fix(x509): use ROM and FW versions in cert subjects

Derive certificate common names from the canonical version constants so
IDevID and LDevID identify the ROM version, while FMC and RT aliases
identify the mutable firmware version. Regenerate the X.509 templates to
match.

Fix the DER TBS length calculation for two-byte lengths whose low byte
crosses the carry boundary, which the longer subject names expose.

Signed-off-by: Arthur Heymans <arthur.heymans@9elements.com>

Author: ArthurHeymans

FROZEN_IMAGES.sha384sum

@@ -1,3 +1,3 @@
 # WARNING: Do not update this file without the approval of the Caliptra TAC
-4469e0789ca27eb08bd911be1a66b0401589b70f2823c2552cb85a563134b6f575b1aae6e4b9689b9a73524bc97798f8  caliptra-rom-no-log.bin
-5f90da3587cada1b3d27778ebe09f4c5e239f185ea7bbdddc6bd1d1d57ffdcd7f4c570bf432d2cfdefadbc79ff6c6f67  caliptra-rom-with-log.bin
+943523249da1b9b6efe3ef54062da2365b6ac12199bf251d453cf099c3cff2cb4f41171f69279a293a1cef4cdfc86c75  caliptra-rom-no-log.bin
+615a0d0eb443f992522ffc14bf62ed8a3e8aebd2f3794060e8472bd2aa27c35362deee26d30017ca9c609e1eadb6b634  caliptra-rom-with-log.bin

builder/src/version.rs

@@ -12,6 +12,30 @@ pub const RUNTIME_VERSION_MAJOR: u32 = 2;
 pub const RUNTIME_VERSION_MINOR: u32 = 1;
 pub const RUNTIME_VERSION_PATCH: u32 = 0;
 
+/// Get the ROM version as a human-readable string (e.g., "2.1.1")
+pub fn rom_version_string() -> String {
+    format!(
+        "{}.{}.{}",
+        ROM_VERSION_MAJOR, ROM_VERSION_MINOR, ROM_VERSION_PATCH
+    )
+}
+
+/// Get the FMC version as a human-readable string (e.g., "2.1.0")
+pub fn fmc_version_string() -> String {
+    format!(
+        "{}.{}.{}",
+        FMC_VERSION_MAJOR, FMC_VERSION_MINOR, FMC_VERSION_PATCH
+    )
+}
+
+/// Get the Runtime version as a human-readable string (e.g., "2.1.0")
+pub fn runtime_version_string() -> String {
+    format!(
+        "{}.{}.{}",
+        RUNTIME_VERSION_MAJOR, RUNTIME_VERSION_MINOR, RUNTIME_VERSION_PATCH
+    )
+}
+
 // ROM Version - 16 bits
 // Major - 5 bits [15:11]
 // Minor - 5 bits [10:6]

fmc/tests/fmc_integration_tests/test_rtalias.rs

@@ -131,8 +131,8 @@ fn test_fht_info() {
 
         let data = hw.mailbox_execute(TEST_CMD_READ_FHT, &[]).unwrap().unwrap();
         let fht = FirmwareHandoffTable::try_ref_from_bytes(data.as_bytes()).unwrap();
-        assert_eq!(fht.ecc_ldevid_tbs_size, 595);
-        assert_eq!(fht.ecc_fmcalias_tbs_size, 918);
+        assert_eq!(fht.ecc_ldevid_tbs_size, 607);
+        assert_eq!(fht.ecc_fmcalias_tbs_size, 929);
         assert_ne!(fht.mldsa_ldevid_tbs_size, 0);
         assert_ne!(fht.mldsa_fmcalias_tbs_size, 0);
     }

rom/dev/tests/rom_integration_tests/test_fmcalias_derivation.rs

@@ -836,8 +836,8 @@ fn test_fht_info() {
 
         let data = hw.mailbox_execute(0x1000_0003, &[]).unwrap().unwrap();
         let fht = FirmwareHandoffTable::try_ref_from_bytes(data.as_bytes()).unwrap();
-        assert_eq!(fht.ecc_ldevid_tbs_size, 595);
-        assert_eq!(fht.ecc_fmcalias_tbs_size, 918);
+        assert_eq!(fht.ecc_ldevid_tbs_size, 607);
+        assert_eq!(fht.ecc_fmcalias_tbs_size, 929);
     }
 }
 

runtime/build.rs

@@ -12,7 +12,23 @@ Abstract:
 
