Ownership transfer: can owners specify the next owner at unlock time?
- Dominant language
- SystemVerilog
- Stars
- 3.6k
- Forks
- 1.1k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 141
Description
My reading of the [ownership transfer spec](https://docs.opentitan.org/doc/security/specs/ownership_transfer/) indicates that ROM_EXT must be provided with two separate endorsements, in sequence:
* This particular chip is now unlocked for ownership transfer, to whomever. Includes an unlock nonce. May be signed by a key held in an online key manager service.
* Any chip I own is allowed to transit to a specified next owner. Does not include an unlock nonce. May be signed by a key held in an offline HSM.
It doesn't appear that there is any binding between these two endorsements. Which for some owners is likely ideal, as the exact next owner may not be known at the time the chip is transiting out of the owner's direct control. But a consequence of this is that if OWNER_A has ever transferred ownership of any of its chips to OWNER_B, even if OWNER_A knows that a given chip is meant to transit directly to OWNER_C, OWNER_B can still claim ownership of that chip while it's in an unlocked state.
Are there any use-cases for requiring that the two endorsements be coupled? "Not only are you currently unlocked for ownership, but your next owner shall be OWNER_FOO."
Contributor guide
Assessment
This issue has not been assessed yet.