Skip to content

Commit e48bde9

Browse files
mcymcy
committed
Clean up text through to the end
Signed-off-by: Miguel Young de la Sota <mcyoung@google.com>
1 parent 9b0d816 commit e48bde9

1 file changed

Lines changed: 77 additions & 149 deletions

File tree

‎RoT/Protocol/Challenge_Protocol.md‎

Lines changed: 77 additions & 149 deletions
Original file line numberDiff line numberDiff line change
@@ -2494,6 +2494,7 @@ Empty body.
24942494
The Seal/Unseal flow is described in the Cerberus Attestation Integration
24952495
specification.
24962496

2497+
24972498
# Platform Active RoT (PA-RoT)
24982499

24992500
The PA-RoT is responsible for challenging the AC-RoT’s and collecting their
@@ -2535,24 +2536,18 @@ level and persistent storage level.
25352536
The following table lists the attributes stored in the PFM for each Active
25362537
component:
25372538

2538-
2539-
Table 98 PFM Attributes
2540-
2541-
2542-
<table> <tr> <td><strong>Attribute</strong> </td>
2543-
<td><strong>Description</strong> </td> </tr> <tr> <td>Description </td>
2544-
<td>Device Part or Description </td> </tr> <tr> <td>Device Type </td>
2545-
<td>Underlying Device Type of AC-RoT </td> </tr> <tr> <td>Remediation Policy
2546-
</td> <td>Policy(s) defining default remediation actions for integrity failure.
2547-
</td> </tr> <tr> <td>Firmware Version </td> <td>List of firmware versions </td>
2548-
</tr> <tr> <td>Flash Areas/Offsets </td> <td>List of offset and digests, used
2549-
and unused </td> </tr> <tr> <td>Measurement </td> <td>Firmware Measurements
2550-
</td> </tr> <tr> <td>Measurement Algorithm </td> <td>Algorithm used to calculate
2551-
measurement. </td> </tr> <tr> <td>Public Key </td> <td>Public keys in the key
2552-
manifest </td> </tr> <tr> <td>Digest Algorithm </td> <td>Algorithm used to
2553-
calculate </td> </tr> <tr> <td>Signature </td> <td>Firmware signature(s) </td>
2554-
</tr> </table>
2555-
2539+
| Attribute | Description |
2540+
|-----------------------|---------------------------------------------|
2541+
| Description | Device Part or Description |
2542+
| Device Type | Underlying Device Type of AC-RoT |
2543+
| Remediation Policy | Remediation actions for integrity failure. |
2544+
| Firmware Version | List of firmware versions |
2545+
| Flash Areas/Offsets | List of offset and digests, used and unused |
2546+
| Measurement | Firmware Measurements |
2547+
| Measurement Algorithm | Algorithm used to calculate measurement. |
2548+
| Public Key | Public keys in the key manifest. |
2549+
| Digest Algorithm | Algorithm used to calculate. |
2550+
| Signature | Firmware signature(s) |
25562551

25572552
The PA-RoT actively takes measurements of flash from platform firmware, the PFM
25582553
provides metadata that instructs the RoT on measurement and signature
@@ -2571,6 +2566,7 @@ Note: The PA-RoT and AC-RoT enforce secure boot and only permit the download of
25712566
digitally signed and unrevoked firmware. A PFM or CFM mismatch can only occur
25722567
when firmware integrity is brought into question.
25732568

2569+
25742570
## RoT External Communication interface
25752571

25762572
The PA-RoT connects to the platform through, either SPI, QSPI depending on the
@@ -2582,21 +2578,7 @@ all AC-RoTs in the platform. The BMC bridges the PA-RoT to the Rack Manager,
25822578
which in-turn bridges the rack to the Datacenter management network. The
25832579
interface into the PA-RoT is as follows:
25842580

