From ad9f3f7571cfc4582531a1169ca033447fcc16f7 Mon Sep 17 00:00:00 2001 From: Willy Zhang Date: Tue, 29 Sep 2026 20:13:28 +0000 Subject: [PATCH] [sku] Enable second-layer HPKE RMA token wrapping for ti04 Configure SecondLayerWrappingMechanism: Hpke along with HPKEPQPublicKeyPath and HPKEClassicalPublicKeyPath in sku_ti04.yml.tmpl, and stage test/release HPKE keys into sku/eg/ti/ca/. Signed-off-by: Willy Zhang --- config/spm/sku_ti04.yml.tmpl | 3 +++ nix/profiles/softhsm.nix | 4 +++- util/integration_test_setup.sh | 3 ++- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/config/spm/sku_ti04.yml.tmpl b/config/spm/sku_ti04.yml.tmpl index 45f0330..1b0811d 100644 --- a/config/spm/sku_ti04.yml.tmpl +++ b/config/spm/sku_ti04.yml.tmpl @@ -33,6 +33,9 @@ attributes: WASDisable: false WrappingMechanism: ${OTPROV_WrappingMechanism} WrappingKeyLabel: sku-eg-rsa-rma-v0.pub + SecondLayerWrappingMechanism: Hpke + HPKEPQPublicKeyPath: sku/eg/ti/ca/hpke_mlkem.pub + HPKEClassicalPublicKeyPath: sku/eg/ti/ca/hpke_ecdsa.pub.der SigningKey/Dice/v0: ti01-ica-dice-key-p256-v0.priv SigningKey/Dice/Mldsa/v0: ti04-ica-dice-key-mldsa-v0.priv SigningKey/Identity/v0: spm-hsm-id-v0.priv diff --git a/nix/profiles/softhsm.nix b/nix/profiles/softhsm.nix index 08c1293..b6cb0d4 100644 --- a/nix/profiles/softhsm.nix +++ b/nix/profiles/softhsm.nix @@ -140,10 +140,12 @@ in /var/lib/opentitan/config/token_init.sh --action offline-sku-certgen "''${SKUS[@]}" fi - # Copy HPKE keys for sival_pqc if staged in /var/lib/opentitan/release/hpke + # Copy HPKE keys for sival_pqc and ti04 if staged in /var/lib/opentitan/release/hpke if [ -d /var/lib/opentitan/release/hpke ] && [ -d /var/lib/opentitan/config/spm/sku/sival_pqc ]; then mkdir -p /var/lib/opentitan/config/spm/sku/sival_pqc/ca cp -f /var/lib/opentitan/release/hpke/* /var/lib/opentitan/config/spm/sku/sival_pqc/ca/ + mkdir -p /var/lib/opentitan/config/spm/sku/eg/ti/ca + cp -f /var/lib/opentitan/release/hpke/* /var/lib/opentitan/config/spm/sku/eg/ti/ca/ fi # 5. Ensure SKU config files and directories are linked into /var/lib/opentitan/config for spm_server diff --git a/util/integration_test_setup.sh b/util/integration_test_setup.sh index 3fcb1d1..69f0679 100755 --- a/util/integration_test_setup.sh +++ b/util/integration_test_setup.sh @@ -140,8 +140,9 @@ chmod +x "${DEPLOYMENT_BIN_DIR}"/openocd if [[ -n "${OT_PROV_PQ_EN}" ]]; then echo "Generating test HPKE keys..." - mkdir -p "${DEPLOYMENT_DIR}/spm/sku/sival_pqc/ca/" + mkdir -p "${DEPLOYMENT_DIR}/spm/sku/sival_pqc/ca/" "${DEPLOYMENT_DIR}/spm/sku/eg/ti/ca/" bazelisk run //util:generate_test_hpke_keys -- "${DEPLOYMENT_DIR}/spm/sku/sival_pqc/ca/" + cp -f "${DEPLOYMENT_DIR}/spm/sku/sival_pqc/ca/hpke_"* "${DEPLOYMENT_DIR}/spm/sku/eg/ti/ca/" fi # Build the SPM server synchronously before launching it in the background so