[perso] Remove CDI 0 and CDI 1 generation and endorsement during provisioning

rules/sku.bzl

@@ -86,8 +86,6 @@ def _sku_cfg_impl(ctx):
 
     if ctx.attr.dice_ca:
         config["dice_ca"] = process_ca(ctx.attr.dice_ca)
-    if ctx.attr.blob_version:
-        config["blob_version"] = ctx.attr.blob_version
     if ctx.attr.ext_ca:
         config["ext_ca"] = process_ca(ctx.attr.ext_ca)
 
@@ -135,7 +133,6 @@ sku_cfg = rule(
     implementation = _sku_cfg_impl,
     attrs = {
         "sku_name": attr.string(mandatory = True),
-        "blob_version": attr.int(mandatory = False),
         "product": attr.string(mandatory = True),
         "si_creator": attr.string(mandatory = True),
         "package": attr.string(mandatory = True),

sw/device/lib/testing/json/provisioning_data.h

@@ -121,11 +121,7 @@ UJSON_SERDE_STRUCT(ManufFtIndividualizeData, \
 // clang-format off
 #define STRUCT_MANUF_CERTGEN_INPUTS(field, string) \
     field(dice_auth_key_key_id, uint8_t, 20) \
-    field(ext_auth_key_key_id, uint8_t, 20) \
-    /* TODO: This should be a perso_blob_version_t enum, but using a primitive \
-     * uint16_t to avoid a ujson deserialization bug with nested derived \
-     * types. */ \
-    field(blob_version, uint16_t)
+    field(ext_auth_key_key_id, uint8_t, 20)
 UJSON_SERDE_STRUCT(ManufCertgenInputs, \
                    manuf_certgen_inputs_t, \
                    STRUCT_MANUF_CERTGEN_INPUTS);

sw/device/silicon_creator/lib/cert/dice.c

@@ -75,12 +75,13 @@ static bool get_debug_mode_cdi1(owner_app_domain_t key_domain) {
 }
 
 rom_error_t dice_uds_tbs_cert_build(
-    hmac_digest_t *otp_creator_sw_cfg_measurement,
-    hmac_digest_t *otp_owner_sw_cfg_measurement,
-    hmac_digest_t *otp_rot_creator_auth_codesign_measurement,
-    hmac_digest_t *otp_rot_creator_auth_state_measurement,
-    cert_key_id_pair_t *key_ids, ecdsa_p256_public_key_t *uds_pubkey,
-    uint8_t *tbs_cert, size_t *tbs_cert_size) {
+    const hmac_digest_t *otp_creator_sw_cfg_measurement,
+    const hmac_digest_t *otp_owner_sw_cfg_measurement,
+    const hmac_digest_t *otp_rot_creator_auth_codesign_measurement,
+    const hmac_digest_t *otp_rot_creator_auth_state_measurement,
+    const cert_key_id_pair_t *key_ids,
+    const ecdsa_p256_public_key_t *uds_pubkey, uint8_t *tbs_cert,
+    size_t *tbs_cert_size) {
   // Generate the TBS certificate.
   uds_tbs_values_t uds_tbs_params = {0};
 
@@ -107,11 +108,11 @@ rom_error_t dice_uds_tbs_cert_build(
   return kErrorOk;
 }
 
-rom_error_t dice_cdi_0_cert_build(hmac_digest_t *rom_ext_measurement,
+rom_error_t dice_cdi_0_cert_build(const hmac_digest_t *rom_ext_measurement,
                                   uint32_t rom_ext_security_version,
-                                  cert_key_id_pair_t *key_ids,
-                                  ecdsa_p256_public_key_t *uds_pubkey,
-                                  ecdsa_p256_public_key_t *cdi_0_pubkey,
+                                  const cert_key_id_pair_t *key_ids,
+                                  const ecdsa_p256_public_key_t *uds_pubkey,
+                                  const ecdsa_p256_public_key_t *cdi_0_pubkey,
                                   uint8_t *cert, size_t *cert_size) {
   hmac_digest_t rom_ext_hash = *rom_ext_measurement;
   util_reverse_bytes(&rom_ext_hash, sizeof(rom_ext_hash));
@@ -166,11 +167,13 @@ rom_error_t dice_cdi_0_cert_build(hmac_digest_t *rom_ext_measurement,
 }
 