2585-
2586-
Figure 12 External Communication Interface
2587-
2588-
2589-
2590-
2591-
<p id="gdcalert11" ><span style="color: red; font-weight: bold">>>>>>
2592-
gd2md-html alert: inline image link here (to images/image11.png). Store image on
2593-
your image server and adjust path/filename/extension if necessary.
2594-
</span><br>(<a href="#">Back to top</a>)(<a href="#gdcalert12">Next
2595-
alert</a>)<br><span style="color: red; font-weight: bold">>>>>> </span></p>
2596-
2597-
2598-
![alt_text](images/image11.png "image_tooltip")
2599-
2581+
> TODO: figure 12
26002582
26012583
The Datacenter Management (DCM) software can communicate with the PA-RoT
26022584
Out-Of-Band (OOB) through the Rack Manager. The Rack Manager allows tunneling
@@ -2606,6 +2588,7 @@ authenticated and encrypted. The Datacenter Management Software can collect
26062588
the RFM measurements and other challenge data over this secure channel. Secure
26072589
updates are also possible over this channel.
26082590

2591+
26092592
## Host Interface
26102593

26112594
The host can communicate with the PA-RoT and AC-RoTs through the BMC host
@@ -2624,6 +2607,7 @@ status and make a determination on the remediation.
26242607

26252608
The OOB communication to Cerberus requires TLS and Certificate Authentication.
26262609

2610+
26272611
# Legacy Interface
26282612

26292613
The legacy interface is defined for backward combability with devices that do
@@ -2634,6 +2618,7 @@ structures will closely match that of the MCTP protocol version. Legacy
26342618
interfaces to no support session based authentication but permit signed
26352619
measurements.
26362620

2621+
26372622
## Protocol Format
26382623

26392624
The legacy protocol leverages the SMBus Write/Read Word and Block commands.
@@ -2648,6 +2633,7 @@ repeated start and finally a slave address read. The master keeps clocking as
26482633
the slaves responds with the selected data. The command code byte can be
26492634
considered register space.
26502635

2636+
26512637
### PEC Handling
26522638

26532639
An SMBus legacy protocol implementation may leverage the 8bit SMBus Packet Error
@@ -2661,6 +2647,7 @@ carried the incorrect PEC value or drop the data for the transaction and any
26612647
further transactions (read or write) until the next valid read or write Start
26622648
transaction is received.
26632649

2650+
26642651
### Message Splitting
26652652

26662653
The protocol supports Write Block and Read Block commands. Standard SMBus
@@ -2676,6 +2663,7 @@ entire message. Each segment includes decrementing packet number that
26762663
sequentially identifies the part of the overall message. To stay within the
26772664
protocol length each message segment must be no longer than 255 bytes.
26782665

2666+
26792667
### Payload Format
26802668

26812669
The payload portions of the SMBus Write and Read blocks will encapsulate the
@@ -2688,6 +2676,7 @@ The data blocks of the Write and Read commands will encapsulate the message
26882676
payload. The encapsulated payload includes a uint16 register offset and data
26892677
section.
26902678

2679+
26912680
### Register Format
26922681

26932682
The SMBUS command byte indexes the register, while additional writes offsets
@@ -2703,179 +2692,118 @@ writes can be performed by writing the seal register to the zero offset.
27032692
The following diagram depicts register read access flow for a large register
27042693
space:
27052694

2706-
2707-
Figure 14 Register Read Flow
2708-
2709-
2710-
2711-
<p id="gdcalert12" ><span style="color: red; font-weight: bold">>>>>>
2712-
gd2md-html alert: inline image link here (to images/image12.png). Store image on
2713-
your image server and adjust path/filename/extension if necessary.
2714-
</span><br>(<a href="#">Back to top</a>)(<a href="#gdcalert13">Next
2715-
alert</a>)<br><span style="color: red; font-weight: bold">>>>>> </span></p>
2716-
2717-
2718-
![alt_text](images/image12.png "image_tooltip")
2719-
2695+
> TODO: Figure 14
27202696
27212697
The following diagram depicts register write access flow for a large register
27222698
space, with required seal (update complete bit):
27232699

