[nrf noup] For Attestation, use message instead of hash #180
Conversation
| @@ -241,6 +241,9 @@ attest_token_encode_start(struct attest_token_encode_ctx *me, | |||
| me->opt_flags = opt_flags; | |||
| me->key_select = key_select; | |||
|
|
|||
| if (opt_flags & TOKEN_OPT_SIGN_MESSAGE) { | |||
There was a problem hiding this comment.
Should I make sure this is only added for nRF54L15, or should we use sign_message for all chips?
There was a problem hiding this comment.
I think that it makes sense to keep the default as is and not use sign_message.
But we need to have this as an option in TFM. We can sync with a call tomorrow or something and we can find a way to do that.
lib/ext/t_cose/inc/t_cose_common.h
Outdated
| @@ -496,6 +496,14 @@ struct t_cose_parameters { | |||
| */ | |||
| #define T_COSE_OPT_DECODE_ONLY 0x00000008 | |||
|
|
|||
| /** | |||
| * By defualt, the cose t_cose_sign1_sign will calculate the hash | |||
There was a problem hiding this comment.
"defualt" -> "default"
And the function t_cose_sign1_sign doesnt exit now.
| @@ -241,6 +241,9 @@ attest_token_encode_start(struct attest_token_encode_ctx *me, | |||
| me->opt_flags = opt_flags; | |||
| me->key_select = key_select; | |||
|
|
|||
| if (opt_flags & TOKEN_OPT_SIGN_MESSAGE) { | |||
There was a problem hiding this comment.
I think that it makes sense to keep the default as is and not use sign_message.
But we need to have this as an option in TFM. We can sync with a call tomorrow or something and we can find a way to do that.
hellesvik-nordic
force-pushed
the
t_cose_add_message_sign
branch
13 times, most recently
from
c9cd993
to
dc8b931
Compare
The t_cose library only had support for signing a hash/digest. Adding support for signing message instead by using the option T_COSE_OPT_SIGN_MESSAGE. Signed-off-by: Sigurd Hellesvik <[email protected]>
For attestation, sign the full token instead of the hash of the token. Signed-off-by: Sigurd Hellesvik <[email protected]>
hellesvik-nordic
force-pushed
the
t_cose_add_message_sign
branch
from
dc8b931
to
9c1a5ad
Compare
There was a problem hiding this comment.
Why are we making changes to lib/ext/t_cose as a noup while it exists upstream?
There was a problem hiding this comment.
Good point. I will make a PR upstream instead, and then fix this PR accordingly.
Also updated T_COSE library to support this