earlgrey signing: add "dummy" keyset Add a "dummy" keyset and owner configuration for testing ownership transfer sequences. Signed-off-by: Chris Frantz <cfrantz@google.com>
diff --git a/target/earlgrey/signing/keys/dummy/BUILD.bazel b/target/earlgrey/signing/keys/dummy/BUILD.bazel new file mode 100644 index 0000000..393e069 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/BUILD.bazel
@@ -0,0 +1,78 @@ +# Licensed under the Apache-2.0 license +# SPDX-License-Identifier: Apache-2.0 + +load("//target/earlgrey/tooling/signing:defs.bzl", "keyset", "owner_block_binary", "ownership_detached_signature") + +package(default_visibility = ["//visibility:public"]) + +filegroup( + name = "all_keys", + srcs = glob([ + "*.der", + "*.pem", + ]), +) + +filegroup( + name = "owner_key", + srcs = ["owner_ecdsa_p256.der"], +) + +filegroup( + name = "owner_key_pub", + srcs = ["owner_ecdsa_p256.pub.der"], +) + +filegroup( + name = "activate_key", + srcs = ["activate_ecdsa_p256.der"], +) + +filegroup( + name = "activate_key_pub", + srcs = ["activate_ecdsa_p256.pub.der"], +) + +filegroup( + name = "unlock_key", + srcs = ["unlock_ecdsa_p256.der"], +) + +filegroup( + name = "unlock_key_pub", + srcs = ["unlock_ecdsa_p256.pub.der"], +) + +filegroup( + name = "all_zero_sig", + srcs = ["all_zero_sig.bin"], +) + +keyset( + name = "ecdsa_keyset", + build_setting_default = "", + keys = { + "activate_ecdsa_p256.der": "activate_0", + "app_prod_ecdsa_p256.der": "app_prod_0", + "owner_ecdsa_p256.der": "owner_0", + "unlock_ecdsa_p256.der": "unlock_0", + }, + profile = "local", + tool = "//target/earlgrey/signing/tokens:local", +) + +owner_block_binary( + name = "dummy_owner_bin", + src = "dummy_owner.json5", + keys = [ + ":all_keys", + ], +) + +ownership_detached_signature( + name = "dummy_owner_sig", + src = ":dummy_owner_bin", + command = "Owner", + ecdsa_key = ":owner_key", + key_alg = "EcdsaP256", +)
diff --git a/target/earlgrey/signing/keys/dummy/activate_ecdsa_p256.der b/target/earlgrey/signing/keys/dummy/activate_ecdsa_p256.der new file mode 100644 index 0000000..c0b4b4b --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/activate_ecdsa_p256.der Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/activate_ecdsa_p256.pub.der b/target/earlgrey/signing/keys/dummy/activate_ecdsa_p256.pub.der new file mode 100644 index 0000000..02b30b3 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/activate_ecdsa_p256.pub.der Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/activate_spx.pem b/target/earlgrey/signing/keys/dummy/activate_spx.pem new file mode 100644 index 0000000..dd86348 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/activate_spx.pem
@@ -0,0 +1,4 @@ +-----BEGIN RAW:SLH_DSA_SHA2_128s PRIVATE KEY----- +weaRPM+SIe+JswtZ2y/t5+THAooeDS5J4qgN4OJcnDPHUev9S9mRA1cPvxhrAHlM +XuRlgAOOYVCeSIk2f5wlKA== +-----END RAW:SLH_DSA_SHA2_128s PRIVATE KEY-----
diff --git a/target/earlgrey/signing/keys/dummy/activate_spx.pub.pem b/target/earlgrey/signing/keys/dummy/activate_spx.pub.pem new file mode 100644 index 0000000..c261822 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/activate_spx.pub.pem
@@ -0,0 +1,3 @@ +-----BEGIN RAW:SLH_DSA_SHA2_128s PUBLIC KEY----- +x1Hr/UvZkQNXD78YawB5TF7kZYADjmFQnkiJNn+cJSg= +-----END RAW:SLH_DSA_SHA2_128s PUBLIC KEY-----