2700+
> TODO: Figure 15
27242701
2725-
Figure 15 Register Write Flow
2726-
2727-
2728-
2729-
<p id="gdcalert13" ><span style="color: red; font-weight: bold">>>>>>
2730-
gd2md-html alert: inline image link here (to images/image13.png). Store image on
2731-
your image server and adjust path/filename/extension if necessary.
2732-
</span><br>(<a href="#">Back to top</a>)(<a href="#gdcalert14">Next
2733-
alert</a>)<br><span style="color: red; font-weight: bold">>>>>> </span></p>
2734-
2735-
2736-
![alt_text](images/image13.png "image_tooltip")
27372702

27382703
### Legacy Active Component RoT Commands
27392704

27402705
The following table describes the commands accepted by the Active Component RoT.
27412706
All commands are master initiated. The command number is not representative of
27422707
a contiguous memory space, but an index to the respective register
27432708

2744-
Table 99 Commands
2745-
2746-
2747-
<table> <tr> <td><strong>Register Name</strong> </td>
2748-
<td><strong>Command</strong> </td> <td><strong>Length</strong> </td>
2749-
<td><strong>R/W</strong> </td> <td><strong>Description</strong> </td> </tr> <tr>
2750-
<td>Status </td> <td>0x30 </td> <td>2 </td> <td>R </td> <td>Command Status </td>
2751-
</tr> <tr> <td>Firmware Version </td> <td>0x32 </td> <td>16 </td> <td>R/W </td>
2752-
<td>Retrieve firmware version information </td> </tr> <tr> <td>Device Id </td>
2753-
<td>0x33 </td> <td>8 </td> <td>R </td> <td>Retrieves Device Id </td> </tr> <tr>
2754-
<td>Capabilities </td> <td>0x34 </td> <td>9 </td> <td>R </td> <td>Retrieves
2755-
Device Capabilities </td> </tr> <tr> <td>Certificate Digest </td> <td>3C </td>
2756-
<td>32 </td> <td>R </td> <td>SHA256 of Device Id Certificate </td> </tr> <tr>
2757-
<td>Certificate </td> <td>3D </td> <td>4096 </td> <td>R/W </td> <td>Certificate
2758-
from the AC-Rot </td> </tr> <tr> <td>Challenge </td> <td>3E </td> <td>32 </td>
2759-
<td>W </td> <td>Nonce written by RoT </td> </tr> <tr> <td>Platform Configuration
2760-
Register </td> <td>0x03 </td> <td>0x5e </td> <td>R </td> <td>Reads firmware
2761-
measurement, calculated with S Nonce </td> </tr> </table>
2709+
| Register Name | Command | Length | R/W | Description |
2710+
|---------------------------------|---------|--------|-----|-----------------------------------------------------|
2711+
| Status | 0x30 | 2 | R | Command Status |
2712+
| Firmware Version | 0x32 | 16 | R/W | Retrieve firmware version information |
2713+
| Device Id | 0x33 | 8 | R | Retrieves Device Id |
2714+
| Capabilities | 0x34 | 9 | R | Retrieves Device Capabilities |
2715+
| Certificate Digest | 0x3c | 32 | R | SHA256 of Device Id Certificate |
2716+
| Certificate | 0x3d | 4096 | R/W | Certificate from the AC-Rot |
2717+
| Challenge | 0x3e | 32 | W | Nonce written by RoT |
2718+
| Platform Configuration Register | 0x03 | 0x5e | R | Reads firmware measurement, calculated with S Nonce |
2719+
27622720

27632721
### Legacy Command Format
27642722

27652723
The following section describes the register format for AC-RoT that do not
27662724
implement SMBUS and comply with the legacy measurement exchange protocol.
27672725

