Timothy Trippel

Results 23 issues of Timothy Trippel

Som certificate fields are expected to be big endian formatted in order for the ASN1 to be encoded correctly. This fixes some integer byte arrays that were incorrect, causing certificates...

Integrate the ECDSA-equivalent sigverify operations into the `otbn_boot_services` library. This will require understanding how we may achieve deterministic ECDSA signing in the ROM.

Priority:P1
Type:Task
SW:ROM

### Description For DICE compliance, the UDS attestation key pair should be generated in ROM according to the diagram below. Additionally, since the UDS attestation key is derived from the...

Type:Task
Component:Security
Hotlist:Security
SW:ROM
SW:ROM_EXT

This cherry picks #22920 and #23007 from to the `earlgrey_es_sival` branch. These commits generate TPM certificates during device personalization. Since the ROM on the ES chip enforces the ROM_EXT slot...

If a DICE certificate must be updated, the entire page must be erased before writing, since flash bits can only transition from 1 --> 0.

CherryPick:earlgrey_es_sival

This updates the ROM to measure the software readable OTP partitions, and use the measurement as input to the attestation binding CSRs of keymgr. This partially addresses #21583.

After #22957 merges, it will be more realistic to run these tests on the CW340, see: https://github.com/lowRISC/opentitan/pull/22957#issuecomment-2092739941

Component:Software
Priority:P2
Type:Task
Manufacturing

During the personalization flow (see `ft_personalize.c`), keys and TBS certificates are generated on-device, sent to the host where they are endorsed by a CA, and then sent back to the...

Component:Software
Priority:P1
Type:Task
Manufacturing

This issue is was originally a sub-task in #21583, but it has been split off into a separate issue here. Note, **this a lower priority item**, but it may be...

Priority:P2
Type:Task
SW:ROM

To enhance the performance and security of the provisioning flow, the RMA unlock token can be injected into the chip during personalization (rather than generated on-chip and extracted). This improves...

Component:Software
Priority:P1
Type:Task
Manufacturing