 --*/
 
+#[allow(dead_code)]
+#[path = "../builder/src/version.rs"]
+mod version;
+
 fn main() {
+    // Emit RT Alias CN strings derived from the canonical version constants.
+    let rt_ver = version::runtime_version_string();
+    println!(
+        "cargo:rustc-env=RT_ALIAS_CN_ECC384=Caliptra FW {} Ecc384 Rt Alias",
+        rt_ver
+    );
+    println!(
+        "cargo:rustc-env=RT_ALIAS_CN_MLDSA87=Caliptra FW {} MlDsa87 Rt Alias",
+        rt_ver
+    );
+    println!("cargo:rerun-if-changed=../builder/src/version.rs");
+
     cfg_if::cfg_if! {
         if #[cfg(not(feature = "std"))] {
             use std::env;

runtime/src/dpe_platform.rs

@@ -109,8 +109,8 @@ impl Platform for DpePlatform<'_> {
         &mut self,
         out: &mut [u8; MAX_ISSUER_NAME_SIZE],
     ) -> Result<usize, PlatformError> {
-        const CN_ECC384: &[u8] = b"Caliptra 2.1 Ecc384 Rt Alias";
-        const CN_MLDSA87: &[u8] = b"Caliptra 2.1 MlDsa87 Rt Alias";
+        const CN_ECC384: &[u8] = env!("RT_ALIAS_CN_ECC384").as_bytes();
+        const CN_MLDSA87: &[u8] = env!("RT_ALIAS_CN_MLDSA87").as_bytes();
         let mut issuer_writer = CertWriter::new(out, self.profile.into(), true);
 
         // Caliptra RDN SerialNumber field is always a Sha256 hash

test/tests/caliptra_integration_tests/smoke_testdata/idevid_csr_ecc.der

@@ -1,7 +1,7 @@
 Certificate Request:
     Data:
         Version: 1 (0x0)
-        Subject: CN=Caliptra 2.1 Ecc384 IDevID/serialNumber=7FFEDEF6DCD6697BD0F381AA37B58112F24BDDB5550D2C791B5798AD202A0351
+        Subject: CN=Caliptra ROM 2.1.1 Ecc384 IDevID/serialNumber=7FFEDEF6DCD6697BD0F381AA37B58112F24BDDB5550D2C791B5798AD202A0351
         Subject Public Key Info:
             Public Key Algorithm: id-ecPublicKey
                 Public-Key: (384 bit)
@@ -27,9 +27,9 @@ Certificate Request:
                     2.23.133.5.4.100.6, 2.23.133.5.4.100.12
     Signature Algorithm: ecdsa-with-SHA384
     Signature Value:
-        30:66:02:31:00:f9:98:04:45:88:e4:d7:a0:f2:98:81:85:0b:
-        81:b5:13:9d:ff:6f:82:85:c3:07:13:02:9b:20:17:22:32:dc:
-        9c:27:7e:d8:85:d0:bf:d3:4c:e4:2d:b4:20:27:6b:8b:83:02:
-        31:00:fc:f7:d1:b6:28:27:fc:04:dc:0d:3c:c6:bb:79:47:0f:
-        91:22:d7:fe:96:33:fc:13:61:3f:2a:6c:dd:b0:8b:42:ef:1b:
-        d1:08:e0:a2:2e:77:a4:be:3b:71:cf:c2:f8:b2
+        30:65:02:30:2f:36:47:fb:06:93:f0:a9:82:04:67:35:dc:03:
+        60:5b:be:a0:29:c8:db:94:58:a8:25:b6:75:15:ec:9b:6d:8b:
+        c5:c8:94:44:13:a3:c9:6d:19:b1:e5:7a:2b:0f:70:55:02:31:
+        00:c4:43:2d:49:a3:8c:b6:ad:5c:bd:d9:65:3c:41:10:86:6e:
+        57:45:cb:76:36:75:54:01:d7:87:2a:bd:da:e7:1e:98:fd:59:
+        58:c3:28:38:e6:5a:05:50:c3:ba:54:06:59