Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[manuf] Propose to store DICE certificates in the flash_info with the "Cert Header" #24942

Closed
2 of 4 tasks
tommychiu-github opened this issue Oct 30, 2024 · 4 comments · Fixed by #24992
Closed
2 of 4 tasks

[manuf] Propose to store DICE certificates in the flash_info with the "Cert Header" #24942

tommychiu-github opened this issue Oct 30, 2024 · 4 comments · Fixed by #24992
Assignees
@timothytrippel @tommychiu-github
Labels
Manufacturing Issues related to manufacturing tasks (hw or sw)
Milestone
Earlgrey-PROD.Pro...

Comments

@tommychiu-github
Copy link
Contributor

tommychiu-github commented Oct 30, 2024 •
edited
Loading

Test point name

NA

Host side component

None

OpenTitanTool infrastructure implemented

None

Silicon Validation (SiVal)

Yes

Emulation Targets

  • None
  • CW310
  • Hyperdebug + CW310

Contact person

No response

Checklist

Please fill out this checklist as items are completed. Link to PRs and issues as appropriate.

  • Device-side (C) component developed

Currently, during ft_perso, the host write the RAW endorsed DICE certificate to flash_info pages.
When it needs to access them later on, the certificate length is calculated by parsing the header (1 or 2 bytes). This design works for X509 but not CWT-CBOR since there's no such information in some CBOR types (map, array specifically).
Ref:

I'm proposing to change the certificat storing format as below. The certificate is prepended by a 16 bits header followed by the ASCII characters of the certificate name, followed by the certificate body.
This format is used already when transfering tbs & certificates from host vs. device.

The original X509 parsing logic can be reused for cross checking the result from the Cert Header.

   *  d15                                         d0
   * +-------------+--------------------------------+
   * | 4 bit       |            12 bits             |
   * +-------------+--------------------------------+
   * | name length |12 bits total cert payload size | <-- Cert Header
   * +-------------+--------------------------------+
   * |             cert name string                 |
   * +----------------------------------------------+
   * |                   cert                       |
   * +----------------------------------------------+

Update

Move to the new storing format based on the conclusion.

   *  d15                                         d0
   * +-------------+--------------------------------+
   * | 4 bit type  |   12 bits total object size    | <-- Object Header
   * +-------------+--------------------------------+
   * | name length |12 bits total cert payload size | <-- Cert Header
   * +-------------+--------------------------------+
   * |             cert name string                 |
   * +----------------------------------------------+
   * |                   cert                       |
   * +----------------------------------------------+
@tommychiu-github tommychiu-github added Component:SiliconValidation Manufacturing Issues related to manufacturing tasks (hw or sw) labels Oct 30, 2024
@tommychiu-github tommychiu-github self-assigned this Oct 30, 2024
@tommychiu-github
Copy link
Contributor Author

@timothytrippel for viz

@tommychiu-github
Copy link
Contributor Author

@timothytrippel for viz

I have a patch for that already. Can file a PR soon.

tommychiu-github added a commit to tommychiu-github/opentitan that referenced this issue Oct 30, 2024
@tommychiu-github
[manuf] Prepend a header to certificate before storing on flash
a839929 
Currently, during ft_perso, the host write the RAW endorsed DICE
certificate to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
@tommychiu-github tommychiu-github mentioned this issue Oct 30, 2024
Closed
tommychiu-github added a commit to tommychiu-github/opentitan that referenced this issue Oct 30, 2024
@tommychiu-github
[manuf] Prepend a header to certificate before storing on flash
08dbe2e 
Currently, during ft_perso, the host write the RAW endorsed DICE
certificate to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Signed-off-by: Tommy Chiu <[email protected]>
@timothytrippel
Copy link
Contributor

This sound reasonable to me. It looks like #24951 is the associated fix?

@tommychiu-github
Copy link
Contributor Author

This sound reasonable to me. It looks like #24951 is the associated fix?

Yes, that's it.

