New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Inconsistent key material used to encrypt DCCM and CMIDs. #1758

Open

bluegate010 opened this issue Oct 30, 2024 · 0 comments

Assignees

Contributor

bluegate010 commented Oct 30, 2024

https://github.com/chipsalliance/caliptra-sw/blob/main-2.x/runtime/README.md describes DCCM encryption and CMID encryption.

DCCM storage:

This storage is protected with authenticated encryption using internal keys that are randomly generated at power on and stored in the key vault.

CMIDs:

The key for the data referenced by a CMID is unique and derived via HKDF from the CDI_RT

The key used to encrypt a CMID should not be more durable than the key used to encrypt DCCM which holds the key referenced by that CMID.

bluegate010 assigned swenson

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment