Fix and enhance Android Profile for DICE documentation
- Fix table formatting
- Fix link to the hwtrust tool
- Describe version backwards compatibility
- Clarify profile name declataions
Change-Id: I65e662a3f107e2ed0386be031e9b85a740bc2f5d
Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/170555
Reviewed-by: Max Bires <jbires@google.com>
Commit-Queue: Auto-Submit <auto-submit@pigweed-service-accounts.iam.gserviceaccount.com>
Reviewed-by: Darren Krahn <dkrahn@google.com>
Pigweed-Auto-Submit: Andrew Scull <ascull@google.com>
diff --git a/docs/android.md b/docs/android.md
index f41e6b1..9dcfa00 100644
--- a/docs/android.md
+++ b/docs/android.md
@@ -76,7 +76,6 @@
Unless explicitly stated as required in the [versions](#versions) section, each
field is optional. If no fields are relevant, an empty map should be encoded.
-```
| Name | Key | Value type | Meaning |
| ----------------- | ------ | ---------- | -----------------------------------|
| Component name | -70002 | tstr | Name of the component |
@@ -88,7 +87,6 @@
: : : : where a greater value indicates a :
: : : : newer version, for example, the :
: : : : anti-rollback counter :
-```
### Versions
@@ -99,15 +97,16 @@
Versions of this profile are identified by their profile name which is composed
of the prefix `"android."` followed by the Android version number it aligns
-with. If no profile name is included in the certificate, `"android.14"` is
-assumed.
+with. Certificates declare which profile they are following in the `profileName`
+field defined by the [Open Profile for DICE](specification.md). If no profile
+name is included in the certificate, `"android.14"` is assumed.
Within a DICE chain, the version of the profile used in each certificate must
be the same or greater than the version used in the previous certificate. This
ensures the all certificates are aware of, and can maintain, any chain
invariants that can be added in any version of the profile.
-Android provides the [`hwtrust`](hwtrust-tool) tool which can validate that
+Android provides the [`hwtrust`][hwtrust-tool] tool which can validate that
certificate chains conform to this profile and can assist in diagnosing
problems.
@@ -132,7 +131,8 @@
#### `"android.15"`
-The profile named `"android.15"` aligns with Android 15.
+The profile named `"android.15"` aligns with Android 15. It is backwards
+compatible with the previous versions of the Andorid Profile for DICE.
* Based on the [Open Profile for DICE v2.5][open-dice-v2.5].
* The `configurationHash` field is permitted to be missing rather than being
@@ -141,7 +141,8 @@
#### `"android.16"`
The profile named `"android.16"` aligns with Android 16 and is still subject to
-change.
+change. It is backwards compatible with the previous versions of the Android
+Profile for DICE.
* Based on the [Open Profile for DICE v2.5][open-dice-v2.5].
* The security version field of the [configuration
