lowRISC / lowRISC/opentitan

[security/attestation] The ownership state shall be encoded in the attestation measurements.

Open
#3,255 2 comments 0 reactions 1 assignee View on GitHub

@moidx is already working on this.

Since Sep 9, 2022.

Component:Security Component:Software SW:ROM_EXT
Dominant language
SystemVerilog
Stars
3.6k
Forks
1.1k
Avg merge
2d 22h
Merged PRs (30d)
141

Description

As part of the ownership unlock operation, `ROM_EXT` verifies the unlock command and updates the device state to `UNOWNED`. The device proceeds with the boot flow and reports the unlock result to the kernel via `BOOT_SERVICES` shared memory.

This issue is tracks any attestation updates required as a result of this change. The current proposal is to capture the ownership state in the attestation measurements, so that it is easier to verify the state of the device.

The kernel operating in `UNOWNED` mode may request an attestation update from the `ROM_EXT` via `BOOT_SERVICES`.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.