 rom_error_t dice_cdi_1_cert_build(
-    hmac_digest_t *owner_measurement, hmac_digest_t *owner_manifest_measurement,
-    hmac_digest_t *owner_history_hash, uint32_t owner_security_version,
-    owner_app_domain_t key_domain, cert_key_id_pair_t *key_ids,
-    ecdsa_p256_public_key_t *cdi_0_pubkey,
-    ecdsa_p256_public_key_t *cdi_1_pubkey, uint8_t *cert, size_t *cert_size) {
+    const hmac_digest_t *owner_measurement,
+    const hmac_digest_t *owner_manifest_measurement,
+    const hmac_digest_t *owner_history_hash, uint32_t owner_security_version,
+    owner_app_domain_t key_domain, const cert_key_id_pair_t *key_ids,
+    const ecdsa_p256_public_key_t *cdi_0_pubkey,
+    const ecdsa_p256_public_key_t *cdi_1_pubkey, uint8_t *cert,
+    size_t *cert_size) {
   hmac_digest_t owner_hash = *owner_measurement;
   hmac_digest_t owner_manifest_hash = *owner_manifest_measurement;
   util_reverse_bytes(&owner_hash, sizeof(owner_hash));

sw/device/silicon_creator/lib/cert/dice.h

@@ -54,12 +54,13 @@ extern const sc_keymgr_ecc_key_t kDiceKeyCdi1;
  */
 OT_WARN_UNUSED_RESULT
 rom_error_t dice_uds_tbs_cert_build(
-    hmac_digest_t *otp_creator_sw_cfg_measurement,
-    hmac_digest_t *otp_owner_sw_cfg_measurement,
-    hmac_digest_t *otp_rot_creator_auth_codesign_measurement,
-    hmac_digest_t *otp_rot_creator_auth_state_measurement,
-    cert_key_id_pair_t *key_ids, ecdsa_p256_public_key_t *uds_pubkey,
-    uint8_t *tbs_cert, size_t *tbs_cert_size);
+    const hmac_digest_t *otp_creator_sw_cfg_measurement,
+    const hmac_digest_t *otp_owner_sw_cfg_measurement,
+    const hmac_digest_t *otp_rot_creator_auth_codesign_measurement,
+    const hmac_digest_t *otp_rot_creator_auth_state_measurement,
+    const cert_key_id_pair_t *key_ids,
+    const ecdsa_p256_public_key_t *uds_pubkey, uint8_t *tbs_cert,
+    size_t *tbs_cert_size);
 
 /**
  * Generates the CDI_0 attestation keypair and X.509 certificate.
@@ -76,11 +77,11 @@ rom_error_t dice_uds_tbs_cert_build(
  * @return The result of the operation.
  */
 OT_WARN_UNUSED_RESULT
-rom_error_t dice_cdi_0_cert_build(hmac_digest_t *rom_ext_measurement,
+rom_error_t dice_cdi_0_cert_build(const hmac_digest_t *rom_ext_measurement,
                                   uint32_t rom_ext_security_version,
-                                  cert_key_id_pair_t *key_ids,
-                                  ecdsa_p256_public_key_t *uds_pubkey,
-                                  ecdsa_p256_public_key_t *cdi_0_pubkey,
+                                  const cert_key_id_pair_t *key_ids,
+                                  const ecdsa_p256_public_key_t *uds_pubkey,
+                                  const ecdsa_p256_public_key_t *cdi_0_pubkey,
                                   uint8_t *cert, size_t *cert_size);
 
 /**
@@ -102,11 +103,13 @@ rom_error_t dice_cdi_0_cert_build(hmac_digest_t *rom_ext_measurement,
  */
 OT_WARN_UNUSED_RESULT
 rom_error_t dice_cdi_1_cert_build(
-    hmac_digest_t *owner_measurement, hmac_digest_t *owner_manifest_measurement,
-    hmac_digest_t *owner_history_hash, uint32_t owner_security_version,
-    owner_app_domain_t key_domain, cert_key_id_pair_t *key_ids,
-    ecdsa_p256_public_key_t *cdi_0_pubkey,
-    ecdsa_p256_public_key_t *cdi_1_pubkey, uint8_t *cert, size_t *cert_size);
+    const hmac_digest_t *owner_measurement,
+    const hmac_digest_t *owner_manifest_measurement,
+    const hmac_digest_t *owner_history_hash, uint32_t owner_security_version,
+    owner_app_domain_t key_domain, const cert_key_id_pair_t *key_ids,
+    const ecdsa_p256_public_key_t *cdi_0_pubkey,
+    const ecdsa_p256_public_key_t *cdi_1_pubkey, uint8_t *cert,
+    size_t *cert_size);
 
