Repository navigation
reverse RKTH order as boot ROM expects it. - #58
JamesHuard merged 2 commits into
Conversation
JamesHuard
left a comment
JamesHuard
left a comment
There was a problem hiding this comment.
Confusing to me that we were reversing byte ordering here in the first place
There was a problem hiding this comment.
🔵 Needs a closer look
The persistent trust-anchor ordering change needs target-device validation of secure cold boot and ROM API authentication.
No open issues 🎉
What changed in this PR
This PR removes root-key hash array reversal to align provisioning data with the order expected by the boot ROM for secure boot authentication.
Changes:
- Store classical and post-quantum root-key hashes as plain arrays in CMPA.
- Update provisioning assignments and hash comparisons to use those arrays directly.
- Pass stored hashes directly to ROM image-authentication parameters.
| File | Description |
|---|---|
libs/mcxa-security-provisioning/src/lib.rs |
Removes reversal wrappers from hash assignment and comparison. |
libs/mcxa-ifr/src/lib.rs |
Changes both CMPA hash fields and defaults to plain arrays. |
libs/ec-slimloader-mcxa/src/verification.rs |
Uses stored hash arrays directly for ROM authentication. |
Review effort: Balanced
Validated on EVK. |
|
felipebalbi
left a comment
felipebalbi
left a comment
There was a problem hiding this comment.
This is the implementation of what I had already commented on PR #49. I would really like to see some unit tests pinning the behavior to prevent re-litigation in the future.
Some tests can be added to this PR while further testing would require some refactoring.
Can you add some basic tests before we merge this? Maybe a "golden vector" type test?
Head branch was pushed to by a user without write access
Added. |
With the degrade / degrade_original the RKTH order is reversed from how ROM wants it on boot.
Dev mode or ROM API call always works because the read/write is in correct order, but for boot SB verify, the order needs to be the original BE order; without it ROM won't authenticate the SBL.