tommychiu-github added a commit to tommychiu-github/opentitan that referenced this issue Oct 31, 2024
@tommychiu-github
[manuf] Prepend a header to certificate before storing on flash
a4ff58c 
Currently, during ft_perso, the host write the RAW endorsed DICE
certificate to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Signed-off-by: Tommy Chiu <[email protected]>
tommychiu-github added a commit to tommychiu-github/opentitan that referenced this issue Oct 31, 2024
@tommychiu-github
[manuf] Prepend a header to certificate before storing on flash
34a5c7a 
Currently, during ft_perso, the host write the RAW endorsed DICE
certificate to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Signed-off-by: Tommy Chiu <[email protected]>
tommychiu-github added a commit to tommychiu-github/opentitan that referenced this issue Oct 31, 2024
@tommychiu-github
[manuf] Prepend a header to certificate before storing on flash
5e162c9 
Currently, during ft_perso, the host write the RAW endorsed DICE
certificate to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Signed-off-by: Tommy Chiu <[email protected]>
tommychiu-github added a commit to tommychiu-github/opentitan that referenced this issue Nov 1, 2024
@tommychiu-github
[manuf] Prepend a header to certificate before storing on flash
bd38b71 
Currently, during ft_perso, the host write the RAW endorsed DICE
certificate to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Signed-off-by: Tommy Chiu <[email protected]>
tommychiu-github added a commit to tommychiu-github/opentitan that referenced this issue Nov 1, 2024
@tommychiu-github
[manuf] Prepend a header to certificate before storing on flash
f829604 
Currently, during ft_perso, the host write the RAW endorsed DICE
certificate to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Signed-off-by: Tommy Chiu <[email protected]>
timothytrippel pushed a commit to timothytrippel/opentitan that referenced this issue Nov 2, 2024
@tommychiu-github @timothytrippel
[manuf] write certs to flash in perso LTV object format
12034c4 
Currently, during ft_perso, the host writes the raw endorsed X.509
certificates (in ASN.1 DER format) to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the ASN.1 header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Co-authored-by: Tommy Chiu <[email protected]>
Signed-off-by: Tim Trippel <[email protected]>
@timothytrippel timothytrippel mentioned this issue Nov 2, 2024
Merged
timothytrippel pushed a commit to timothytrippel/opentitan that referenced this issue Nov 2, 2024
@tommychiu-github @timothytrippel
[manuf] write certs to flash in perso LTV object format
fb6c4a6 
Currently, during ft_perso, the host writes the raw endorsed X.509
certificates (in ASN.1 DER format) to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the ASN.1 header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Co-authored-by: Tommy Chiu <[email protected]>
Signed-off-by: Tim Trippel <[email protected]>
timothytrippel pushed a commit to timothytrippel/opentitan that referenced this issue Nov 2, 2024
@tommychiu-github @timothytrippel
[manuf] write certs to flash in perso LTV object format
f26a4f3 
Currently, during ft_perso, the host writes the raw endorsed X.509
certificates (in ASN.1 DER format) to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the ASN.1 header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Bug: lowRISC#24942
Test: //sw/device/silicon_creator/manuf/base:ft_provision_cw340
Co-authored-by: Tommy Chiu <[email protected]>
Signed-off-by: Tim Trippel <[email protected]>
timothytrippel added a commit to timothytrippel/opentitan that referenced this issue Nov 2, 2024
@timothytrippel @tommychiu-github
[manuf] write certs to flash in perso LTV object format
fc628e6 
Currently, during ft_perso, the host writes the raw endorsed X.509
certificates (in ASN.1 DER format) to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the ASN.1 header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Fixes lowRISC#24942.

Co-authored-by: Tommy Chiu <[email protected]>
Signed-off-by: Tim Trippel <[email protected]>
@timothytrippel timothytrippel self-assigned this Nov 4, 2024
timothytrippel added a commit that referenced this issue Nov 5, 2024
@timothytrippel @tommychiu-github
[manuf] write certs to flash in perso LTV object format
3eac5d6 
Currently, during ft_perso, the host writes the raw endorsed X.509
certificates (in ASN.1 DER format) to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the ASN.1 header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Fixes #24942.

Co-authored-by: Tommy Chiu <[email protected]>
Signed-off-by: Tim Trippel <[email protected]>
timothytrippel added a commit to timothytrippel/opentitan that referenced this issue Nov 7, 2024
@timothytrippel
[manuf] write certs to flash in perso LTV object format
0876b77 
Currently, during ft_perso, the host writes the raw endorsed X.509
certificates (in ASN.1 DER format) to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the ASN.1 header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Fixes lowRISC#24942.

Co-authored-by: Tommy Chiu <[email protected]>
Signed-off-by: Tim Trippel <[email protected]>
(cherry picked from commit fc628e6)
timothytrippel added a commit that referenced this issue Nov 8, 2024
@timothytrippel
[manuf] write certs to flash in perso LTV object format
0e1898f 
Currently, during ft_perso, the host writes the raw endorsed X.509
certificates (in ASN.1 DER format) to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the ASN.1 header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Fixes #24942.

Co-authored-by: Tommy Chiu <[email protected]>
Signed-off-by: Tim Trippel <[email protected]>
(cherry picked from commit fc628e6)
andrea-caforio pushed a commit to andrea-caforio/opentitan that referenced this issue Nov 12, 2024
@timothytrippel @tommychiu-github @andrea-caforio
[manuf] write certs to flash in perso LTV object format
446d385 
Currently, during ft_perso, the host writes the raw endorsed X.509
certificates (in ASN.1 DER format) to flash_info pages.
When it needs to access them later on, the certificate length is
calculated by parsing the ASN.1 header (1 or 2 bytes).
This design works for X509 but not CWT-CBOR since there's no such
information in some CBOR types (map, array specifically).

Fixes lowRISC#24942.

Co-authored-by: Tommy Chiu <[email protected]>
Signed-off-by: Tim Trippel <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@timothytrippel timothytrippel

@tommychiu-github tommychiu-github

Labels
Manufacturing Issues related to manufacturing tasks (hw or sw)
Projects
None yet
Milestone
Earlgrey-PROD.Provisioning
2 participants
@timothytrippel @tommychiu-github