feat(measured-boot): enable dynamic hash provisioning

Introduce dynamic hash provisioning for Measured Boot by removing the
previous static hash-selection path and allowing platforms to supply
algor

feat(measured-boot): enable dynamic hash provisioning

Introduce dynamic hash provisioning for Measured Boot by removing the
previous static hash-selection path and allowing platforms to supply
algorithm metadata at runtime. Add mboot_find_event_log_metadata() as a
common helper for resolving image metadata. Update the Event Log build
logic to use MAX_DIGEST_SIZE and MAX_HASH_COUNT, deprecate legacy
MBOOT_EL_HASH_ALG, and warn when it is used. Adjust MbedTLS
configuration to enable hash algorithms automatically when Measured Boot
is enabled.

Change-Id: I704e1a5005f6caad3d51d868bacc53699b6dd64f
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat: add TPM/TCG hashing helper to crypto module

Introduce crypto_mod_tcg_hash(), a helper that maps TPM/TCG algorithm
identifiers to the platform crypto backend. This ensures that Event Log
measur

feat: add TPM/TCG hashing helper to crypto module

Introduce crypto_mod_tcg_hash(), a helper that maps TPM/TCG algorithm
identifiers to the platform crypto backend. This ensures that Event Log
measurements use the same digest implementation as the platform PCR
backend regardless of whether hashing is performed in software,
hardware, or a discrete TPM. Update the measured boot design document,
expose the new API via public headers, and implement the helper in the
common crypto module.

Change-Id: Id4f7f1d0014ab42064c46819965417daef71555b
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(mbedtls): update mbedtls to version 3.6.5

Change-Id: Ia5366faa71007024e098a05ee391a2ff8e8676c0
Signed-off-by: Slava Andrianov <slava.andrianov@arm.com>

feat(mbedtls): update mbedtls to version 3.6.4

In order to successfully update mbedtls to version 3.6.4, the
redundant-decls warning must be disabled to accomodate a change in the
definition locatio

feat(mbedtls): update mbedtls to version 3.6.4

In order to successfully update mbedtls to version 3.6.4, the
redundant-decls warning must be disabled to accomodate a change in the
definition locations of some helper functions. This is currently an open
issue for mbedtls: https://github.com/Mbed-TLS/mbedtls/issues/10376

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I57c9c14aabe75a51c74dcf2a33faf59f95ce2386

show more ...

build(measured-boot)!: move to ext event log lib

Removes in-tree Event Log library implementation and updates all
references to use the external submodule. Updates include paths,
Makefile macros, an

build(measured-boot)!: move to ext event log lib

Removes in-tree Event Log library implementation and updates all
references to use the external submodule. Updates include paths,
Makefile macros, and platform integration logic to link with lib as a
static library.

If you cloned TF-A without the `--recurse-submodules` flag, you can
ensure that this submodule is present by running:

git submodule update --init --recursive

BREAKING-CHANGE: LibEventLog is now included in TF-A as a submodule.
Please run `git submodule update --init --recursive` if you encounter
issues after migrating to the latest version of TF-A.

Change-Id: I723f493033c178759a45ea04118e7cc295dc2438
Signed-off-by: Harrison Mutai <harrison.mutai@arm.com>

show more ...

feat(auth): mbedtls psa key id mgmt

Currently the psa key is created and destroyed after each usage during
signature verification.

This redesign adds a key_cache to store the key ID, psa algorithm,

feat(auth): mbedtls psa key id mgmt

Currently the psa key is created and destroyed after each usage during
signature verification.

This redesign adds a key_cache to store the key ID, psa algorithm, and
key attributes associated with a particular pk_oid. This allows for the
psa key to be reused by each image that has the associated pk_oid.

The pk_oid of the image being authenticated is stored as the global
current_pk_oid variable, which is used during the psa crypto
verification stage to associate a key_cache entry with a particular
pk_oid.

