Add identity key support for PSA attestation #8188
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
frkv
requested review from
SebastianBoe,
a team,
anangl,
rlubos,
carlescufi and
tejlmand
as code owners
github-actions
bot
added
changelog-entry-required
Integration test specification
Detailed information of selected test modules Note: This message is automatically posted and updated by the CI |
Vge0rge
force-pushed
the
tf-m-attestation
branch
from
1d0be32 to
2caaa69
Compare
joerchan
reviewed
Jul 21, 2022
Vge0rge
force-pushed
the
tf-m-attestation
branch
from
2caaa69 to
3e34de3
Compare
Vge0rge
changed the title
Vge0rge
force-pushed
the
tf-m-attestation
branch
11 times, most recently
from
10a3b25 to
c3ba52e
Compare
Vge0rge
force-pushed
the
tf-m-attestation
branch
3 times, most recently
from
0bf379c to
77f70c9
Compare
SebastianBoe
approved these changes
Sep 1, 2022
Vge0rge
force-pushed
the
tf-m-attestation
branch
6 times, most recently
from
b5f78a1 to
a305189
Compare
mia-ko
requested changes
Sep 2, 2022
Vge0rge
force-pushed
the
tf-m-attestation
branch
2 times, most recently
from
3a0f3b6 to
0f47289
Compare
mia-ko
approved these changes
Sep 2, 2022
Vge0rge
force-pushed
the
tf-m-attestation
branch
from
0f47289 to
aa51d95
Compare
-Adds library for storing and retrieving an identity key -This uses the hw_unique_key library to ensure that HUK keys are generated or written to the device. ref: NCSDK-14121 Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no> Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
-Sample showcasing writing an identity key to the reserved KMU slot. The key will be encrypted using the MKEK key. ref: NCSDK-14121 Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no> Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
-This uses reads the identity key in the reserved slot in KMU, decrypts it and loads it into PSA Crypto key storage. Afterwards the key is used to sign a message. ref: NCSDK-14121 Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no> Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
-Add usage of nrf_cc3xx_platform_identity_key_retrieve function to allow decrypting the key from its reserved KMU slot. -This usage expects the Attestation Key to be placed in this location prior to usage ref: NCSDK-12235 Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no> Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
The identity key generation sample by default creates a random key. The TFM regression tests rely on a specific key. Add an extra sample configuration which generates this specific key, such that it is possible to run this before the regression tests. ref: NCSDK-14121 Signed-off-by: Torstein Grindvik <torstein.grindvik@nordicsemi.no> Signed-off-by: Frank Audun Kvamtrø <frank.kvamtro@nordicsemi.no>
Vge0rge
force-pushed
the
tf-m-attestation
branch
from
aa51d95 to
4ed230f
Compare
14 tasks
|
As per offline discussion, I was told this PR was agreed to be merged post RC1. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
-Adds library for identity key services making use of nrf_cc3xx_platform APIs
that encrypts/decrypts an asymmetric key using MKEK.
-Adds support for key retrieval in TF-M images
ref: NCSDK-14121
ref: NCSDK-12235
Signed-off-by: Frank Audun Kvamtrø frank.kvamtro@nordicsemi.no
test-sdk-nrf: sdk-nrf-PR-8188