arm-trusted-firmware/include/tools_share/dualroot_oid.h

/*
 * Copyright (c) 2020, Arm Limited. All rights reserved.
 *
 * SPDX-License-Identifier: BSD-3-Clause
 */

#ifndef DUALROOT_OID_H
#define DUALROOT_OID_H

/* Reuse the Object IDs defined by TBBR for certificate extensions. */
#include "tbbr_oid.h"

/*
 * Platform root-of-trust public key.
 * Arbitrary value that does not conflict with any of the TBBR reserved OIDs.
 */
#define PROT_PK_OID				"1.3.6.1.4.1.4128.2100.1102"

#endif /* DUALROOT_OID_H */
Introduce a new "dualroot" chain of trust This new chain of trust defines 2 independent signing domains: 1) One for the silicon firmware (BL1, BL2, BL31) and optionally the Trusted OS. It is rooted in the Silicon ROTPK, just as in the TBBR CoT. 2) One for the Normal World Bootloader (BL33). It is rooted in a new key called Platform ROTPK, or PROTPK for short. In terms of certificates chain, - Signing domain 1) is similar to what TBBR advocates (see page 21 of the TBBR specification), except that the Non-Trusted World Public Key has been removed from the Trusted Key Certificate. - Signing domain 2) only contains the Non-Trusted World Content certificate, which provides the hash of the Non-Trusted World Bootloader. Compared to the TBBR CoT, there's no Non-Trusted World Key certificate for simplicity. Change-Id: I62f1e952522d84470acc360cf5ee63e4c4b0b4d9 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com> 2020-02-06 13:59:14 +00:00			`/*`
			`* Copyright (c) 2020, Arm Limited. All rights reserved.`
			`*`
			`* SPDX-License-Identifier: BSD-3-Clause`
			`*/`

			`#ifndef DUALROOT_OID_H`
			`#define DUALROOT_OID_H`

			`/* Reuse the Object IDs defined by TBBR for certificate extensions. */`
			`#include "tbbr_oid.h"`

			`/*`
			`* Platform root-of-trust public key.`
			`* Arbitrary value that does not conflict with any of the TBBR reserved OIDs.`
			`*/`
			`#define PROT_PK_OID "1.3.6.1.4.1.4128.2100.1102"`

			`#endif /* DUALROOT_OID_H */`