 /**
  * Perform attestation for CDI_0.

sw/device/silicon_creator/lib/cert/dice_cwt.c

@@ -142,12 +142,13 @@ static rom_error_t configuration_descriptor_build(
 }
 
 rom_error_t dice_uds_tbs_cert_build(
-    hmac_digest_t *otp_creator_sw_cfg_measurement,
-    hmac_digest_t *otp_owner_sw_cfg_measurement,
-    hmac_digest_t *otp_rot_creator_auth_codesign_measurement,
-    hmac_digest_t *otp_rot_creator_auth_state_measurement,
-    cert_key_id_pair_t *key_ids, ecdsa_p256_public_key_t *uds_pubkey,
-    uint8_t *tbs_cert, size_t *tbs_cert_size) {
+    const hmac_digest_t *otp_creator_sw_cfg_measurement,
+    const hmac_digest_t *otp_owner_sw_cfg_measurement,
+    const hmac_digest_t *otp_rot_creator_auth_codesign_measurement,
+    const hmac_digest_t *otp_rot_creator_auth_state_measurement,
+    const cert_key_id_pair_t *key_ids,
+    const ecdsa_p256_public_key_t *uds_pubkey, uint8_t *tbs_cert,
+    size_t *tbs_cert_size) {
   // These parameters are used by the X.509 sibling implementation.
   OT_DISCARD(otp_creator_sw_cfg_measurement);
   OT_DISCARD(otp_owner_sw_cfg_measurement);
@@ -180,11 +181,11 @@ rom_error_t dice_uds_tbs_cert_build(
   return kErrorOk;
 }
 
-rom_error_t dice_cdi_0_cert_build(hmac_digest_t *rom_ext_measurement,
+rom_error_t dice_cdi_0_cert_build(const hmac_digest_t *rom_ext_measurement,
                                   uint32_t rom_ext_security_version,
-                                  cert_key_id_pair_t *key_ids,
-                                  ecdsa_p256_public_key_t *uds_pubkey,
-                                  ecdsa_p256_public_key_t *cdi_0_pubkey,
+                                  const cert_key_id_pair_t *key_ids,
+                                  const ecdsa_p256_public_key_t *uds_pubkey,
+                                  const ecdsa_p256_public_key_t *cdi_0_pubkey,
                                   uint8_t *cert, size_t *cert_size) {
   // Build Subject public key structure
   size_t cose_key_size = sizeof(cose_key_buffer);
@@ -281,11 +282,13 @@ rom_error_t dice_cdi_0_cert_build(hmac_digest_t *rom_ext_measurement,
 }
 
 rom_error_t dice_cdi_1_cert_build(
-    hmac_digest_t *owner_measurement, hmac_digest_t *owner_manifest_measurement,
-    hmac_digest_t *owner_history_hash, uint32_t owner_security_version,
-    owner_app_domain_t key_domain, cert_key_id_pair_t *key_ids,
-    ecdsa_p256_public_key_t *cdi_0_pubkey,
-    ecdsa_p256_public_key_t *cdi_1_pubkey, uint8_t *cert, size_t *cert_size) {
+    const hmac_digest_t *owner_measurement,
+    const hmac_digest_t *owner_manifest_measurement,
+    const hmac_digest_t *owner_history_hash, uint32_t owner_security_version,
+    owner_app_domain_t key_domain, const cert_key_id_pair_t *key_ids,
+    const ecdsa_p256_public_key_t *cdi_0_pubkey,
+    const ecdsa_p256_public_key_t *cdi_1_pubkey, uint8_t *cert,
+    size_t *cert_size) {
   // TODO: The ownership history is currently not included in the CWT
   // certificate.
   OT_DISCARD(owner_history_hash);

sw/device/silicon_creator/lib/cert/dice_mldsa.c

@@ -60,19 +60,25 @@ const dice_storage_slot_v1_t kDiceStorageSlotPqCdi0 = {
     .bank_idx = 0,
     .header =
         {
-            .object_header = TLV_OBJ_HEADER_V1(kPersoObjectTypeX509Cert, 8192),
-            .cert_header = TLV_CERT_HEADER_V1(8, 0),
-            .name = "PQ_CDI_0",
+            .version_header = kPersoTlvVersionPrefixV1,
+            .object_header =
+                TLV_OBJ_HEADER_V1(kPersoObjectTypeX509Cert,
+                                  8192 - sizeof(perso_tlv_version_header_t)),
+            .cert_header = TLV_CERT_HEADER_V1(12, 0),
+            .name = "PQ_CDI_0",  // Zero-padded to 12 bytes.
         },
 };
 
