Skip to content

[skus,signing] Fixes for compatibility with personalization & signing changes in upstream OpenTitan #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexJones0 merged 2 commits into from
Oct 20, 2026
Merged

[skus,signing] Fixes for compatibility with personalization & signing changes in upstream OpenTitan #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1ea6609
[signing] Update keysets to label default key type
AlexJones0 Sep 23, 2026
3bbf93a
[perso] Update personalization flow to support flash scrambling
AlexJones0 Sep 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions skus/cfg.bzl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ EXT_EARLGREY_SKUS = {
"ecdsa_key": {"@provisioning_exts//open/keys/root:keyset": "ot00-earlgrey-a2-root-ecdsa-prod-0"},
"spx_key": {"@provisioning_exts//open/keys/root:spxset": "ot00-earlgrey-a2-root-slhdsa-prod-0"},
"signature_prefix": "@provisioning_exts//open/signatures/perso",
"scrambling_bin": "@provisioning_exts//open/binaries/perso:ft_flash_scramble_ot00",
"perso_bin": "@provisioning_exts//open/binaries/perso:ft_personalize_ot00",
"orchestrator_cfg": "@provisioning_exts//open/orchestrator:ot00_staging",
"offline": False,
Expand All @@ -61,6 +62,7 @@ EXT_EARLGREY_SKUS = {
"ecdsa_key": {"@provisioning_exts//open/keys/root:keyset": "ot00-earlgrey-a2-root-ecdsa-prod-0"},
"spx_key": {"@provisioning_exts//open/keys/root:spxset": "ot00-earlgrey-a2-root-slhdsa-prod-0"},
"signature_prefix": "@provisioning_exts//open/signatures/perso",
"scrambling_bin": "@provisioning_exts//open/binaries/perso:ft_flash_scramble_ot00",
"perso_bin": "@provisioning_exts//open/binaries/perso:ft_personalize_ot00",
"orchestrator_cfg": "@provisioning_exts//open/orchestrator:ot00",
"offline": True,
Expand Down
18 changes: 18 additions & 0 deletions skus/open/binaries/perso/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ copy_files(
filter = [
# TODO: filter relevant build targets from above label
"ft_personalize_ot00",
"ft_flash_scramble_ot00",
],
relative_to = ":BUILD",
tags = ["manual"],
Expand Down Expand Up @@ -49,3 +50,20 @@ exec_env_filegroup(
"@provisioning_exts_extra//perso_release:ft_personalize_ot00_silicon_creator.signed.bin": "silicon",
},
)

exec_env_filegroup(
name = "ft_flash_scramble_ot00",
testonly = True,
exec_env = {
"@lowrisc_opentitan//hw/top_earlgrey:fpga_hyper310_rom_with_fake_keys": "cw310",
"@lowrisc_opentitan//hw/top_earlgrey:fpga_cw340_rom_with_fake_keys": "cw340",
"@lowrisc_opentitan//hw/top_earlgrey:silicon_creator": "silicon",
},
# The "fake_keys" filenames are an unfortunate consequence of a historical
# choice of naming convention. They are, in fact, signed by offline HSM keys.
files = {
"@provisioning_exts_extra//perso_release:ft_flash_scramble_ot00_fpga_cw340_rom_with_fake_keys.signed.bin": "cw340",
"@provisioning_exts_extra//perso_release:ft_flash_scramble_ot00_fpga_hyper310_rom_with_fake_keys.signed.bin": "cw310",
"@provisioning_exts_extra//perso_release:ft_flash_scramble_ot00_silicon_creator.signed.bin": "silicon",
},
)
1 change: 1 addition & 0 deletions skus/open/keys/ca/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ keyset(
keys = {
"nuvoton-ot00-ca-ecdsa-0.pub.der": "nuvoton-ot00-ca-ecdsa-0",
},
keytype = "ecdsa",
profile = "nuvoton-ot00-ca",
tool = "@lowrisc_opentitan//signing:token",
)
2 changes: 2 additions & 0 deletions skus/open/keys/owner/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ keyset(
"nuvoton-ot00-app-ecdsa-prod-1.pub.der": "nuvoton-ot00-app-ecdsa-prod-1",
"nuvoton-ot00-app-ecdsa-dev-0.pub.der": "nuvoton-ot00-app-ecdsa-dev-0",
},
keytype = "ecdsa",
profile = "nuvoton-ot00-app",
tool = "@lowrisc_opentitan//signing:token",
)
Expand All @@ -34,6 +35,7 @@ keyset(
"nuvoton-ot00-app-slhdsa-prod-1.pub.pem": "nuvoton-ot00-app-slhdsa-prod-1:domain=PreHashedSha256",
"nuvoton-ot00-app-slhdsa-dev-0.pub.pem": "nuvoton-ot00-app-slhdsa-dev-0:domain=PreHashedSha256",
},
keytype = "spx",
profile = "nuvoton-ot00-app",
tool = "@lowrisc_opentitan//signing:token",
)
2 changes: 2 additions & 0 deletions skus/open/keys/root/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ keyset(
"ot00-earlgrey-a2-root-ecdsa-prod-2.pub.der": "ot00-earlgrey-a2-root-ecdsa-prod-2",
"ot00-earlgrey-a2-root-ecdsa-dev-0.pub.der": "ot00-earlgrey-a2-root-ecdsa-dev-0",
},
keytype = "ecdsa",
profile = "earlgrey-a2-open-root",
tool = "@lowrisc_opentitan//signing:token",
)
Expand All @@ -35,6 +36,7 @@ keyset(
"ot00-earlgrey-a2-root-slhdsa-prod-2.pub.pem": "ot00-earlgrey-a2-root-slhdsa-prod-2:domain=PreHashedSha256",
"ot00-earlgrey-a2-root-slhdsa-dev-0.pub.pem": "ot00-earlgrey-a2-root-slhdsa-dev-0:domain=PreHashedSha256",
},
keytype = "spx",

