[keymgr, rtl] Reorganize keymgr advance payloads #22878
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ballifatih
requested review from
matutem
and removed request for
a team and
matutem
ballifatih
force-pushed
the
keymgr_reorg_cnsts
branch
from
fae8593
to
cee92c6
Compare
|
Visual description of how advance payloads change with this PR: |
There was a problem hiding this comment.
Thx @ballifatih, RTL and DV change LGTM.
In the RTL, this is as simple as adding the revision seed to the material used for advancing into the OwnerIntermediate key and the Owner key.
DV seems to have been properly updated to cover this change: I ran util/dvsim/dvsim.py hw/ip/keymgr/dv/keymgr_sim_cfg.hjson -i all -rx 0.5 and got the usual pass rates.
That leaves the spec side, where I'd like explicit approval from @moidx and for which we should update doc/security/specs/identities_and_root_keys/identities_and_root_keys_DICE_fig1b.svg if we decide to merge this
vogelpi
reviewed
May 23, 2024
There was a problem hiding this comment.
The changes look good to me, thanks @ballifatih for working out the change and making sure DV can deal with this, too. I am supportive of merging this but don't want to make the final call as I don't know the design / relevant spec that well.
A solution to the issue raised in lowRISC#22565, which does the following changes: * Use REVISION_SEED only for 1st advance as the first block. * Use CREATOR_ADV_SEED only for 2nd advance as the first block. * Use OWNER_ADV_SEED only for 3rd advance as the first block. thereby ensuring that domain separation for KDF-KMAC is done correctly. Signed-off-by: Fatih Balli <[email protected]>
ballifatih
force-pushed
the
keymgr_reorg_cnsts
branch
from
cee92c6
to
7d6e790
Compare
ballifatih
changed the title
revision_seed in advance calls
|
Block-level DV results look similar to without this PR. |
|
|
|
With the last push, keymgr advance messages are organized as below:
|
moidx
approved these changes
May 25, 2024
|
Thanks @ballifatih! |
ballifatih
added a commit
to ballifatih/opentitan
that referenced
this pull request
Aug 23, 2024
For better alignment with the NIST standards, we have updated how diversification inputs are consumed during advance calls. The RTL/DV change was resolved in lowRISC#22878. This commit updates the identity and keys documentation to match these previously merged changes. Signed-off-by: Fatih Balli <[email protected]>
timothytrippel
pushed a commit
that referenced
this pull request
Oct 2, 2024
For better alignment with the NIST standards, we have updated how diversification inputs are consumed during advance calls. The RTL/DV change was resolved in #22878. This commit updates the identity and keys documentation to match these previously merged changes. Signed-off-by: Fatih Balli <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I am having some issues with my environment and I need to runt this through CI.
It basically tries to address to #22565 by: