Skip to content

wolfBoot DICE attestation with wolfCOSE #831

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aidangarske wants to merge 12 commits into
base: master
Choose a base branch
from
Open

wolfBoot DICE attestation with wolfCOSE #831

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
d522c3d
Add wolfCOSE as a submodule at lib/wolfCOSE
aidangarske Jul 23, 2026
6645acf
Build DICE attestation tokens with wolfCOSE instead of a local CBOR w…
aidangarske Jul 23, 2026
fb5c373
Read the STM32H5 unique device ID from 0x08FFF800 for DICE UDS deriva…
aidangarske Jul 23, 2026
ba6c1d9
Wire wolfCOSE into the CMake WOLFCRYPT_TZ_PSA build path
aidangarske Jul 23, 2026
1dec1b3
Assert DICE attestation output in the trustzone emulator test
aidangarske Jul 27, 2026
2f52e07
Build m33mu from danielinux/m33mu#10 in the trustzone emulator test
aidangarske Jul 27, 2026
a7c02cd
Revert the temporary m33mu PR build step
aidangarske Jul 27, 2026
c74f277
Keep the DICE signing objects out of the token builder frame
aidangarske Jul 27, 2026
902995c
Build a pinned m33mu in the trustzone emulator test
aidangarske Jul 28, 2026
92d674f
Drop the pinned m33mu build now that the CI image is refreshed
aidangarske Jul 30, 2026
2955e99
Use the PSA registered claim keys for lifecycle and measurement descr…
aidangarske Jul 30, 2026
b1f8273
Fail attestation when a measurement cannot be collected
aidangarske Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitmodules
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@
[submodule "lib/wolfHAL"]
path = lib/wolfHAL
url = https://github.com/wolfSSL/wolfHAL.git
[submodule "lib/wolfCOSE"]
path = lib/wolfCOSE
url = https://github.com/wolfSSL/wolfCOSE.git
5 changes: 5 additions & 0 deletions CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -566,6 +566,11 @@ endif()

if(DEFINED WOLFCRYPT_TZ_PSA AND NOT WOLFCRYPT_TZ_PSA STREQUAL "0")
list(APPEND WOLFBOOT_SOURCES "src/dice/dice.c")
list(APPEND WOLFBOOT_SOURCES "lib/wolfCOSE/src/wolfcose.c")
list(APPEND WOLFBOOT_SOURCES "lib/wolfCOSE/src/wolfcose_cbor.c")
list(APPEND WOLFBOOT_INCLUDE_DIRS ${WOLFBOOT_ROOT}/lib/wolfCOSE/include)
list(APPEND WOLFBOOT_DEFS WOLFCOSE_LEAN WOLFCOSE_ENABLE_EXT_SIGN
WOLFCOSE_SIGN1_UNTAGGED)
endif()

# build bin-assemble tool Windows
Expand Down
3 changes: 3 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,20 +179,23 @@ WOLFBOOT_LIB_WOLFTPM?=lib/wolfTPM
WOLFBOOT_LIB_WOLFPKCS11?=lib/wolfPKCS11
WOLFBOOT_LIB_WOLFPSA?=lib/wolfPSA
WOLFBOOT_LIB_WOLFHSM?=lib/wolfHSM
WOLFBOOT_LIB_WOLFCOSE?=lib/wolfCOSE

# Convert to absolute paths using abspath function
WOLFBOOT_LIB_WOLFSSL:=$(abspath $(WOLFBOOT_LIB_WOLFSSL))
WOLFBOOT_LIB_WOLFTPM:=$(abspath $(WOLFBOOT_LIB_WOLFTPM))
WOLFBOOT_LIB_WOLFPKCS11:=$(abspath $(WOLFBOOT_LIB_WOLFPKCS11))
WOLFBOOT_LIB_WOLFPSA:=$(abspath $(WOLFBOOT_LIB_WOLFPSA))
WOLFBOOT_LIB_WOLFHSM:=$(abspath $(WOLFBOOT_LIB_WOLFHSM))
WOLFBOOT_LIB_WOLFCOSE:=$(abspath $(WOLFBOOT_LIB_WOLFCOSE))

# Export variables so they are available to sub-makefiles
export WOLFBOOT_LIB_WOLFSSL
export WOLFBOOT_LIB_WOLFTPM
export WOLFBOOT_LIB_WOLFPKCS11
export WOLFBOOT_LIB_WOLFPSA
export WOLFBOOT_LIB_WOLFHSM
export WOLFBOOT_LIB_WOLFCOSE

