Skip to content

Commit

Permalink
Populate draft
Browse files Browse the repository at this point in the history
  • Loading branch information
@SimonFrost-Arm
SimonFrost-Arm committed Jul 3, 2024
1 parent 80c50cc commit 3db8a15
Show file tree
Hide file tree
Showing 32 changed files with 1,548 additions and 48 deletions.
46 changes: 46 additions & 0 deletions CONTRIBUTING.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
# Contributing

This repository relates to activities in the Internet Engineering Task Force
([IETF](https://www.ietf.org/)). All material in this repository is considered
Contributions to the IETF Standards Process, as defined in the intellectual
property policies of IETF currently designated as
[BCP 78](https://www.rfc-editor.org/info/bcp78),
[BCP 79](https://www.rfc-editor.org/info/bcp79) and the
[IETF Trust Legal Provisions (TLP) Relating to IETF Documents](http://trustee.ietf.org/trust-legal-provisions.html).

Any edit, commit, pull request, issue, comment or other change made to this
repository constitutes Contributions to the IETF Standards Process
(https://www.ietf.org/).

You agree to comply with all applicable IETF policies and procedures, including,
BCP 78, 79, the TLP, and the TLP rules regarding code components (e.g. being
subject to a Simplified BSD License) in Contributions.


## Other Resources

Discussion of this work occurs on the
[rats working group mailing list](https://mailarchive.ietf.org/arch/browse/rats/)
([subscribe](https://www.ietf.org/mailman/listinfo/rats)). In addition to
contributions in GitHub, you are encouraged to participate in discussions there.

**Note**: Some working groups adopt a policy whereby substantive discussion of
technical issues needs to occur on the mailing list.

You might also like to familiarize yourself with other
[working group documents](https://datatracker.ietf.org/wg/rats/documents/).

## Working Group Information

Discussion of this work occurs on the [Remote ATtestation ProcedureS
Working Group mailing list](mailto:rats@ietf.org)
([archive](https://mailarchive.ietf.org/arch/browse/rats/),
[subscribe](https://www.ietf.org/mailman/listinfo/rats)).
In addition to contributions in GitHub, you are encouraged to participate in
discussions there.

**Note**: Some working groups adopt a policy whereby substantive discussion of
technical issues needs to occur on the mailing list.

You might also like to familiarize yourself with other
[Working Group documents](https://datatracker.ietf.org/wg/rats/documents/).
4 changes: 4 additions & 0 deletions LICENSE.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# License

See the
[guidelines for contributions](https://github.com/SimonFrost-Arm/draft-ffm-rats-cca-token/blob/master/CONTRIBUTING.md).
11 changes: 11 additions & 0 deletions Makefile
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
LIBDIR := lib
include $(LIBDIR)/main.mk

$(LIBDIR)/main.mk:
ifneq (,$(shell grep "path *= *$(LIBDIR)" .gitmodules 2>/dev/null))
git submodule sync
git submodule update $(CLONE_ARGS) --init
else
git clone -q --depth 10 $(CLONE_ARGS) \
-b main https://github.com/martinthomson/i-d-template $(LIBDIR)
endif
30 changes: 30 additions & 0 deletions art/cca-attester.ascii-art
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
.----------.
| Verifier |
'----------'
^
|
CCA Token |
|
.-------------------------------------------|---------.
| .-----------------------------------------|--------. |
| | Attesting Environment <------R----- | | |
| | | | | | |
| | .------------. .--+--. .----+-+------. | |
| | | Main | | HES | | Realm | | |
| | | Bootloader +--->| RoT |<----+ Management | | |
| | | | W | | R | Monitor | | |
| | '-----+------' '-----' '------+------' | |
| '----------|------------------------------|--------' |
| | | |
| .----------|------------------------------|--------. |
| | | | | |
| | .-----o-------. .-----o------. | |
| | | Realm World | | Realm | | |
| | | TCB | | State | | |
| | '-------------' '------------' | |
| | Target Environment | |
| '--------------------------------------------------' |
'------------------------------------------------------'
Legend:
---> read ---> write ---o measure
R W
13 changes: 13 additions & 0 deletions art/cca-boot.ascii-art
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
i-th Target Main Boot HES
Environment Loader RoT
| | |
.--------|-------------|-------------|----.
| loop i | | | |
| | measure | | |
| |o------------+ | |
| | | write | |
| | | measurement | |
| | +------------>| |
'--------|-------------|-------------|----'
| | |

