Skip to content

[sku] Enable second-layer HPKE #341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
willyzha merged 1 commit into from
Sep 29, 2026
Merged

[sku] Enable second-layer HPKE #341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions config/spm/sku_ti04.yml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,9 @@ attributes:
WASDisable: false
WrappingMechanism: ${OTPROV_WrappingMechanism}
WrappingKeyLabel: sku-eg-rsa-rma-v0.pub
SecondLayerWrappingMechanism: Hpke
HPKEPQPublicKeyPath: sku/eg/ti/ca/hpke_mlkem.pub
HPKEClassicalPublicKeyPath: sku/eg/ti/ca/hpke_ecdsa.pub.der
SigningKey/Dice/v0: ti01-ica-dice-key-p256-v0.priv
SigningKey/Dice/Mldsa/v0: ti04-ica-dice-key-mldsa-v0.priv
SigningKey/Identity/v0: spm-hsm-id-v0.priv
Expand Down
4 changes: 3 additions & 1 deletion nix/profiles/softhsm.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,10 +140,12 @@ in
/var/lib/opentitan/config/token_init.sh --action offline-sku-certgen "''${SKUS[@]}"
fi

# Copy HPKE keys for sival_pqc if staged in /var/lib/opentitan/release/hpke
# Copy HPKE keys for sival_pqc and ti04 if staged in /var/lib/opentitan/release/hpke
if [ -d /var/lib/opentitan/release/hpke ] && [ -d /var/lib/opentitan/config/spm/sku/sival_pqc ]; then
mkdir -p /var/lib/opentitan/config/spm/sku/sival_pqc/ca
cp -f /var/lib/opentitan/release/hpke/* /var/lib/opentitan/config/spm/sku/sival_pqc/ca/
mkdir -p /var/lib/opentitan/config/spm/sku/eg/ti/ca
cp -f /var/lib/opentitan/release/hpke/* /var/lib/opentitan/config/spm/sku/eg/ti/ca/
fi

# 5. Ensure SKU config files and directories are linked into /var/lib/opentitan/config for spm_server
Expand Down
3 changes: 2 additions & 1 deletion util/integration_test_setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,8 +140,9 @@ chmod +x "${DEPLOYMENT_BIN_DIR}"/openocd

if [[ -n "${OT_PROV_PQ_EN}" ]]; then
echo "Generating test HPKE keys..."
mkdir -p "${DEPLOYMENT_DIR}/spm/sku/sival_pqc/ca/"
mkdir -p "${DEPLOYMENT_DIR}/spm/sku/sival_pqc/ca/" "${DEPLOYMENT_DIR}/spm/sku/eg/ti/ca/"
bazelisk run //util:generate_test_hpke_keys -- "${DEPLOYMENT_DIR}/spm/sku/sival_pqc/ca/"
cp -f "${DEPLOYMENT_DIR}/spm/sku/sival_pqc/ca/hpke_"* "${DEPLOYMENT_DIR}/spm/sku/eg/ti/ca/"
fi

# Build the SPM server synchronously before launching it in the background so
Expand Down
Loading