Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in / Register
Toggle navigation
Menu
Open sidebar
adam.huang
Arm Trusted Firmware
Commits
d83f3e5d
Commit
d83f3e5d
authored
Mar 02, 2020
by
Sandrine Bailleux
Committed by
TrustedFirmware Code Review
Mar 02, 2020
Browse files
Merge "doc: Fix variables names in TBBR CoT documentation" into integration
parents
24038137
51d4e227
Changes
1
Hide whitespace changes
Inline
Side-by-side
docs/design/auth-framework.rst
View file @
d83f3e5d
...
...
@@ -621,7 +621,7 @@ The TBBR CoT
The CoT can be found in ``drivers/auth/tbbr/tbbr_cot.c``. This CoT consists of
an array of pointers to image descriptors and it is registered in the framework
using the macro ``REGISTER_COT(cot_desc)``, where
'
cot_desc
'
must be the name
using the macro ``REGISTER_COT(cot_desc)``, where
``
cot_desc
``
must be the name
of the array (passing a pointer or any other type of indirection will cause the
registration process to fail).
...
...
@@ -870,32 +870,32 @@ Once the signature has been checked and the certificate authenticated, the
Trusted World public key needs to be extracted from the certificate. A new entry
is created in the ``authenticated_data`` array for that purpose. In that entry,
the corresponding parameter descriptor must be specified along with the buffer
address to store the parameter value. In this case, the ``t
z
_world_pk``
descriptor
is used to extract the public key from an x509v3 extension with OID
address to store the parameter value. In this case, the ``t
rusted
_world_pk``
descriptor
is used to extract the public key from an x509v3 extension with OID
``TRUSTED_WORLD_PK_OID``. The BL31 key certificate will use this descriptor as
parameter in the signature authentication method. The key is stored in the
``
plat_tz
_world_pk_buf`` buffer.
``
trusted
_world_pk_buf`` buffer.
The **BL31 Key certificate** is authenticated by checking its digital signature
using the Trusted World public key obtained previously from the Trusted Key
certificate. In the image descriptor, we specify a single authentication method
by signature whose public key is the ``t
z
_world_pk``. Once this certificate
has
been authenticated, we have to extract the BL31 public key, stored in the
extension specified by ``
bl31
_content_pk``. This key will be copied to the
``
plat_
content_pk`` buffer.
by signature whose public key is the ``t
rusted
_world_pk``. Once this certificate
has
been authenticated, we have to extract the BL31 public key, stored in the
extension specified by ``
soc_fw
_content_pk``. This key will be copied to the
``content_pk
_buf
`` buffer.
The **BL31 certificate** is authenticated by checking its digital signature
using the BL31 public key obtained previously from the BL31 Key certificate.
We specify the authentication method using ``
bl31
_content_pk`` as public key.
We specify the authentication method using ``
soc_fw
_content_pk`` as public key.
After authentication, we need to extract the BL31 hash, stored in the extension
specified by ``
bl31
_hash``. This hash will be copied to the
``plat_bl31_hash_buf``
buffer.
specified by ``
soc_fw
_hash``. This hash will be copied to the
``soc_fw_hash_buf``
buffer.
The **BL31 image** is authenticated by calculating its hash and matching it
with the hash obtained from the BL31 certificate. The image descriptor contains
a single authentication method by hash. The parameters to the hash method are
the reference hash, ``
bl31
_hash``, and the data to be hashed. In this case,
it is
the whole image, so we specify ``raw_data``.
the reference hash, ``
soc_fw
_hash``, and the data to be hashed. In this case,
it is
the whole image, so we specify ``raw_data``.
The image parser library
~~~~~~~~~~~~~~~~~~~~~~~~
...
...
@@ -965,6 +965,6 @@ The mbedTLS library algorithm support is configured by both the
--------------
*Copyright (c) 2017-20
19
, Arm Limited and Contributors. All rights reserved.*
*Copyright (c) 2017-20
20
, Arm Limited and Contributors. All rights reserved.*
.. _TBBR-Client specification: https://developer.arm.com/docs/den0006/latest/trusted-board-boot-requirements-client-tbbr-client-armv8-a
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment