feat: Add real mldas87 cert and csr to rom #2060
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ArthurHeymans
requested review from
FerralCoder,
rusty1968,
bluegate010,
mhatrevi,
swenson,
vsonims,
ajisaxena,
jlmahowa-amd,
jhand2,
korran and
JohnTraverAmd
as code owners
jhand2
requested changes
Mar 31, 2025
ArthurHeymans
force-pushed
the
RealMldsa87CsrAndCert
branch
2 times, most recently
from
db4ea23 to
3617b2c
Compare
Alright that turned out to be easier than expected :-D |
ArthurHeymans
force-pushed
the
RealMldsa87CsrAndCert
branch
from
3617b2c to
e2764e1
Compare
ArthurHeymans
force-pushed
the
RealMldsa87CsrAndCert
branch
2 times, most recently
from
fb82048 to
9909bfc
Compare
ArthurHeymans
force-pushed
the
RealMldsa87CsrAndCert
branch
4 times, most recently
from
e4c25f4 to
3010c7c
Compare
jhand2
reviewed
Apr 24, 2025
jhand2
reviewed
Apr 24, 2025
jhand2
reviewed
Apr 24, 2025
jhand2
previously approved these changes
Apr 24, 2025
ArthurHeymans
force-pushed
the
RealMldsa87CsrAndCert
branch
2 times, most recently
from
292adce to
ca6f2df
Compare
mhatrevi
previously approved these changes
Apr 28, 2025
The previous certificates were handcrafted and most certainly not correct. For now this uses out of tree code to generate cert and csr based on existing code, but using rustcrypto instead of openssl. Later work will try to integrate that code into caliptra-x509 build.rs. The repo for generating these tbs is "https://github.com/ArthurHeymans/test-rustcrypto-mldsa" A difference is that x509-cert from rustcrypto always uses UTC time rather than General time which has a 2049 date limit and uses 13 instead of 15 bytes. Signed-off-by: Arthur Heymans <[email protected]>
Signed-off-by: Arthur Heymans <[email protected]>
To avoid conflicting dependencies that we already use for rustcrypto add this empty workspace crate that can generate all the cert and csr templates. To run it and update existing TBS templates: cd x509/ml-dsa OUT_DIR=../build cargo run Signed-off-by: Arthur Heymans <[email protected]>
Signed-off-by: Arthur Heymans <[email protected]>
Signed-off-by: Arthur Heymans <[email protected]>
This will be used by rustcrypto cert generation Signed-off-by: Arthur Heymans <[email protected]>
Signed-off-by: Arthur Heymans <[email protected]>
Signed-off-by: Arthur Heymans <[email protected]>
ArthurHeymans
force-pushed
the
RealMldsa87CsrAndCert
branch
from
ca6f2df to
dedaa1e
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The previous certificates were handcrafted and most certainly not correct.
For now this uses out of tree code to generate cert and csr based on existing code, but using rustcrypto instead of openssl. Later work will try to integrate that code into caliptra-x509 build.rs.
The repo for generating these tbs is
"https://github.com/ArthurHeymans/test-rustcrypto-mldsa"
A difference is that x509-cert from rustcrypto always uses UTC time rather than General time which has a 2049 date limit and uses 13 instead of 15 bytes.