diff --git a/target/earlgrey/signing/keys/dummy/all_zero_sig.bin b/target/earlgrey/signing/keys/dummy/all_zero_sig.bin new file mode 100644 index 0000000..9017fd9 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/all_zero_sig.bin Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/app_prod_ecdsa_p256.der b/target/earlgrey/signing/keys/dummy/app_prod_ecdsa_p256.der new file mode 100644 index 0000000..1885983 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/app_prod_ecdsa_p256.der Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/app_prod_ecdsa_p256.pub.der b/target/earlgrey/signing/keys/dummy/app_prod_ecdsa_p256.pub.der new file mode 100644 index 0000000..419aa55 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/app_prod_ecdsa_p256.pub.der Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/dummy_owner.json5 b/target/earlgrey/signing/keys/dummy/dummy_owner.json5 new file mode 100644 index 0000000..c06b387 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/dummy_owner.json5
@@ -0,0 +1,132 @@ +// Licensed under the Apache-2.0 license +// SPDX-License-Identifier: Apache-2.0 +{ + config_version: 1, + update_mode: "SelfVersion", + sram_exec: "DisabledLocked", + min_security_version_bl0: "NoChange", + + ownership_key_alg: "EcdsaP256", + owner_key: { + Ecdsa: "target/earlgrey/signing/keys/dummy/owner_ecdsa_p256.pub.der" + }, + activate_key: { + Ecdsa: "target/earlgrey/signing/keys/dummy/activate_ecdsa_p256.pub.der" + }, + unlock_key: { + Ecdsa: "target/earlgrey/signing/keys/dummy/unlock_ecdsa_p256.pub.der" + }, + data: [ + { + ApplicationKey: { + key_alg: "EcdsaP256", + key_domain: "Prod", + usage_constraint: 0, + key: { + Ecdsa: "target/earlgrey/signing/keys/dummy/app_prod_ecdsa_p256.pub.der" + } + } + }, + { + "FlashConfig": { + "config": [ + { + // Slot A App Firmware region: 64 to 476 KiB. + "start": 32, + "size": 206, + // Permissions: read, erase and program. + "read": true, + "program": true, + "erase": true, + // Region properties. + "protect_when_active": true, + "lock": true + }, + { + // Slot B App Firmware region + "start": 288, + "size": 206, + // Permissions: read, erase and program. + "read": true, + "program": true, + "erase": true, + // Region properties. + "protect_when_active": true, + "lock": true + }, + { + // Slot A App storage region: 476 to 512 KiB. + "start": 238, + "size": 18, + // Permissions: read, erase and program. + "read": true, + "program": true, + "erase": true, + // Region properties. Must disable scramble so we have following + // write patterh: 0xFF -> 0x?? -> 0x00 + "protect_when_active": false, + "lock": false + }, + { + // Slot B App storage region (excludes Identity seed region) + "start": 494, + "size": 18, + // Permissions: read, erase and program. + "read": true, + "program": true, + "erase": true, + // Region properties. Must disable scramble so we have following + // write patterh: 0xFF -> 0x?? -> 0x00 + "protect_when_active": false, + "lock": false + } + ] + }, + }, + { + // The Rescue Config determines whether the ROM_EXT rescue protocol + // is enabled and what rescue and boot service commands are permitted. + "RescueConfig": { + "protocol": "UsbDfu", + "trigger": "Strapping", + "trigger_index": 0x33, + "enter_on_failure": true, + "timeout": 30, + + // The rescue region in Flash pages. The rescue protocol will never + // touch flash pages outside of this region. + "start": 32, + "size": 206, + // List of rescue and boot service commands permitted by the rescue + // protocol. There is no preferred ordering of this list. Rescue + // commands and boot service commands have distinct identifiers. + "command_allow": [ + // Rescue commands: + "Rescue", // Rescue firmware upload. + "GetBootLog", // Boot log download. + "BootSvcReq", // Boot