Repository navigation
[skus,signing] Fixes for compatibility with personalization & signing changes in upstream OpenTitan - #24
Conversation
Upstream OpenTitan `earlgrey_1.0.0` has moved to adding a default keytype to identify keys, where keys can override the keytype. This is currently being used just to disambiguate SPHINCS+ (`spx`) and SLH-DSA (`slh-dsa`) keys, but may be extended in the future to refactor the current signing rule interface, which is a bit crowded. To ensure SPHINCS+ signing still works with downstream changes, and in preparation for any future changes, identify the correct default keytype on every keyset defined in this repository. Signed-off-by: Alex Jones <alex.jones@lowrisc.org>
Upstream OpenTitan earlgrey_1.0.0 has split the personalization binary into two parts: flash scrambling and personalization. Update the SKU configurations to match these changes, so that we can continue building valid releases. Signed-off-by: Alex Jones <alex.jones@lowrisc.org>
pamaury
left a comment
pamaury
left a comment
There was a problem hiding this comment.
Thanks Alex for investigating this!
|
The OT CI failed due a download issue, I restarted it but I don't know if the new run will show up on the GH UI |
|
This is expected to fail CI - it expects to find flash scrambling binaries, which don't exist for the current release. To fix this we would need to do another release, and I'm not sure about you, but I think it would be better to do a release after we get all the required changes in 😅 The first commit also uses the keyset keytype as introduced in lowRISC/opentitan/pull/31551: I expect it will probably also fail CI until that is merged. |
| "ot00-earlgrey-a2-root-slhdsa-prod-2.pub.pem": "ot00-earlgrey-a2-root-slhdsa-prod-2:domain=PreHashedSha256", | ||
| "ot00-earlgrey-a2-root-slhdsa-dev-0.pub.pem": "ot00-earlgrey-a2-root-slhdsa-dev-0:domain=PreHashedSha256", | ||
| }, | ||
| keytype = "spx", |
There was a problem hiding this comment.
spx for now. slh-dsa after we redo keygen with hsmtool+slh-dsa support, correct?
|
I'm merging this now, but it will cause CI failures until a new release is made. |
Update
ot-skuto retain compatibility with upstream OpenTitan.The first commit adds default key types to the various keysets as defined in lowRISC/opentitan#31551, and hence requires that PR to be merged. Although the flow is currently broken anyway, ideally that PR should be merged before this one is.
The second commit contains fixes for the personalization flow changes introduced in lowRISC/opentitan#30756, which split the FT personalization provisioning into two stages -- scrambling and personalization. Note that this will not actually work until the appropriate fixes to upstream OpenTitan integration is merged with PR lowRISC/opentitan#31553.