michaelh/zephyr
1
0
Fork 0
Code Releases Activity

tfm: Enforce initial attestation with required key provisioned

Browse source 
Enforce that the initial attestation partition has the required
initial attestation key provisioned.

If the initial attestation key (IAK) is not present during boot of
TF-M the system will panic during initialization.

Signed-off-by: Joakim Andersson <joakim.andersson@nordicsemi.no>
This commit is contained in:
Joakim Andersson 2023-08-25 13:55:49 +02:00 • committed by Carles Cufí
commit 2687376eff
3 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
modules/trusted-firmware-m/Kconfig.tfm
View file

@ -182,6 +182,7 @@ config TFM_PARTITION_PLATFORM_CUSTOM_REBOOT
config TFM_DUMMY_PROVISIONING
bool "Provision with dummy values. NOT to be used in production"
select TFM_INITIAL_ATTESTATION_KEY
default y
help
If this option is enabled (as it is by default), a set of dummy
@ -191,6 +192,13 @@ config TFM_DUMMY_PROVISIONING
This option MUST not be used in production hardware, as the keys are
insecure.
config TFM_INITIAL_ATTESTATION_KEY
bool
help
Hidden option to mark that the TF-M platform has an initial
attestation key, which is a requirement for the Initial Attestation
partition.
config TFM_BL2_NOT_SUPPORTED
bool
help

1
modules/trusted-firmware-m/Kconfig.tfm.partitions
View file

@ -44,6 +44,7 @@ config TFM_PARTITION_CRYPTO
config TFM_PARTITION_INITIAL_ATTESTATION
bool "Secure partition 'Initial Attestation'"
depends on TFM_PARTITION_CRYPTO
depends on TFM_INITIAL_ATTESTATION_KEY
default n
help
Setting this option will cause '-DTFM_PARTITION_INITIAL_ATTESTATION'