[keymgr] add support for injected FIPS key and swap key/context in KMAC
Open
@moidx is already working on this.
Since Mar 27, 2024.
FIPS
prodc-integration
Type:FutureRelease
- Dominant language
- SystemVerilog
- Stars
- 3.6k
- Forks
- 1.1k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 141
Description
Description
Related to #22283 to implement a potential workaround to move properties of secrets in the OTP out of FIPS scope.
Key manager can have a register which is loaded by firmware with a FIPS key, which firmware produce in whatever way is ok for it be a FIPS key (FIPS_key).
In the following derivation steps, key derived from OTP seeds and other data loaded in key manager earlier is used as a context/label for key derivation, and FIPS_key is as a key: KMAC(FIPS_key, KMAC(KMAC(RootKey, .....))).
This way output of key manager can be considered a FIPS key, and at the same time mix in hw_backed secrets.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.