2768-
2769-
2770-
1. Status
2726+
#### Status
27712727

27722728
The SMBUS read command reads detailed information on error status. The status
27732729
register is issued between writing the challenge nonce and reading the
27742730
Measurement. The delay time for deriving the Measurement must comply with the
27752731
Capabilities command.
27762732

2733+
| Payload | Description |
2734+
|---------|-----------------------------------------------------------|
2735+
| 1 | Status: 0x00 = Complete, 0x01 = In Progress, 0x02 = Error |
2736+
| 2 | Error Data or Zero |
27772737

2778-
Table 100 Status Register
2779-
2780-
2781-
<table> <tr> <td><strong>Payload</strong> </td> <td><strong>Description</strong>
2782-
</td> </tr> <tr> <td>1 </td> <td>Status: <p>
2783-
2784-
00 = Complete <p>
2785-
2786-
01 In Progress <p>
2787-
2788-
02 Error </td> </tr> <tr> <td>2 </td> <td>Error Data or Zero </td> </tr>
2789-
</table>
2790-
2791-
2792-
2738+
<!-- NOTE: all of the table references below are broken and ened to be replaced
2739+
with proper anchor links. -->
27932740

2794-
2. Firmware Version
2741+
#### Firmware Version
27952742

27962743
The SMBUS write command payload sets the index. The subsequent SMBUS read
27972744
command reads the response. For register payload description see response:
27982745
Table 11 Firmware Version Response
27992746

2747+
#### Device Id
28002748

2749+
The SMBUS read command reads the response. For register payload
2750+
description see response: Table 1 Field Definitions.
28012751

2802-
3. Device Id
2803-
2804-
The SMBUS read command reads the response. For register payload
2805-
description see response: Table 1 Field Definitions
2806-
2807-
4. Device Capabilities
2808-
2809-
The SMBUS read command reads the response. For register payload
2810-
description see response:
2752+
#### Device Capabilities
28112753

2754+
The SMBUS read command reads the response. For register payload description see
2755+
response: Table 13 Device Capabilities Response
28122756

2813-
Table 13 Device Capabilities Response
2814-
2815-
5. Certificate Digest
2757+
#### Certificate Digest
28162758

28172759
The SMBUS read command reads the response. For register payload description
2818-
see response: Table 24 GET DIGEST Response
2760+
see response: Table 24 `GET DIGEST` Response
28192761

28202762
The PA-Rot will use the digest to determine if it has the certificate already
28212763
cached. Unlike MCTP, only the Alias and Device Id cert is supported.
28222764
Therefore, it must be CA signed by a mutually trusted CA, as the CA Public Cert
28232765
is not present
28242766

2825-
2826-
2827-
6. Certificate
2767+
#### Certificate
28282768

28292769
The SMBUS write command writes the offset into the register space. For register
2830-
payload description see response: Table 26 GET CERTIFICATE Response
2831-
2770+
payload description see response: Table 26 `GET CERTIFICATE` Response
28322771

2833-
#### Unlike MCTP, only the Alias and Device Id cert is supported. Therefore,
2772+
Unlike MCTP, only the Alias and Device Id certificates are supported. Therefore,
28342773
it must be CA signed by mutually trusted CA, as the CA Public Cert is not
28352774
present in the reduced challenge
28362775

28372776
The SMBUS write command writes a nonce for measurement freshness.
28382777

2778+
| Payload | Description |
2779+
|---------|---------------------------------------|
2780+
| 1:32 | Random 32 byte nonce chosen by PA-RoT |
28392781

2840-
Table 101 Challenge Register
2841-
2842-
2843-
<table> <tr> <td><strong>Payload</strong> </td> <td><strong>Description</strong>
2844-
</td> </tr> <tr> <td>1:32 </td> <td>Random 32 byte nonce chosen by PA-RoT </td>
2845-
</tr> </table>
2846-
2847-
2848-
2849-
2850-
7. Measurement
2782+
#### Measurement
28512783