 const dice_storage_slot_v1_t kDiceStorageSlotPqCdi1 = {
     .bank_idx = 1,
     .header =
         {
-            .object_header = TLV_OBJ_HEADER_V1(kPersoObjectTypeX509Cert, 8192),
-            .cert_header = TLV_CERT_HEADER_V1(8, 0),
-            .name = "PQ_CDI_1",
+            .version_header = kPersoTlvVersionPrefixV1,
+            .object_header =
+                TLV_OBJ_HEADER_V1(kPersoObjectTypeX509Cert,
+                                  8192 - sizeof(perso_tlv_version_header_t)),
+            .cert_header = TLV_CERT_HEADER_V1(12, 0),
+            .name = "PQ_CDI_1",  // Zero-padded to 12 bytes.
         },
 };
 

sw/device/silicon_creator/lib/cert/dice_storage.c

@@ -99,9 +99,10 @@ rom_error_t dice_storage_write_cert_tlv_v1(const dice_storage_slot_v1_t *slot,
                                  write_perms, cfg, kHardenedBoolFalse);
 
   dice_storage_header_v1_t hdr = slot->header;
-  PERSO_TLV_SET_FIELD_V1(
-      Crth, Size, hdr.cert_header,
-      sizeof(dice_storage_header_v1_t) - sizeof(hdr.object_header) + cert_size);
+  PERSO_TLV_SET_FIELD_V1(Crth, Size, hdr.cert_header,
+                         sizeof(dice_storage_header_v1_t) -
+                             sizeof(hdr.version_header) -
+                             sizeof(hdr.object_header) + cert_size);
 
   for (size_t i = 0; i < num_pages; ++i) {
     RETURN_IF_ERROR(flash_ctrl_data_erase(

sw/device/silicon_creator/lib/cert/dice_storage.h

@@ -235,15 +235,17 @@ OT_WARN_UNUSED_RESULT
 rom_error_t dice_storage_check_digest(const dice_storage_page_t *page);
 
 typedef struct dice_storage_header_v1 {
-  uint32_t object_header;  // Big Endian
-  uint32_t cert_header;    // Big Endian
-  char name[8];            // "PQ_CDI_0" or "PQ_CDI_1" (8 bytes)
+  uint32_t version_header;  // 0x010004F0 (kPersoTlvVersionPrefixV1)
+  uint32_t object_header;   // Big Endian
+  uint32_t cert_header;     // Big Endian
+  char name[12];            // "PQ_CDI_x" string NULL-padded to 12 bytes
 } dice_storage_header_v1_t;
 
-OT_ASSERT_MEMBER_OFFSET(dice_storage_header_v1_t, object_header, 0);
-OT_ASSERT_MEMBER_OFFSET(dice_storage_header_v1_t, cert_header, 4);
-OT_ASSERT_MEMBER_OFFSET(dice_storage_header_v1_t, name, 8);
-OT_ASSERT_SIZE(dice_storage_header_v1_t, 16);
+OT_ASSERT_MEMBER_OFFSET(dice_storage_header_v1_t, version_header, 0);
+OT_ASSERT_MEMBER_OFFSET(dice_storage_header_v1_t, object_header, 4);
+OT_ASSERT_MEMBER_OFFSET(dice_storage_header_v1_t, cert_header, 8);
+OT_ASSERT_MEMBER_OFFSET(dice_storage_header_v1_t, name, 12);
+OT_ASSERT_SIZE(dice_storage_header_v1_t, 24);
 
 /**
  * Represents the TLV v1 format storage layout on data flash.

sw/device/silicon_creator/lib/drivers/keymgr.c

@@ -327,9 +327,9 @@ rom_error_t sc_keymgr_sideload_clear(sc_keymgr_dest_t destination) {
   return kErrorOk;
 }
 
