY_TYPE0": otp_hex(CONST.SIGVERIFY.KEY_TYPE.PROD), | ||
| "ROT_CREATOR_AUTH_CODESIGN_ECDSA_KEY0": "0x112eb53614cd78573bfb44005f1f81f71ad8bc614f9b1f0848650d82b6cbbebac48c696274cbb86ede569ca56444702e91e7b09d661f560151ea3f688aa047bb", | ||
|
|
||
| # sv00-earlgrey-a1-root-ecdsa-prod-1.pub.der | ||
| "ROT_CREATOR_AUTH_CODESIGN_ECDSA_KEY_TYPE1": otp_hex(CONST.SIGVERIFY.KEY_TYPE.PROD), | ||
| "ROT_CREATOR_AUTH_CODESIGN_ECDSA_KEY1": "0x8f522f2bcf8ca3f443d70b86f2479b3cc73d4c1384363edc38cf545ad6aaf46d2a7f529f489446e9d29e7624af46824f2964ca991cd5c4d84adc632bc436fc3d", | ||
|
|
||
| # sv00-earlgrey-a1-root-ecdsa-prod-2.pub.der | ||
| "ROT_CREATOR_AUTH_CODESIGN_ECDSA_KEY_TYPE2": otp_hex(CONST.SIGVERIFY.KEY_TYPE.PROD), | ||
| "ROT_CREATOR_AUTH_CODESIGN_ECDSA_KEY2": "0x1295b177eaec69f04c421e8f58bb55f89c8001ba1c3e5f45bec154fb25136e20bde6d117d7ff3af127348cb63574ccc3da8a1db44660350908384089a7948feb", | ||
|
|
||
| # sv00-earlgrey-a1-root-ecdsa-test-0.pub.der | ||
| "ROT_CREATOR_AUTH_CODESIGN_ECDSA_KEY_TYPE3": otp_hex(CONST.SIGVERIFY.KEY_TYPE.TEST), | ||
| "ROT_CREATOR_AUTH_CODESIGN_ECDSA_KEY3": "0x39dc04654afd697af53f530a3806de08f4d513f4e7bdb33ede83bf38960005ea3b4c161ce2acf000babd10689f8da3a3132eff0b3bbdf26acacaa3d3473d006d", | ||
| }, | ||
| ), | ||
| otp_partition( | ||
| name = "ROT_CREATOR_AUTH_STATE", | ||
| items = { | ||
| "ROT_CREATOR_AUTH_STATE_ECDSA_KEY0": otp_hex(CONST.SIGVERIFY.KEY_STATE.PROVISIONED), | ||
| "ROT_CREATOR_AUTH_STATE_ECDSA_KEY1": otp_hex(CONST.SIGVERIFY.KEY_STATE.PROVISIONED), | ||
| "ROT_CREATOR_AUTH_STATE_ECDSA_KEY2": otp_hex(CONST.SIGVERIFY.KEY_STATE.PROVISIONED), | ||
| "ROT_CREATOR_AUTH_STATE_ECDSA_KEY3": otp_hex(CONST.SIGVERIFY.KEY_STATE.PROVISIONED), | ||
| }, | ||
| ), | ||
| ], | ||
| ) |
Binary file added
BIN
+91 Bytes
hw/ip/otp_ctrl/data/earlgrey_skus/sival/keys/sv00-earlgrey-a1-ca-dice-0.pub.der
Binary file not shown.
Binary file added
BIN
+91 Bytes
hw/ip/otp_ctrl/data/earlgrey_skus/sival/keys/sv00-earlgrey-a1-root-ecdsa-prod-0.pub.der
Binary file not shown.
Binary file added
BIN
+91 Bytes
hw/ip/otp_ctrl/data/earlgrey_skus/sival/keys/sv00-earlgrey-a1-root-ecdsa-prod-1.pub.der
Binary file not shown.
Binary file added
BIN
+91 Bytes
hw/ip/otp_ctrl/data/earlgrey_skus/sival/keys/sv00-earlgrey-a1-root-ecdsa-prod-2.pub.der
Binary file not shown.
Binary file added
BIN
+91 Bytes
hw/ip/otp_ctrl/data/earlgrey_skus/sival/keys/sv00-earlgrey-a1-root-ecdsa-test-0.pub.der
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| # SiVAL ROM\_EXT | ||
|
|
||
| The ROM\_EXT build in this directory is for chips that are configured as the SiVAL SKU. | ||
|
|
||
| The SiVAL SKU is initialized with the SiVAL owner during provisioning. | ||
| The human-readable owner configuration is `sival_owner.json5` and is translated to binary form with the following command: | ||
|
|
||
| ```bash | ||
| cd $REPO_TOP | ||
| opentitantool ownership config \ | ||
| --input sw/device/silicon_creator/rom_ext/sival/sival_owner.json5 \ | ||
| sw/device/silicon_creator/rom_ext/sival/sival_owner.bin | ||
| ``` | ||
|
|
||
| The configuration is signed using the owner key stored in the Cloud KMS keyring `ot-earlgrey-a1-sival`: | ||
|
|
||
| ```bash | ||
| cd $REPO_TOP | ||
|
|
||
| # From https://github.com/GoogleCloudPlatform/kms-integrations/releases/tag/pkcs11-v1.2 | ||
| export HSMTOOL_MODULE=$(pwd)/libkmsp11.so | ||
| export KMS_PKCS11_CONFIG=signing/tokens/ot-earlgrey-a1-sival.yaml | ||
|
|
||
| hsmtool -t ot-earlgrey-a1-sival ecdsa sign \ | ||
| -l sv00-ownership-owner-0 \ | ||
| --little-endian \ | ||
| --format=slice:0..1952 \ | ||
| --update-in-place=1952..2016 \ | ||
| sw/device/silicon_creator/rom_ext/sival/sival_owner.bin | ||
| ``` | ||
|
|
||
| The header file `sival_owner.h` was created by dumping the binary file to a C header. | ||
| This file is only used by the "fake" ROM\_EXT used in testing FPGA configurations. | ||
| NOTE: the repeating unused data pattern `ZZZZ` can be cut out of the hexdump as the `sku_creator_owner_init` function will fill the unused portion of the owner page with that pattern. | ||
| ```bash | ||
| cd $REPO_TOP | ||
|
|
||
| ./util/sh/scripts/bin2c.sh \ | ||
| --input sw/device/silicon_creator/rom_ext/sival/sival_owner.bin \ | ||
| --output sw/device/silicon_creator/rom_ext/sival/sival_owner.h \ | ||
| --name sival_owner | ||
| ``` |
Oops, something went wrong.