28522784
The SMBUS read command that reads the signed measurement with the nonce from the
28532785
hallenge above. The PA-RoT must poll the Status register for completion after
28542786
issuing the Challenge and before reading the Measurement.
28552787

2788+
| Payload | Description |
2789+
|---------|--------------------------------------|
2790+
| 1 | Length (L) of following hash digest. |
2791+
| 2:33 | `H(Challenge Nonce ** H(PMR0))` |
2792+
| 34:N | Signature of HASH [2:33] |
28562793

2857-
Table 102 Measurement Register
2858-
2859-
2860-
<table> <tr> <td><strong>Payload</strong> </td> <td><strong>Description</strong>
2861-
</td> </tr> <tr> <td>1 </td> <td>Length (L) of following hash digest. </td>
2862-
</tr> <tr> <td>2:33 </td> <td>H(Challenge Nonce || H(Firmware Measurement/PMR0))
2863-
</td> </tr> <tr> <td>34:N </td> <td>Signature of HASH [2:33] </td> </tr>
2864-
</table>
28652794

28662795
# References
2867-
1. DICE Architecture
2868-
[https://trustedcomputinggroup.org/work-groups/dice-architectures](https://trustedcomputinggroup.org/work-groups/dice-architectures)
2869-
2. RIoT
2870-
[https://www.microsoft.com/en-us/research/publication/riot-a-foundation-for-trust-in-the-internet-of-things](https://www.microsoft.com/en-us/research/publication/riot-a-foundation-for-trust-in-the-internet-of-things)
2871-
3. DICE and RIoT Keys and Certificates
2872-
[https://www.microsoft.com/en-us/research/publication/device-identity-dice-riot-keys-certificates](https://www.microsoft.com/en-us/research/publication/device-identity-dice-riot-keys-certificates)
2873-
4. USB Type C Authentication Specification
2874-
[http://www.usb.org/developers/docs/](http://www.usb.org/developers/docs/)
2875-
5. PCIe Device Security Enhancements specification
2876-
[https://www.intel.com/content/www/us/en/io/pci-express/pcie-device-security-enhancements-spec.html](https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.intel.com%2Fcontent%2Fwww%2Fus%2Fen%2Fio%2Fpci-express%2Fpcie-device-security-enhancements-spec.html&data=02%7C01%7Cbryankel%40microsoft.com%7C6b6c323d9f5a430b6e2308d5c00880fc%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636626065116355800&sdata=Kebb47PfKoWc8jO1KHCDCxMriLH5gHncp3lCqyT6WAo%3D&reserved=0)
2877-
6. **NIST Special Publication 800-108 ** Recommendation for Key Derivation
2878-
Using Pseudorandom Functions.
2879-
[http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-108.pdf](http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-108.pdf)
2880-
7. TCG PC Client Platform Firmware Profile Specification** **
2881-
[https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification](https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification)
2796+
1. DICE Architecture
2797+
<https://trustedcomputinggroup.org/work-groups/dice-architectures>
2798+
2. RIoT
2799+
<https://www.microsoft.com/en-us/research/publication/riot-a-foundation-for-trust-in-the-internet-of-things>
2800+
3. DICE and RIoT Keys and Certificates
2801+
<https://www.microsoft.com/en-us/research/publication/device-identity-dice-riot-keys-certificates>
2802+
4. USB Type C Authentication Specification
2803+
<http://www.usb.org/developers/docs>
2804+
5. PCIe Device Security Enhancements specification
2805+
<https://www.intel.com/content/www/us/en/io/pci-express/pcie-device-security-enhancements-spec.html>
2806+
6. NIST Special Publication 800-108 - Recommendation for Key Derivation Using Pseudorandom Functions.
2807+
<http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-108.pdf>
2808+
7. TCG PC Client Platform Firmware Profile Specification
2809+
<https://trustedcomputinggroup.org/resource/pc-client-specific-platform-firmware-profile-specification>

0 commit comments

Comments
 (0)