Conversation
dgarske
left a comment
dgarske
left a comment
There was a problem hiding this comment.
I see this enabling the wolfCrypt HW PUF options, but I don't see anywhere it actually gets used in wolfBoot? Or even called in wolfCrypt. How's this supposed to work end to end?
There was a problem hiding this comment.
This adds the useful build plumbing for LPC55 PUF support, but it does not yet connect the HW PUF to the attestation identity.
What we actually need here is the HW PUF to become the UID/UDS source for the boot attestation demo. Today the attestation stack gets its identity through hal_uds_derive_key() / hal_attestation_get_ueid() in dice.c.
This PR still needs:
- a new LPC55 attestation config enabling PSA attestation demo options
- LPC55 hal support that rebuilds identity from PUF exposing it via hal_uds_derive_key / get_ueid. Check
existing generic software managed internal flash PUF support in STM32H5existing support for HW PUF in mcxn.c via those API for how to implement - The test app showing that the PSA attestation token is actually produced from the PUF-derived identity wired inside wolfBoot.
lpc55s69-hwpuf.config will compile in wolfssl test.c, which tests the hwpuf. But, you have to turn on HWPUF=1 in that config file, and point your wolfssl to wolfSSL/wolfssl#10584 |
|
Depends on wolfSSL/wolfssl#10584 |
477c71c to
4c7c347
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #787
Scan targets checked: wolfboot-src, wolfboot-bugs
Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
|
This is now properly demonstrating HW PUF on LPC55S69 in DICE. LGTM after wolfSSL/wolfssl#10584 is merged. |
Clean up the single-letter UART markers (R/A/B/C/g0-3/1-6/D/E/F/G-P/L0/L/ V/W/d/e) and the hwpuf provision success/failure trace messages added during the lpc55s69 PUF cosim debugging. The PUF+RNG models in m33mu now work; the boot flow completes end-to-end.
Uses lpc55s69-tz-psa.config with HWPUF=1 and WOLFBOOT_HWPUF_PROVISION=1. Requires m33mu with lpc55s69 PUF/RNG models and the 0x0C000000 secure flash alias (wolfboot-ci >= 1.22).
5 participants
This adds a new example config (lpc55s69-hwpuf.config) to wolfBoot, to demonstrate and test the new lpc55s69 hw puf support added in wolfSSL/wolfssl#10584
It also adds an example of device attestation with lpc55s69-tz-psa.config