38 changes: 38 additions & 0 deletions art/cca-lifecycle.ascii-art
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
.--------------------------.
| Device Assembly and Test |
'-------------+------------'
| Device
| Lockdown
v
.----------------------------.
| CCA Security Provisioning |
'-----------+----------------'
|
Provisioning | .-------------------.
Lockdown | | |
v v |
.----------------. |Recoverable
.--------------+ Secured +--------. |
| '-+--------------' | |
Non | ^ Recoverable |
Recoverable RM Debug | Root Debug |
Root Debug Enable | | |
| | | | |
| v | v |
| .------------+--. .-------+-.
| | Realm Manager | | Root |
| | Debug | | Debug |
| '---------------' '--+------'
| |
| .---------------. |
|----------->+ Terminate +<----------'
'---------------'
|
|
v
.----------------.
| Decommissioned |
'----------------'



37 changes: 37 additions & 0 deletions art/cca-runtime.ascii-art
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@

HES Realm
RoT Manager Verifier
| | |
----------|----------------|-----------|----
| | |
Platform | | |
Boot | | |
State | Req. Platform | |
| | Token (#RAK) | |
| |<---------------+ |
v | | |
Plat <-| | |
Token ->| | |
| | |
<---| | |
sign | | |
--->| Plat Token | |
|--------------->| |
| | |
| Realm | |
| State | |
| | | |
| | | |
| v | |
| Realm | |
| Token | |
| .---+ |
| sign | | |
| '-->| |
| | |
| | |
| | CCA Token |
| +---------->|
| | |


6 changes: 6 additions & 0 deletions cddl/platform/arm-platform-challenge.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
arm-platform-challenge-label = 10

arm-platform-challenge = (
arm-platform-challenge-label => arm-platform-hash-type
)

14 changes: 14 additions & 0 deletions cddl/platform/arm-platform-claims.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
arm-platform-claims = (arm-platform-claim-map)

arm-platform-claim-map = {
arm-platform-profile
arm-platform-challenge
arm-platform-implementation-id
arm-platform-instance-id
arm-platform-config
arm-platform-lifecycle
arm-platform-sw-components
? arm-platform-verification-service
arm-platform-hash-algo-id
}

8 changes: 8 additions & 0 deletions cddl/platform/arm-platform-config.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
arm-platform-config-label = 2401 ; PSA platform range
; TBD: add to IANA registration
arm-platform-config-type = bytes

arm-platform-config = (
arm-platform-config-label => arm-platform-config-type
)

7 changes: 7 additions & 0 deletions cddl/platform/arm-platform-hash-algo-id.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
arm-platform-hash-algo-id-label = 2402 ; PSA platform range
; TBD: add to IANA registration

arm-platform-hash-algo-id = (
arm-platform-hash-algo-id-label => text
)

2 changes: 2 additions & 0 deletions cddl/platform/arm-platform-hash-type.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
arm-platform-hash-type = bytes .size 32 / bytes .size 48 / bytes .size 64

7 changes: 7 additions & 0 deletions cddl/platform/arm-platform-implementation-id.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
arm-platform-implementation-id-label = 2396 ; PSA implementation ID
arm-platform-implementation-id-type = bytes .size 32

arm-platform-implementation-id = (
arm-platform-implementation-id-label => arm-platform-implementation-id-type
)

10 changes: 10 additions & 0 deletions cddl/platform/arm-platform-instance-id.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
arm-platform-instance-id-label = 256 ; EAT ueid

; TODO: require that the first byte of arm-platform-instance-id-type is 0x01
; EAT UEIDs need to be 7 - 33 bytes
arm-platform-instance-id-type = bytes .size 33

arm-platform-instance-id = (
arm-platform-instance-id-label => arm-platform-instance-id-type
)

23 changes: 23 additions & 0 deletions cddl/platform/arm-platform-lifecycle.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
arm-platform-lifecycle-label = 2395 ; PSA lifecycle

arm-platform-lifecycle-unknown-type = 0x0000..0x00ff
arm-platform-lifecycle-assembly-and-test-type = 0x1000..0x10ff
arm-platform-lifecycle-arm-platform-rot-provisioning-type = 0x2000..0x20ff
arm-platform-lifecycle-secured-type = 0x3000..0x30ff
arm-platform-lifecycle-non-arm-platform-rot-debug-type = 0x4000..0x40ff
arm-platform-lifecycle-recoverable-arm-platform-rot-debug-type = 0x5000..0x50ff
arm-platform-lifecycle-decommissioned-type = 0x6000..0x60ff

arm-platform-lifecycle-type =
arm-platform-lifecycle-unknown-type /
arm-platform-lifecycle-assembly-and-test-type /
arm-platform-lifecycle-arm-platform-rot-provisioning-type /
arm-platform-lifecycle-secured-type /
arm-platform-lifecycle-non-arm-platform-rot-debug-type /
arm-platform-lifecycle-recoverable-arm-platform-rot-debug-type /
arm-platform-lifecycle-decommissioned-type

arm-platform-lifecycle = (
arm-platform-lifecycle-label => arm-platform-lifecycle-type
)

7 changes: 7 additions & 0 deletions cddl/platform/arm-platform-profile.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
cca-platform-profile-label = 265 ; EAT profile

cca-platform-profile-type = "tag:arm.com,2023:cca_platform#1.0.0"

cca-platform-profile = (
cca-platform-profile-label => cca-platform-profile-type
)
14 changes: 14 additions & 0 deletions cddl/platform/arm-platform-sw-components.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
arm-platform-sw-components-label = 2399 ; PSA software components

arm-platform-sw-component = {
? 1 => text, ; component type
2 => arm-platform-hash-type, ; measurement value
? 4 => text, ; version
5 => arm-platform-hash-type, ; signer id
? 6 => text, ; hash algorithm identifier
}

arm-platform-sw-components = (
arm-platform-sw-components-label => [ + arm-platform-sw-component ]
)

8 changes: 8 additions & 0 deletions cddl/platform/arm-platform-verification-service.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
arm-platform-verification-service-label = 2400 ; PSA verification service
arm-platform-verification-service-type = text

arm-platform-verification-service = (
arm-platform-verification-service-label =>
arm-platform-verification-service-type
)

14 changes: 14 additions & 0 deletions cddl/realm/COSE_Key.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
; per RFC8152

label = int / tstr

values = any

COSE_Key = {
1 => tstr / int, ; kty
? 2 => bstr, ; kid
? 3 => tstr / int, ; alg
? 4 => [+ (tstr / int) ], ; key_ops
? 5 => bstr, ; Base IV
* label => values
}
6 changes: 6 additions & 0 deletions cddl/realm/cca-realm-challenge.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
cca-realm-challenge-label = 10
cca-realm-challenge-type = bytes .size 64

cca-realm-challenge = (
cca-realm-challenge-label => cca-realm-challenge-type
)
13 changes: 13 additions & 0 deletions cddl/realm/cca-realm-claims.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
cca-realm-claims = (cca-realm-claim-map)

cca-realm-claim-map = {
cca-realm-challenge
? cca-realm-profile
cca-realm-personalization-value
cca-realm-initial-measurement
cca-realm-extensible-measurements
cca-realm-hash-algo-id
cca-realm-public-key
cca-realm-public-key-hash-algo-id
cca-realm-mec-policy
}
5 changes: 5 additions & 0 deletions cddl/realm/cca-realm-extensible-measurements.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
cca-realm-extensible-measurements-label = 44239

cca-realm-extensible-measurements = (
cca-realm-extensible-measurements-label => [ 4*4 cca-realm-measurement-type ]
)
5 changes: 5 additions & 0 deletions cddl/realm/cca-realm-hash-algo-id.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
cca-realm-hash-algo-id-label = 44236

cca-realm-hash-algo-id = (
cca-realm-hash-algo-id-label => text
)
5 changes: 5 additions & 0 deletions cddl/realm/cca-realm-initial-measurement.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
cca-realm-initial-measurement-label = 44238

cca-realm-initial-measurement = (
cca-realm-initial-measurement-label => cca-realm-measurement-type
)
1 change: 1 addition & 0 deletions cddl/realm/cca-realm-measurement.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
cca-realm-measurement-type = bytes .size 32 / bytes .size 48 / bytes .size 64
5 changes: 5 additions & 0 deletions cddl/realm/cca-realm-mec-policy.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
cca-realm-mec-policy-label = 44241

cca-realm-mec-policy = (
cca-realm-mec-policy-label => "shared" / "private"
)
6 changes: 6 additions & 0 deletions cddl/realm/cca-realm-personalization-value.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
cca-realm-personalization-value-label = 44235
cca-realm-personalization-value-type = bytes .size 64

cca-realm-personalization-value = (
cca-realm-personalization-value-label => cca-realm-personalization-value-type
)
7 changes: 7 additions & 0 deletions cddl/realm/cca-realm-profile.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
cca-realm-profile-label = 265 ; EAT profile

cca-realm-profile-type = "tag:arm.com,2023:realm#1.0.0"

cca-realm-profile = (
cca-realm-profile-label => cca-realm-profile-type
)
5 changes: 5 additions & 0 deletions cddl/realm/cca-realm-public-key-hash-algo-id.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
cca-realm-public-key-hash-algo-id-label = 44240

cca-realm-public-key-hash-algo-id = (
cca-realm-public-key-hash-algo-id-label => text
)
8 changes: 8 additions & 0 deletions cddl/realm/cca-realm-public-key.cddl
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
cca-realm-public-key-label = 44237

; See RFC8152 for definition of COSE_Key
cca-realm-public-key-type = bstr .cbor COSE_Key

cca-realm-public-key = (
cca-realm-public-key-label => cca-realm-public-key-type
)
Loading

0 comments on commit 3db8a15

Please sign in to comment.