Since the psa key is no longer destroyed after each usage, the psa keys
are therefore destroyed after all images have been loaded during each
boot phase in the new crypto_mod_finish() function that is registered
by the REGISTER_CRYPTO_LIB and enabled through the build option of
PSA_CRYTPO.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Iba330bc659a76493bd958673424efcc621bab1c4

show more ...

feat(auth): add crypto_mod_finish() function

Adding crypto_mod_finish() function to be run at the end of crypto usage
to cleanup.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Chan

feat(auth): add crypto_mod_finish() function

Adding crypto_mod_finish() function to be run at the end of crypto usage
to cleanup.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Ib6d099ddaa278f293fe14b805070985522a85686

show more ...

feat(auth): add util file for current pk_oid

Adding new auth util file for the current_pk_oid and get and set
functions.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I9

feat(auth): add util file for current pk_oid

Adding new auth util file for the current_pk_oid and get and set
functions.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I91220f94d469c86f2e18570e13f1419125447288

show more ...

feat(auth): increase mbedtls heap for PSA RSA

Increase default mbedtls PSA crypto heap size for key id management
redesign where the key information is stored for reuse during
verification and needs

feat(auth): increase mbedtls heap for PSA RSA

Increase default mbedtls PSA crypto heap size for key id management
redesign where the key information is stored for reuse during
verification and needs more heap size for RSA keys.

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: I3afe0107a8e22ededd3eb4c0e1f635f18960d341

show more ...

feat(mbedtls): update mbedtls to version 3.6.3

Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>
Change-Id: Icad24203a36cb7e5b0a6f2275cb3b5346dcd148a

feat(mbedtls): optimize SHA256 for reduced memory footprint

Set MBEDTLS_SHA256_SMALLER as the default mbedTLS configuration
to minimize memory usage, trading off some processing speed for
a smaller

feat(mbedtls): optimize SHA256 for reduced memory footprint

Set MBEDTLS_SHA256_SMALLER as the default mbedTLS configuration
to minimize memory usage, trading off some processing speed for
a smaller footprint.

Change-Id: Ibfa6e115a0ed94096b9acdd9e237f3fb5457071d
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(psa): increase psa-mbedtls heap size for rsa

The value assigned for the mbedtls heap size for large
rsa keys was too small when PSA_CRYPTO is set to 1,
leading to run-time failures if one was to

fix(psa): increase psa-mbedtls heap size for rsa

The value assigned for the mbedtls heap size for large
rsa keys was too small when PSA_CRYPTO is set to 1,
leading to run-time failures if one was to attempt
to use a large RSA key with PSA_CRYPTO=1.

Change-Id: Id9b2648ae911879f483f1b88301f28694af0721d
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

feat(mbedtls): mbedtls config update for v3.6.2

This new update to the LTS branch of MbedTLS provides
the fix for a buffer underrun vulnerability. TF-A does
not use the previously vulnerable functio

feat(mbedtls): mbedtls config update for v3.6.2

This new update to the LTS branch of MbedTLS provides
the fix for a buffer underrun vulnerability. TF-A does
not use the previously vulnerable functions
`mbedtls_pk_write_key_der` or `mbedtls_pk_write_key_pem`.
Full patch notes to this MbedTLS update can be found at
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.2.

We now enforce the mbedtls version to be greater than or equal
to 3.6.2 in our default configs.

Change-Id: I79027f6c741ab3f419f7b555321507e6a78b977b
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

refactor(mbedtls): rename default mbedtls confs

Change the name of these confs to be version agnostic,
we will later use these configs to enforce the mbedtls
minimum version

Change-Id: I1f665c24718

refactor(mbedtls): rename default mbedtls confs

Change the name of these confs to be version agnostic,
we will later use these configs to enforce the mbedtls
minimum version

Change-Id: I1f665c2471877ecc833270c511749ff845046f10
Signed-off-by: Ryan Everett <ryan.everett@arm.com>

show more ...

chore(mbedtls): remove hash configs

After the upgrade to mbedtls 3.6.0, some of these configuation limitations
are no longer present.

Size chages:
build config | executable | Delta
-------------|--

chore(mbedtls): remove hash configs

After the upgrade to mbedtls 3.6.0, some of these configuation limitations
are no longer present.

Size chages:
build config | executable | Delta
-------------|------------|-------
tbb ecdsa | bl1 | -176
-------------|------------|-------
tbb rsa | bl1 | -192
| bl2 | -4096
-------------|------------|-------
drtm | romlib | -576
-------------|------------|-------
spm | romlib | -576
-------------|------------|-------
mb384 | romlib | -1016

Change-Id: I019bc59adc93cf95f6f28ace9579e7bf1e785b62
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>

show more ...