| DiversificationKey | -Flash | +HardwareRevisionSecret | +Gates | -Additional diversification key stored in flash. Provisioned at -manufacturing time by the Silicon Creator. - -Hidden from software once provisioned. +Encoded in gates. Provisioned by Silicon Creator before tapeout. Hidden from +software. |
| ROMExtSecurityDescriptor | -SW register | +RomHash | +Computed by ROM controller | -The implementation may choose one of the following options: - -1. Hash of the ROM extension. Changes in the ROM extension code will trigger an - update of the Creator Identity. -2. Use a software binding tag stored in the ROM_EXT manifest. This is to - retain the Creator Identity across validated updates of the ROM_EXT. - The implementation may opt to use the software binding interface - described in later sections to fulfill this property. +SHA-3-256 hash of the ROM image. |
| DeviceIdentifier | -OTP | +Health State Measurement | +Computed by Lifecycle controller | -Provisioned at manufacturing time. Readable from software and JTAG interface. +Comprises the following measurements: + +* Device life cycle state. +* Debug mode state. + +The debug mode shall be used as well if there are multiple debug configurations +supported by a single life cycle state. |
| HardwareRevisionSecret | -Gates | +DeviceIdentifier | +OTP | -Encoded in gates. Provisioned by Silicon Creator before tapeout. Hidden from -software. +Provisioned at manufacturing time. Readable from software and JTAG interface. |
| Health State Measurement | -Register (ROM stage) | +ROMExtSecurityDescriptor | +SW register | -Comprises the following measurements: - -* Device life cycle state. -* Debug mode state. -* ROM Hash. - -Some values are read from the device life cycle controller. The device life -cycle state should be consumed by the ROM stage. +The implementation may choose one of the following options: -The debug mode shall be used as well if there are multiple debug configurations -supported by a single life cycle state. +1. Hash of the ROM extension. Changes in the ROM extension code will trigger an + update of the Creator Identity. +2. Use a software binding tag stored in the ROM_EXT manifest. This is to + retain the Creator Identity across validated updates of the ROM_EXT. + The implementation may opt to use the software binding interface + described in later sections to fulfill this property. |
| Description | |||
| OwnerRootSecret | +id="creator-secret"CreatorSecret | Flash | -Used as a diversification constant with acceptable entropy. Provisioned at -Ownership Transfer time by the Silicon Creator. - -The OwnerRootSecret has different visibility options depending on the level of -isolation provided in hardware: +Additional diversification key stored in flash. Provisioned at +manufacturing time by the Silicon Creator. -* The value should be hidden from software after provisioning. -* The value is visible to ROM and ROM Extension, but hidden from all Silicon - Owner software. The ROM Extension implements this property. +Hidden from software once provisioned. |
| Encoding | Description | ||
| OwnerRootSecret | +Flash | ++Used as a diversification constant with acceptable entropy. Provisioned at +Ownership Transfer time by the Silicon Creator. + +The OwnerRootSecret has different visibility options depending on the level of +isolation provided in hardware: + +* The value should be hidden from software after provisioning. +* The value is visible to ROM and ROM Extension, but hidden from all Silicon + Owner software. The ROM Extension implements this property. + | +|
| OwnerRootKey | Internal RAM | diff --git a/doc/security/specs/identities_and_root_keys/identities_and_root_keys_DICE_fig1b.svg b/doc/security/specs/identities_and_root_keys/identities_and_root_keys_DICE_fig1b.svg index dfe494f748620..cbad2fe7706c0 100644 --- a/doc/security/specs/identities_and_root_keys/identities_and_root_keys_DICE_fig1b.svg +++ b/doc/security/specs/identities_and_root_keys/identities_and_root_keys_DICE_fig1b.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/hw/ip/keymgr/doc/theory_of_operation.md b/hw/ip/keymgr/doc/theory_of_operation.md index 74a30f71e9148..6c65520678984 100644 --- a/hw/ip/keymgr/doc/theory_of_operation.md +++ b/hw/ip/keymgr/doc/theory_of_operation.md @@ -53,15 +53,17 @@ When transitioning from `Initialized` to this state, a KMAC operation is invoked The output of the KMAC operation replaces the previous value of the internal key, and the new value becomes the `CreatorRootKey`. Inputs to the derivation function are: -* `DiversificationKey`: Secret seed from flash +* `HardwareRevisionSecret`: A global design time constant. +* `ROMHash`: SHA-3-256 hash of the ROM image. * `HealthMeasurement`: Current life cycle state * To avoid a state value corresponding to each life cycle state, the raw life cycle value is not used. * Instead, certain life cycle states diversify the same way. * Please see the life cycle controller for more details. * `DeviceIdentifier`: Unique device identification. -* `HardwareRevisionSecret`: A global design time constant. +* `SoftwareBinding`: A software programmed value related to ROMExt. + -Other than the `DiversificationKey` and `HardwareRevisionSecret`, none of the values above are considered secret. +Other than `HardwareRevisionSecret`, none of the values above are considered secret. Once the `CreatorRootKey` is reached, software can request key manager to advance state, generate output key or generate output identity. The key used for all 3 functions is the `CreatorRootKey`. @@ -77,7 +79,7 @@ This state is reached through another invocation of the KMAC operation using the The output of the KMAC operation replaces the previous value of the internal key, and the new value becomes the `OwnerIntermediateKey`. The relevant data inputs are: -* `OwnerRootSecret`: Secret seed from flash. +* `CreatorSecret`: A secret seed from flash determined by the SiliconCreator. * `SoftwareBinding`: A software programmed value representing the first owner code to be run. Once the `OwnerIntermediateKey` is created, software can request key manager to advance state, generate output key or generate output identity. @@ -92,6 +94,7 @@ This state is reached through another invocation of the KMAC operation using the The output of the KMAC operation replaces the previous value of the internal key, and the new value becomes the `OwnerRootKey`. The relevant inputs are: +* `OwnerRootSecret`: Secret seed from flash. * `SoftwareBinding` - A software programmed value representing the owner kernel code. Once the `OwnerRootKey` is created, software can request key manager to advance state, generate output key or generate output identity.