Skip to content

Latest commit

 

History

History
73 lines (62 loc) · 23.8 KB

interfaces.md

File metadata and controls

73 lines (62 loc) · 23.8 KB
Raw

Hardware Interfaces

Referring to the Comportable guideline for peripheral device functionality, the module keymgr has the following hardware interfaces defined

  • Primary Clock: clk_i
  • Other Clocks: clk_edn_i
  • Bus Device Interfaces (TL-UL): tl
  • Bus Host Interfaces (TL-UL): none
  • Peripheral Pins for Chip IO: none

Inter-Module Signals

Port Name Package::Struct Type Act Width Description
edn edn_pkg::edn req_rsp req 1
aes_key keymgr_pkg::hw_key_req uni req 1
kmac_key keymgr_pkg::hw_key_req uni req 1
otbn_key keymgr_pkg::otbn_key_req uni req 1
kmac_data kmac_pkg::app req_rsp req 1
otp_key otp_ctrl_pkg::otp_keymgr_key uni rcv 1
otp_device_id otp_ctrl_pkg::otp_device_id uni rcv 1
flash flash_ctrl_pkg::keymgr_flash uni rcv 1
lc_keymgr_en lc_ctrl_pkg::lc_tx uni rcv 1
lc_keymgr_div lc_ctrl_pkg::lc_keymgr_div uni rcv 1
rom_digest rom_ctrl_pkg::keymgr_data uni rcv 1
kmac_en_masking logic uni rcv 1
tl tlul_pkg::tl req_rsp rsp 1

Interrupts

Interrupt Name Type Description
op_done Event Operation complete

Security Alerts

Alert Name Description
recov_operation_err Alert for key manager operation errors. These errors could have been caused by software
fatal_fault_err Alert for key manager faults. These errors cannot be caused by software

Security Countermeasures

Countermeasure ID Description
KEYMGR.BUS.INTEGRITY End-to-end bus integrity scheme.
KEYMGR.CONFIG.SHADOW Various critical registers are shadowed: including operation control, reseed interval, and key max version (creator, owner intermediate, owner).
KEYMGR.OP.CONFIG.REGWEN Various controls locked during the duration of an operation: including operation start, operation control, sideload clear, salt and key version.
KEYMGR.RESEED.CONFIG.REGWEN Reseed interval is software lockable.
KEYMGR.SW_BINDING.CONFIG.REGWEN Software binding is lockable by software in each stage. When keymgr successfully advances, the lock is released to allow the next stage the freedom to program.
KEYMGR.MAX_KEY_VER.CONFIG.REGWEN Max key version is software lockable.
KEYMGR.LC_CTRL.INTERSIG.MUBI Life cycle control signal is multibit
KEYMGR.CONSTANTS.CONSISTENCY Basic consistency checks (all 0's or all 1's) for keymgr diversification constants
KEYMGR.INTERSIG.CONSISTENCY Basic consistency checks (all 0's or all 1's) for otp diversification inputs
KEYMGR.HW.KEY.SW_NOACCESS Sideload keys are not directly accessible by software.
KEYMGR.OUTPUT_KEYS.CTRL.REDUN Software and sideload keys are redundantly controlled. Each generate operation creates a valid and a data enable (software and sideload specific). In order for a key to be populated into the software register, both the software valid and the software data enable must be asserted. The same is true for sideload. This makes it more difficult for an attack to fault a sideload key into the software key slot. An attacker would need to fault both the software valid and the software data enable. During a sideload operation, if an attacker manages to fault the valid but not the data enable, the software key is populated with random data. If an atacker manages to fault the data enable but not the valid, then the software key retains its previous value.
KEYMGR.CTRL.FSM.SPARSE Main control fsm is sparsely encoded.
KEYMGR.DATA.FSM.SPARSE Control data fsm (for redundant data control) is sparsely encoded.
KEYMGR.CTRL.FSM.LOCAL_ESC Main control fsm locally escalates based on any detected fault in keymgr. When a fault is detected (sync or async) the fsm transitions to invalid state to prevent further legal operations from executing.
KEYMGR.CTRL.FSM.CONSISTENCY Main and operational fsm transitions are consistent with software commands.
KEYMGR.CTRL.FSM.GLOBAL_ESC When the system globally escalates, the main control fsm also transitions to invalid state to prevent further legal operations from executing.
KEYMGR.CTRL.CTR.REDUN Primary count is duplicated.
KEYMGR.KMAC_IF.FSM.SPARSE kmac interface fsm is sparsely encoded.
KEYMGR.KMAC_IF.CTR.REDUN Primary count uses cross count.
KEYMGR.KMAC_IF_CMD.CTRL.CONSISTENCY One hot check for kmac interface commands. Also, command enable (adv_en, id_en, gen_en) is checked for consistency throughout the operation.
KEYMGR.KMAC_IF_DONE.CTRL.CONSISTENCY Spurious kmac done check.
KEYMGR.RESEED.CTR.REDUN Primary count is duplicated.
KEYMGR.SIDE_LOAD_SEL.CTRL.CONSISTENCY Sideload key slot select is checked for consistency. When a key slot is valid when it should not be, an error is triggered. The reverse case is not checked, since an invalid key cannot be used anyways.
KEYMGR.SIDELOAD_CTRL.FSM.SPARSE Sideload control fsm is sparsely encoded.
KEYMGR.CTRL.KEY.INTEGRITY Internal secret key is protected with ECC.