github
/
arm-trusted-firmware
mirror of https://github.com/ARM-software/arm-trusted-firmware.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
15266 Commits
5 Branches
114 Tags
55 MiB
Branch: master
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'master'
${ noResults }
arm-trusted-firmware/include/tools_share/dualroot_oid.h

20 lines
459 B
Raw Permalink Normal View History

Introduce a new "dualroot" chain of trust This new chain of trust defines 2 independent signing domains: 1) One for the silicon firmware (BL1, BL2, BL31) and optionally the Trusted OS. It is rooted in the Silicon ROTPK, just as in the TBBR CoT. 2) One for the Normal World Bootloader (BL33). It is rooted in a new key called Platform ROTPK, or PROTPK for short. In terms of certificates chain, - Signing domain 1) is similar to what TBBR advocates (see page 21 of the TBBR specification), except that the Non-Trusted World Public Key has been removed from the Trusted Key Certificate. - Signing domain 2) only contains the Non-Trusted World Content certificate, which provides the hash of the Non-Trusted World Bootloader. Compared to the TBBR CoT, there's no Non-Trusted World Key certificate for simplicity. Change-Id: I62f1e952522d84470acc360cf5ee63e4c4b0b4d9 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
5 years ago
/*
feat(auth): create a zero-OID for Subject Public Key Created an explicit zero-OID which can be used for Subject Public Key that do not have their own key identifier. With this, all keys (including the subject public key) have a proper key OID string so we don't need to make a special case of null pointers when it comes to handling key OIDs. Change-Id: Ice6923951699b6e253d7fd87e4c1b912470e0391 Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
2 years ago
* Copyright (c) 2020-2023, Arm Limited. All rights reserved.
Introduce a new "dualroot" chain of trust This new chain of trust defines 2 independent signing domains: 1) One for the silicon firmware (BL1, BL2, BL31) and optionally the Trusted OS. It is rooted in the Silicon ROTPK, just as in the TBBR CoT. 2) One for the Normal World Bootloader (BL33). It is rooted in a new key called Platform ROTPK, or PROTPK for short. In terms of certificates chain, - Signing domain 1) is similar to what TBBR advocates (see page 21 of the TBBR specification), except that the Non-Trusted World Public Key has been removed from the Trusted Key Certificate. - Signing domain 2) only contains the Non-Trusted World Content certificate, which provides the hash of the Non-Trusted World Bootloader. Compared to the TBBR CoT, there's no Non-Trusted World Key certificate for simplicity. Change-Id: I62f1e952522d84470acc360cf5ee63e4c4b0b4d9 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
5 years ago
*
* SPDX-License-Identifier: BSD-3-Clause
*/
#ifndef DUALROOT_OID_H
#define DUALROOT_OID_H
/* Reuse the Object IDs defined by TBBR for certificate extensions. */
#include "tbbr_oid.h"
/*
* Platform root-of-trust public key.
* Arbitrary value that does not conflict with any of the TBBR reserved OIDs.
*/
#define PROT_PK_OID "1.3.6.1.4.1.4128.2100.1102"
#endif /* DUALROOT_OID_H */