-rom_error_t sc_keymgr_owner_int_advance(keymgr_binding_value_t *sealing_binding,
-                                        keymgr_binding_value_t *attest_binding,
-                                        uint32_t max_key_version) {
+rom_error_t sc_keymgr_owner_int_advance(
+    const keymgr_binding_value_t *sealing_binding,
+    const keymgr_binding_value_t *attest_binding, uint32_t max_key_version) {
   HARDENED_RETURN_IF_ERROR(sc_keymgr_state_check(kScKeymgrStateCreatorRootKey));
   sc_keymgr_sw_binding_set(sealing_binding, attest_binding);
   sc_keymgr_owner_int_max_ver_set(max_key_version);
@@ -339,9 +339,9 @@ rom_error_t sc_keymgr_owner_int_advance(keymgr_binding_value_t *sealing_binding,
   return kErrorOk;
 }
 
-rom_error_t sc_keymgr_owner_advance(keymgr_binding_value_t *sealing_binding,
-                                    keymgr_binding_value_t *attest_binding,
-                                    uint32_t max_key_version) {
+rom_error_t sc_keymgr_owner_advance(
+    const keymgr_binding_value_t *sealing_binding,
+    const keymgr_binding_value_t *attest_binding, uint32_t max_key_version) {
   HARDENED_RETURN_IF_ERROR(
       sc_keymgr_state_check(kScKeymgrStateOwnerIntermediateKey));
   sc_keymgr_sw_binding_set(sealing_binding, attest_binding);

sw/device/silicon_creator/lib/drivers/keymgr.h

@@ -321,9 +321,9 @@ inline rom_error_t sc_keymgr_sideload_clear_otbn(void) {
  * @return The result of the operation.
  */
 OT_WARN_UNUSED_RESULT
-rom_error_t sc_keymgr_owner_int_advance(keymgr_binding_value_t *attest_binding,
-                                        keymgr_binding_value_t *sealing_binding,
-                                        uint32_t max_key_version);
+rom_error_t sc_keymgr_owner_int_advance(
+    const keymgr_binding_value_t *attest_binding,
+    const keymgr_binding_value_t *sealing_binding, uint32_t max_key_version);
 
 /**
  * Sets the binding registers and advances the keymgr to the `OwnerKey` (CDI_1)
@@ -339,9 +339,9 @@ rom_error_t sc_keymgr_owner_int_advance(keymgr_binding_value_t *attest_binding,
  * @return The result of the operation.
  */
 OT_WARN_UNUSED_RESULT
-rom_error_t sc_keymgr_owner_advance(keymgr_binding_value_t *attest_binding,
-                                    keymgr_binding_value_t *sealing_binding,
-                                    uint32_t max_key_version);
+rom_error_t sc_keymgr_owner_advance(
+    const keymgr_binding_value_t *attest_binding,
+    const keymgr_binding_value_t *sealing_binding, uint32_t max_key_version);
 
 /**
  * Disables the keymgr and clears all sideload slots.

sw/device/silicon_creator/manuf/base/BUILD

@@ -358,10 +358,10 @@ manifest(d = {
             ":perso_tlv_data",
             ":personalize_ext",
             "//hw/ip/otp_ctrl/data:otp_ctrl_c_regs",
+            "//sw/device/lib/base:status",
             "//sw/device/lib/crypto/drivers:entropy",
             "//sw/device/lib/dif:flash_ctrl",
             "//sw/device/lib/dif:gpio",
-            "//sw/device/lib/dif:lc_ctrl",
             "//sw/device/lib/dif:otp_ctrl",
             "//sw/device/lib/dif:pinmux",
             "//sw/device/lib/dif:rstmgr",
@@ -374,17 +374,13 @@ manifest(d = {
             "//sw/device/lib/testing/json:provisioning_data",
             "//sw/device/lib/testing/test_framework:check",
             "//sw/device/lib/testing/test_framework:ottf_main",
-            "//sw/device/lib/testing/test_framework:status",
             "//sw/device/lib/testing/test_framework:ujson_ottf",
             "//sw/device/silicon_creator/lib:attestation",
             "//sw/device/silicon_creator/lib:boot_data",
             "//sw/device/silicon_creator/lib:otbn_boot_services",
             "//sw/device/silicon_creator/lib/base:chip",
             "//sw/device/silicon_creator/lib/base:util",
             "//sw/device/silicon_creator/lib/cert",
-            "//sw/device/silicon_creator/lib/cert:cdi_0_template_library",
-            "//sw/device/silicon_creator/lib/cert:cdi_1_template_library",
-            "//sw/device/silicon_creator/lib/cert:dice_chain",
             "//sw/device/silicon_creator/lib/cert:dice_storage",
             "//sw/device/silicon_creator/lib/cert:uds_template_library",
             "//sw/device/silicon_creator/lib/drivers:flash_ctrl",