fix(tbbr): guard defines under MBEDTLS_CONFIG_FILE

Several platforms, such as NXP platforms, employ Trusted Boot support
without relying on MBEDTLS_CONFIG. This patch addresses the build
issues that

fix(tbbr): guard defines under MBEDTLS_CONFIG_FILE

Several platforms, such as NXP platforms, employ Trusted Boot support
without relying on MBEDTLS_CONFIG. This patch addresses the build
issues that arose on such platforms as a result of recent change
c1ec23dd60 [1].

[1]: https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/23730

Change-Id: Idfbeeafb8a30dc15bb0060beb5b17819a8807084
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

refactor(tbbr): enforce compile-time error for invalid algorithm selection

Enforced compile-time error on invalid algorithm selection.

Change-Id: I517aa11c9fa9fda49483f95587f43529085c9d5d
Signed-of

refactor(tbbr): enforce compile-time error for invalid algorithm selection

Enforced compile-time error on invalid algorithm selection.

Change-Id: I517aa11c9fa9fda49483f95587f43529085c9d5d
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

feat(tbbr): update PK_DER_LEN for ECDSA P-384 keys

Adding the PK_DER_LEN option for 384 key size when adding ECDSA P384 key
support

Change-Id: I0f19aebad20d1c552976dc3c22ed396d79614769
Signed-off-b

feat(tbbr): update PK_DER_LEN for ECDSA P-384 keys

Adding the PK_DER_LEN option for 384 key size when adding ECDSA P384 key
support

Change-Id: I0f19aebad20d1c552976dc3c22ed396d79614769
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>

show more ...

fix(mbedtls): fix mbedtls coverity issues

commit (a8eadc51a refactor(mbedtls): avoid including
MBEDTLS_CONFIG_FILE) avoids using config file directly and relies on
config file usage from mbedtls ver

fix(mbedtls): fix mbedtls coverity issues

commit (a8eadc51a refactor(mbedtls): avoid including
MBEDTLS_CONFIG_FILE) avoids using config file directly and relies on
config file usage from mbedtls version.h

But we could build trusted boot without mbedtls dir so guard version.h
include in cot_def.h with availability of config file.

Also we refactored in same commit to break dependencies between
auth_mod.h and cot_def.h, So add cot_def.h include in nxp tbbr
cot file.

Change-Id: I4779e90c18f04c73d2121c88df6420b4b1109c8b
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

refactor(mbedtls): avoid including MBEDTLS_CONFIG_FILE

Currently we include MBEDTLS_CONFIG_FILE directly and if a custom
config file is used it will included.

However from mbedtls-3.x onwards it di

refactor(mbedtls): avoid including MBEDTLS_CONFIG_FILE

Currently we include MBEDTLS_CONFIG_FILE directly and if a custom
config file is used it will included.

However from mbedtls-3.x onwards it discourages usage of
MBEDTLS_CONFIG_FILE include directly, so to resolve this and keep 2.28
compatibility include version.h which would include the custom config
file if present and also would expose us with mbedtls-major-version
number which could be used for selecting features and functions for
mbedtls 2.28 or 3.3

Change-Id: I029992311be2a38b588ebbb350875b03ea29acdb
Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>

show more ...

feat(tbbr): increase PK_DER_LEN size

Public key brainpool ECDSA DER certificate are 92 byte long.
OID for brainpool curve are 1 byte bigger than the one for NIST curve.

Change-Id: Ifad51da3c576d555

feat(tbbr): increase PK_DER_LEN size

Public key brainpool ECDSA DER certificate are 92 byte long.
OID for brainpool curve are 1 byte bigger than the one for NIST curve.

Change-Id: Ifad51da3c576d555da9fc519d2df3d9a0e6ed91b
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>

show more ...

feat(cca): introduce new "cca" chain of trust

This chain of trust is targeted at Arm CCA solutions and defines 3
independent signing domains:

1) CCA signing domain. The Arm CCA Security Model (Arm

feat(cca): introduce new "cca" chain of trust

This chain of trust is targeted at Arm CCA solutions and defines 3
independent signing domains:

1) CCA signing domain. The Arm CCA Security Model (Arm DEN-0096.A.a) [1]
refers to the CCA signing domain as the provider of CCA components
running on the CCA platform. The CCA signing domain might be independent
from other signing domains providing other firmware blobs.

The CCA platform is a collective term used to identify all hardware and
firmware components involved in delivering the CCA security guarantee.
Hence, all hardware and firmware components on a CCA enabled system that
a Realm is required to trust.

In the context of TF-A, this corresponds to BL1, BL2, BL31, RMM and
associated configuration files.

The CCA signing domain is rooted in the Silicon ROTPK, just as in the
TBBR CoT.

2) Non-CCA Secure World signing domain. This includes SPMC (and
associated configuration file) as the expected BL32 image as well as
SiP-owned secure partitions. It is rooted in a new SiP-owned key called
Secure World ROTPK, or SWD_ROTPK for short.

3) Platform owner signing domain. This includes BL33 (and associated
configuration file) and the platform owner's secure partitions. It is
rooted in the Platform ROTPK, or PROTPK.

[1] https://developer.arm.com/documentation/DEN0096/A_a

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I6ffef3f53d710e6a2072fb4374401249122a2805

show more ...