@cfrantz cfrantz Oct 9, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

spx for now. slh-dsa after we redo keygen with hsmtool+slh-dsa support, correct?

@AlexJones0 AlexJones0 Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct, this is changed in #26.

profile = "earlgrey-a2-open-root",
tool = "@lowrisc_opentitan//signing:token",
)
Expand Down
6 changes: 6 additions & 0 deletions skus/open/orchestrator/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ sku_cfg(
perso_bin_suffix = "ft_personalize_{sku}_{target}.prod_key_0.prod_key_0.signed.bin",
perso_bins = ["@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_personalize_emulation_open"],
product = "earlgrey_a2",
scrambling_bin_suffix = "ft_flash_scramble_{sku}_{target}.prod_key_0.prod_key_0.signed.bin",
scrambling_bins = ["@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_flash_scramble_emulation_open"],
si_creator = "nuvoton",
sku_name = "emulation_open",
target_lc_state = "prod",
Expand All @@ -41,6 +43,8 @@ sku_cfg(
perso_bin_suffix = "ft_personalize_{sku}_{target}.signed.bin",
perso_bins = ["//open/binaries/perso:ft_personalize_ot00"],
product = "earlgrey_a2",
scrambling_bin_suffix = "ft_flash_scramble_{sku}_{target}.signed.bin",
scrambling_bins = ["//open/binaries/perso:ft_flash_scramble_ot00"],
si_creator = "nuvoton",
sku_name = "ot00",
target_lc_state = "prod",
Expand All @@ -58,6 +62,8 @@ sku_cfg(
perso_bin_suffix = "ft_personalize_{sku}_{target}.signed.bin",
perso_bins = ["//open/binaries/perso:ft_personalize_ot00"],
product = "earlgrey_a2",
scrambling_bin_suffix = "ft_flash_scramble_{sku}_{target}.signed.bin",
scrambling_bins = ["//open/binaries/perso:ft_flash_scramble_ot00"],
si_creator = "nuvoton",
sku_name = "ot00",
target_lc_state = "prod",
Expand Down
5 changes: 4 additions & 1 deletion skus/open/perso/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ SKU = "ot00"
offline_presigning_artifacts(
name = "provisioning_{}".format(SKU),
testonly = True,
srcs = ["@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_personalize_{}".format(SKU)],
srcs = [
"@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_personalize_{}".format(SKU),
"@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:ft_flash_scramble_{}".format(SKU),
],
ecdsa_key = EXT_EARLGREY_SKUS[SKU]["ecdsa_key"],
manifest = "@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:manifest_perso",
spx_key = EXT_EARLGREY_SKUS[SKU]["spx_key"],
Expand Down