diff options
| author | Sandrine Bailleux <sandrine.bailleux@arm.com> | 2020-02-06 14:59:14 +0100 |
|---|---|---|
| committer | Sandrine Bailleux <sandrine.bailleux@arm.com> | 2020-02-24 11:01:39 +0100 |
| commit | 5ab8b7170e2ba6649cc856778a517c0c686c653a (patch) | |
| tree | 0f4d5afbb9af0e28e822e569332a22036ef9cb51 /include | |
| parent | 2f39c55c085ae92b6eead06172096410e5aab81c (diff) | |
| download | platform_external_arm-trusted-firmware-5ab8b7170e2ba6649cc856778a517c0c686c653a.tar.gz platform_external_arm-trusted-firmware-5ab8b7170e2ba6649cc856778a517c0c686c653a.tar.bz2 platform_external_arm-trusted-firmware-5ab8b7170e2ba6649cc856778a517c0c686c653a.zip | |
Introduce a new "dualroot" chain of trust
This new chain of trust defines 2 independent signing domains:
1) One for the silicon firmware (BL1, BL2, BL31) and optionally the
Trusted OS. It is rooted in the Silicon ROTPK, just as in the TBBR
CoT.
2) One for the Normal World Bootloader (BL33). It is rooted in a new key
called Platform ROTPK, or PROTPK for short.
In terms of certificates chain,
- Signing domain 1) is similar to what TBBR advocates (see page 21 of
the TBBR specification), except that the Non-Trusted World Public Key
has been removed from the Trusted Key Certificate.
- Signing domain 2) only contains the Non-Trusted World Content
certificate, which provides the hash of the Non-Trusted World
Bootloader. Compared to the TBBR CoT, there's no Non-Trusted World
Key certificate for simplicity.
Change-Id: I62f1e952522d84470acc360cf5ee63e4c4b0b4d9
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/tools_share/dualroot_oid.h | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/include/tools_share/dualroot_oid.h b/include/tools_share/dualroot_oid.h new file mode 100644 index 000000000..3e88a6d22 --- /dev/null +++ b/include/tools_share/dualroot_oid.h @@ -0,0 +1,19 @@ +/* + * Copyright (c) 2020, Arm Limited. All rights reserved. + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#ifndef DUALROOT_OID_H +#define DUALROOT_OID_H + +/* Reuse the Object IDs defined by TBBR for certificate extensions. */ +#include "tbbr_oid.h" + +/* + * Platform root-of-trust public key. + * Arbitrary value that does not conflict with any of the TBBR reserved OIDs. + */ +#define PROT_PK_OID "1.3.6.1.4.1.4128.2100.1102" + +#endif /* DUALROOT_OID_H */ |