service request upload. + "BootSvcRsp", // Boot service response download. + "OwnerBlock", // Owner Block (config) upload. + "GetDeviceId", // Get the OpenTitan device ID. + "RescueB", // Rescue SlotB of the flash. + "GetOwnerPage0", // Get the content of owner page 0. + "GetOwnerPage1", // Get the content of owner page 1. + + // The following commands are always allowed regardless of the + // allow-list: + // "Baud", // Change the rescue baud rate. + // "Reboot", // Reboot. + // "Wait", // Don't automatically reboot after data upload. + + // Boot service commands allowed. These commands can only be sent + // if the rescue command "BootSvcReq" is allowed. + "Empty", + "MinBl0SecVerRequest", + "NextBl0SlotRequest", + "OwnershipUnlockRequest", + "OwnershipActivateRequest" + ] + } + } + ] +}
diff --git a/target/earlgrey/signing/keys/dummy/owner_ecdsa_p256.der b/target/earlgrey/signing/keys/dummy/owner_ecdsa_p256.der new file mode 100644 index 0000000..8134d77 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/owner_ecdsa_p256.der Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/owner_ecdsa_p256.pub.der b/target/earlgrey/signing/keys/dummy/owner_ecdsa_p256.pub.der new file mode 100644 index 0000000..a199a16 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/owner_ecdsa_p256.pub.der Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/owner_spx.pem b/target/earlgrey/signing/keys/dummy/owner_spx.pem new file mode 100644 index 0000000..3c34434 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/owner_spx.pem
@@ -0,0 +1,4 @@ +-----BEGIN RAW:SLH_DSA_SHA2_128s PRIVATE KEY----- +if5c1hs0bcw6NaKtz7t0ygsWaJ8CHbQSWh3jo/B+0Ai6j2diLvyF3AmJ95FSpBFV +MhIiYZO+N87nzGWtprZnzw== +-----END RAW:SLH_DSA_SHA2_128s PRIVATE KEY-----
diff --git a/target/earlgrey/signing/keys/dummy/owner_spx.pub.pem b/target/earlgrey/signing/keys/dummy/owner_spx.pub.pem new file mode 100644 index 0000000..1e29bb3 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/owner_spx.pub.pem
@@ -0,0 +1,3 @@ +-----BEGIN RAW:SLH_DSA_SHA2_128s PUBLIC KEY----- +uo9nYi78hdwJifeRUqQRVTISImGTvjfO58xlraa2Z88= +-----END RAW:SLH_DSA_SHA2_128s PUBLIC KEY-----
diff --git a/target/earlgrey/signing/keys/dummy/unlock_ecdsa_p256.der b/target/earlgrey/signing/keys/dummy/unlock_ecdsa_p256.der new file mode 100644 index 0000000..a52254c --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/unlock_ecdsa_p256.der Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/unlock_ecdsa_p256.pub.der b/target/earlgrey/signing/keys/dummy/unlock_ecdsa_p256.pub.der new file mode 100644 index 0000000..ad32bd0 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/unlock_ecdsa_p256.pub.der Binary files differ
diff --git a/target/earlgrey/signing/keys/dummy/unlock_spx.pem b/target/earlgrey/signing/keys/dummy/unlock_spx.pem new file mode 100644 index 0000000..63cd3f0 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/unlock_spx.pem
@@ -0,0 +1,4 @@ +-----BEGIN RAW:SLH_DSA_SHA2_128s PRIVATE KEY----- +zOhDLHS1z43aMzqC6tlhqyh7/8Y1+ixA/SIt0xasufChY6H+6lVBLSfqVHXLOSKa +dQpRRIF+ZoHXTHcLDCy1EQ== +-----END RAW:SLH_DSA_SHA2_128s PRIVATE KEY-----
diff --git a/target/earlgrey/signing/keys/dummy/unlock_spx.pub.pem b/target/earlgrey/signing/keys/dummy/unlock_spx.pub.pem new file mode 100644 index 0000000..fc5d282 --- /dev/null +++ b/target/earlgrey/signing/keys/dummy/unlock_spx.pub.pem
@@ -0,0 +1,3 @@ +-----BEGIN RAW:SLH_DSA_SHA2_128s PUBLIC KEY----- +oWOh/upVQS0n6lR1yzkimnUKUUSBfmaB10x3CwwstRE= +-----END RAW:SLH_DSA_SHA2_128s PUBLIC KEY-----