## Architecture/CPU configuration
include arch.mk
Expand Down
33 changes: 17 additions & 16 deletions hal/stm32h5.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,10 +167,11 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
return 0;
}

#define STM32H5_BSEC_BASE 0x46009000u
#define STM32H5_BSEC_UID0 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x14))
#define STM32H5_BSEC_UID1 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x18))
#define STM32H5_BSEC_UID2 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x1C))
/* STM32H5 96-bit unique device ID, factory-programmed (RM0481). */
#define STM32H5_UID_BASE 0x08FFF800u
#define STM32H5_UID0 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x0u))
#define STM32H5_UID1 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x4u))
#define STM32H5_UID2 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x8u))

#ifdef WOLFBOOT_UDS_OBKEYS
__attribute__((weak)) int stm32h5_obkeys_read_uds(uint8_t *out, size_t out_len)
Expand Down Expand Up @@ -205,18 +206,18 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
#endif
size_t copy_len;

uid[0] = (uint8_t)(STM32H5_BSEC_UID0 >> 0);
uid[1] = (uint8_t)(STM32H5_BSEC_UID0 >> 8);
uid[2] = (uint8_t)(STM32H5_BSEC_UID0 >> 16);
uid[3] = (uint8_t)(STM32H5_BSEC_UID0 >> 24);
uid[4] = (uint8_t)(STM32H5_BSEC_UID1 >> 0);
uid[5] = (uint8_t)(STM32H5_BSEC_UID1 >> 8);
uid[6] = (uint8_t)(STM32H5_BSEC_UID1 >> 16);
uid[7] = (uint8_t)(STM32H5_BSEC_UID1 >> 24);
uid[8] = (uint8_t)(STM32H5_BSEC_UID2 >> 0);
uid[9] = (uint8_t)(STM32H5_BSEC_UID2 >> 8);
uid[10] = (uint8_t)(STM32H5_BSEC_UID2 >> 16);
uid[11] = (uint8_t)(STM32H5_BSEC_UID2 >> 24);
uid[0] = (uint8_t)(STM32H5_UID0 >> 0);
uid[1] = (uint8_t)(STM32H5_UID0 >> 8);
uid[2] = (uint8_t)(STM32H5_UID0 >> 16);
uid[3] = (uint8_t)(STM32H5_UID0 >> 24);
uid[4] = (uint8_t)(STM32H5_UID1 >> 0);
uid[5] = (uint8_t)(STM32H5_UID1 >> 8);
uid[6] = (uint8_t)(STM32H5_UID1 >> 16);
uid[7] = (uint8_t)(STM32H5_UID1 >> 24);
uid[8] = (uint8_t)(STM32H5_UID2 >> 0);
uid[9] = (uint8_t)(STM32H5_UID2 >> 8);
uid[10] = (uint8_t)(STM32H5_UID2 >> 16);
uid[11] = (uint8_t)(STM32H5_UID2 >> 24);

#if defined(WOLFBOOT_HASH_SHA256)
wc_InitSha256(&hash);
Expand Down
1 change: 1 addition & 0 deletions lib/wolfCOSE
Open in desktop
Submodule wolfCOSE added at 21bd18
5 changes: 5 additions & 0 deletions options.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1122,6 +1122,9 @@ ifeq ($(WOLFCRYPT_TZ_PSA),1)
CFLAGS+=-DWOLFSSL_PSA_ENGINE
CFLAGS+=-DWOLFPSA_CUSTOM_STORE
CFLAGS+=-DNO_DES3 -DNO_DES3_TLS_SUITES
CFLAGS+=-I$(WOLFBOOT_LIB_WOLFCOSE)/include
CFLAGS+=-DWOLFCOSE_LEAN -DWOLFCOSE_ENABLE_EXT_SIGN
CFLAGS+=-DWOLFCOSE_SIGN1_UNTAGGED
WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)
WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)/wolfpsa
ifeq ($(USE_CLANG),1)
Expand All @@ -1135,6 +1138,8 @@ ifeq ($(WOLFCRYPT_TZ_PSA),1)
WOLFCRYPT_OBJS+=src/psa_store.o
WOLFCRYPT_OBJS+=src/arm_tee_psa_veneer.o
WOLFCRYPT_OBJS+=src/arm_tee_psa_ipc.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFCOSE)/src/wolfcose.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFCOSE)/src/wolfcose_cbor.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/pwdbased.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hmac.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/dh.o
Expand Down
Loading
Loading