From 1ea6609de23bdfac87e654519e96327f89173d47 Mon Sep 17 00:00:00 2001 From: Alex Jones Date: Wed, 23 Sep 2026 12:35:32 +0100 Subject: [PATCH 1/2] [signing] Update keysets to label default key type Upstream OpenTitan `earlgrey_1.0.0` has moved to adding a default keytype to identify keys, where keys can override the keytype. This is currently being used just to disambiguate SPHINCS+ (`spx`) and SLH-DSA (`slh-dsa`) keys, but may be extended in the future to refactor the current signing rule interface, which is a bit crowded. To ensure SPHINCS+ signing still works with downstream changes, and in preparation for any future changes, identify the correct default keytype on every keyset defined in this repository. Signed-off-by: Alex Jones --- skus/open/keys/ca/BUILD | 1 + skus/open/keys/owner/BUILD | 2 ++ skus/open/keys/root/BUILD | 2 ++ 3 files changed, 5 insertions(+) diff --git a/skus/open/keys/ca/BUILD b/skus/open/keys/ca/BUILD index 1ebd6d8..630a4f5 100644 --- a/skus/open/keys/ca/BUILD +++ b/skus/open/keys/ca/BUILD @@ -25,6 +25,7 @@ keyset( keys = { "nuvoton-ot00-ca-ecdsa-0.pub.der": "nuvoton-ot00-ca-ecdsa-0", }, + keytype = "ecdsa", profile = "nuvoton-ot00-ca", tool = "@lowrisc_opentitan//signing:token", ) diff --git a/skus/open/keys/owner/BUILD b/skus/open/keys/owner/BUILD index 4d9f049..2591843 100644 --- a/skus/open/keys/owner/BUILD +++ b/skus/open/keys/owner/BUILD @@ -22,6 +22,7 @@ keyset( "nuvoton-ot00-app-ecdsa-prod-1.pub.der": "nuvoton-ot00-app-ecdsa-prod-1", "nuvoton-ot00-app-ecdsa-dev-0.pub.der": "nuvoton-ot00-app-ecdsa-dev-0", }, + keytype = "ecdsa", profile = "nuvoton-ot00-app", tool = "@lowrisc_opentitan//signing:token", ) @@ -34,6 +35,7 @@ keyset( "nuvoton-ot00-app-slhdsa-prod-1.pub.pem": "nuvoton-ot00-app-slhdsa-prod-1:domain=PreHashedSha256", "nuvoton-ot00-app-slhdsa-dev-0.pub.pem": "nuvoton-ot00-app-slhdsa-dev-0:domain=PreHashedSha256", }, + keytype = "spx", profile = "nuvoton-ot00-app", tool = "@lowrisc_opentitan//signing:token", ) diff --git a/skus/open/keys/root/BUILD b/skus/open/keys/root/BUILD index 31d3904..17a176e 100644 --- a/skus/open/keys/root/BUILD +++ b/skus/open/keys/root/BUILD @@ -22,6 +22,7 @@ keyset( "ot00-earlgrey-a2-root-ecdsa-prod-2.pub.der": "ot00-earlgrey-a2-root-ecdsa-prod-2", "ot00-earlgrey-a2-root-ecdsa-dev-0.pub.der": "ot00-earlgrey-a2-root-ecdsa-dev-0", }, + keytype = "ecdsa", profile = "earlgrey-a2-open-root", tool = "@lowrisc_opentitan//signing:token", ) @@ -35,6 +36,7 @@ keyset( "ot00-earlgrey-a2-root-slhdsa-prod-2.pub.pem": "ot00-earlgrey-a2-root-slhdsa-prod-2:domain=PreHashedSha256", "ot00-earlgrey-a2-root-slhdsa-dev-0.pub.pem": "ot00-earlgrey-a2-root-slhdsa-dev-0:domain=PreHashedSha256", }, + keytype = "spx", profile = "earlgrey-a2-open-root", tool = "@lowrisc_opentitan//signing:token", ) From 3bbf93acbce654bd6763c6ca2d42290a92d8a651 Mon Sep 17 00:00:00 2001 From: Alex Jones Date: Fri, 25 Sep 2026 16:59:20 +0100 Subject: [PATCH 2/2] [perso] Update personalization flow to support flash scrambling Upstream OpenTitan earlgrey_1.0.0 has split the personalization binary into two parts: flash scrambling and personalization. Update the SKU configurations to match these changes, so that we can continue building valid releases. Signed-off-by: Alex Jones --- skus/cfg.bzl | 2 ++ skus/open/binaries/perso/BUILD | 18 ++++++++++++++++++ skus/open/orchestrator/BUILD | 6 ++++++ skus/open/perso/BUILD | 5 ++++- 4 files changed, 30 insertions(+), 1 deletion(-) diff --git a/skus/cfg.bzl b/skus/cfg.bzl index 82bd4de..cfa8516 100644 --- a/skus/cfg.bzl +++ b/skus/cfg.bzl @@ -45,6 +45,7 @@ EXT_EARLGREY_SKUS = { "ecdsa_key": {"@provisioning_exts//open/keys/root:keyset": "ot00-earlgrey-a2-root-ecdsa-prod-0"}, "spx_key": {"@provisioning_exts//open/keys/root:spxset": "ot00-earlgrey-a2-root-slhdsa-prod-0"}, "signature_prefix": "@provisioning_exts//open/signatures/perso", + "scrambling_bin": "@provisioning_exts//open/binaries/perso:ft_flash_scramble_ot00", "perso_bin": "@provisioning_exts//open/binaries/perso:ft_personalize_ot00", "orchestrator_cfg": "@provisioning_exts//open/orchestrator:ot00_staging", "offline": False, @@ -61,6 +62,7 @@ EXT_EARLGREY_SKUS = { "ecdsa_key": {"@provisioning_exts//open/keys/root:keyset": "ot00-earlgrey-a2-root-ecdsa-prod-0"}, "spx_key": {"@provisioning_exts//open/keys/root:spxset": "ot00-earlgrey-a2-root-slhdsa-prod-0"}, "signature_prefix": "@provisioning_exts//open/signatures/perso", + "scrambling_bin": "@provisioning_exts//open/binaries/perso:ft_flash_scramble_ot00", "perso_bin": "@provisioning_exts//open/binaries/perso:ft_personalize_ot00", "orchestrator_cfg": "@provisioning_exts//open/orchestrator:ot00", "offline": True, diff --git a/skus/open/binaries/perso/BUILD b/skus/open/binaries/perso/BUILD index 2864f12..4209086 100644 --- a/skus/open/binaries/perso/BUILD +++ b/skus/open/binaries/perso/BUILD @@ -17,6 +17,7 @@ copy_files( filter = [ # TODO: filter relevant build targets from above label "ft_personalize_ot00", + "ft_flash_scramble_ot00", ], relative_to = ":BUILD", tags = ["manual"], @@ -49,3 +50,20 @@ exec_env_filegroup( "@provisioning_exts_extra//perso_release:ft_personalize_ot00_silicon_creator.signed.bin": "silicon", }, ) + +exec_env_filegroup( + name = "ft_flash_scramble_ot00", + testonly = True, + exec_env = { + "@lowrisc_opentitan//hw/top_earlgrey:fpga_hyper310_rom_with_fake_keys": "cw310", + "@lowrisc_opentitan//hw/top_earlgrey:fpga_cw340_rom_with_fake_keys": "cw340", + "@lowrisc_opentitan//hw/top_earlgrey:silicon_creator": "silicon", + }, + # The "fake_keys" filenames are an unfortunate consequence of a historical + # choice of naming convention. They are, in fact, signed by offline HSM keys. + files = { + "@provisioning_exts_extra//perso_release:ft_flash_scramble_ot00_fpga_cw340_rom_with_fake_keys.signed.bin": "cw340", + "@provisioning_exts_extra//perso_release:ft_flash_scramble_ot00_fpga_hyper310_rom_with_fake_keys.signed.bin": "cw310", + "@provisioning_exts_extra//perso_release:ft_flash_scramble_ot00_silicon_creator.signed.bin": "silicon", + }, +) diff --git a/skus/open/orchestrator/BUILD b/skus/open/orchestrator/BUILD index c568e0d..cf361e4 100644 --- a/skus/open/orchestrator/BUILD +++ b/skus/open/orchestrator/BUILD @@ -25,6 +25,8 @@ sku_cfg( perso_bin_suffix = "ft_personalize_{sku}_{target}.prod_key_0.prod_key_0.signed.bin", perso_bins = ["@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_personalize_emulation_open"], product = "earlgrey_a2", + scrambling_bin_suffix = "ft_flash_scramble_{sku}_{target}.prod_key_0.prod_key_0.signed.bin", + scrambling_bins = ["@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_flash_scramble_emulation_open"], si_creator = "nuvoton", sku_name = "emulation_open", target_lc_state = "prod", @@ -41,6 +43,8 @@ sku_cfg( perso_bin_suffix = "ft_personalize_{sku}_{target}.signed.bin", perso_bins = ["//open/binaries/perso:ft_personalize_ot00"], product = "earlgrey_a2", + scrambling_bin_suffix = "ft_flash_scramble_{sku}_{target}.signed.bin", + scrambling_bins = ["//open/binaries/perso:ft_flash_scramble_ot00"], si_creator = "nuvoton", sku_name = "ot00", target_lc_state = "prod", @@ -58,6 +62,8 @@ sku_cfg( perso_bin_suffix = "ft_personalize_{sku}_{target}.signed.bin", perso_bins = ["//open/binaries/perso:ft_personalize_ot00"], product = "earlgrey_a2", + scrambling_bin_suffix = "ft_flash_scramble_{sku}_{target}.signed.bin", + scrambling_bins = ["//open/binaries/perso:ft_flash_scramble_ot00"], si_creator = "nuvoton", sku_name = "ot00", target_lc_state = "prod", diff --git a/skus/open/perso/BUILD b/skus/open/perso/BUILD index 4e1df4b..743f9d5 100644 --- a/skus/open/perso/BUILD +++ b/skus/open/perso/BUILD @@ -18,7 +18,10 @@ SKU = "ot00" offline_presigning_artifacts( name = "provisioning_{}".format(SKU), testonly = True, - srcs = ["@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_personalize_{}".format(SKU)], + srcs = [ + "@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_personalize_{}".format(SKU), + "@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_flash_scramble_{}".format(SKU), + ], ecdsa_key = EXT_EARLGREY_SKUS[SKU]["ecdsa_key"], manifest = "@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:manifest_perso", spx_key = EXT_EARLGREY_SKUS[SKU]["spx_key"],