nrf_security: Add key revocation for SICR keys #19710
Open
+88
−30
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
the
changelog-entry-required
CI InformationTo view the history of this post, clich the 'edited' button above Inputs:Sources:sdk-nrf: PR head: dcd079a863c4adce3246d3ec5f822c634f0bc412 more detailssdk-nrf:
Github labels
List of changed files detected by CI (3)Outputs:ToolchainVersion: 11349092be Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped;
|
Vge0rge
force-pushed
the
platform_key_revocation
branch
from
4fdb848 to
caca435
Compare
tomi-font
reviewed
Jan 2, 2025
|
|
||
| nrf_mramc_config_set(mramc, &mramc_config_write_enabled); | ||
|
|
||
| memcpy(key.sicr.attr_addr, &sicr_attr, sizeof(sicr_attr)); |
There was a problem hiding this comment.
Ahem key is a pointer but you use it as if it were not?
There was a problem hiding this comment.
That's a good catch, thanks! I will update.
There was a problem hiding this comment.
Updated and opened a PR in secdom to run it's CI: 1051
There was a problem hiding this comment.
I see CI failures, I think you need to make CI green first before I review?
There was a problem hiding this comment.
I don't think that you need to wait no, the CI failures seem to build some nrfx clock build failures. These should not be relevant to this PR at all.
Vge0rge
force-pushed
the
platform_key_revocation
branch
from
caca435 to
4ed1318
Compare
This refactors how SICR keys are writen into MRAM. This refactors the code but it should not change any funcionality. The purpose of this is to make the MRAM writing part reusable so it can be used by the revocation functionality later. Signed-off-by: Georgios Vasilakis <[email protected]>
Vge0rge
force-pushed
the
platform_key_revocation
branch
from
4ed1318 to
8008df6
Compare
Vge0rge
force-pushed
the
platform_key_revocation
branch
from
8008df6 to
14c4ee8
Compare
Adds support of key revocation using the psa_destroy_key API. The value 0xfa50 is used in the key type in order to mark an revoked key. The return code PSA_ERROR_NOT_PERMITTED is returned for revoked keys for all the functions in the PSA crypto driver wrapper. This error code seems OK since it mentions platform specific policies for not permitted an operation. Ref: NCSDK-30076 Signed-off-by: Georgios Vasilakis <[email protected]>
Vge0rge
force-pushed
the
platform_key_revocation
branch
from
14c4ee8 to
dcd079a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds key revocation for the platform keys stored in SICR for nRF54H20.