-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add ephemeral key allocator to FabricTable #20082
Merged
tcarmelveilleux
merged 8 commits into
project-chip:master
from
tcarmelveilleux:cleanup-hsm-20036
Jun 29, 2022
Merged
Add ephemeral key allocator to FabricTable #20082
tcarmelveilleux
merged 8 commits into
project-chip:master
from
tcarmelveilleux:cleanup-hsm-20036
Jun 29, 2022
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- CASE requires P256 ephemeral keys - CASE had a hack whereby "single slots" ephemeral keys for NXP HSM were used, which cannot work for multiple CASE session establishments - Using raw P256Keypair prevents being able to use OS-backed or HW-backed keys, like can be done for operational keys Issue project-chip#20036 This PR: - Adds a way to get CASE ephemeral keys from the OperationalKeystore abstraction - Funnels their access via the FabricTable - Removes some HSM hacks (cannot remove all HSM usage just yet) in a way that now OperationalKeystore targeting NXP HSM could do the right thing Testing done: - Unit tests still pass - Integration tests still passa - Added unit tests to validate usage of new APIs - Ran valgrind on the unit tests, found no leaks
pullapprove
bot
requested review from
andy31415,
anush-apple,
arkq,
Byungjoo-Lee,
bzbarsky-apple,
carol-apple,
chrisdecenzo,
chshu,
chulspro,
Damian-Nordic,
dhrishi,
electrocucaracha,
emargolis,
franck-apple,
gjc13,
harsha-rajendran,
hawk248,
isiu-apple,
jelderton,
jepenven-silabs,
jmartinez-silabs,
jtung-apple,
kghost,
kpschoedel and
lazarkov
June 28, 2022 21:55
pullapprove
bot
requested review from
yufengwangca,
vivien-apple,
wbschiller,
woody-apple and
xylophone21
June 28, 2022 21:55
bzbarsky-apple
approved these changes
Jun 28, 2022
PR #20082: Size comparison from 02c0e3c to ea73b56 Increases (39 builds for cc13x2_26x2, cyw30739, efr32, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (6 builds for cc13x2_26x2)
Full report (39 builds for cc13x2_26x2, cyw30739, efr32, k32w, linux, mbed, nrfconnect, p6, telink)
|
PR #20082: Size comparison from 02c0e3c to 2296c91 Increases (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (6 builds for cc13x2_26x2)
Full report (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
andy31415
approved these changes
Jun 29, 2022
msandstedt
reviewed
Jun 29, 2022
PR #20082: Size comparison from b91727b to 5436b62 Increases (12 builds for cyw30739, k32w, linux, mbed, nrfconnect, telink)
Full report (12 builds for cyw30739, k32w, linux, mbed, nrfconnect, telink)
|
msandstedt
approved these changes
Jun 29, 2022
PR #20082: Size comparison from b91727b to 0c93070 Increases (30 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (6 builds for cc13x2_26x2)
Full report (30 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
woody-apple
approved these changes
Jun 29, 2022
PR #20082: Size comparison from 81c7f2a to bed37e1 Increases (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (6 builds for cc13x2_26x2)
Full report (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
tehampson
approved these changes
Jun 29, 2022
PR #20082: Size comparison from 81c7f2a to 443c31e Increases (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (39 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
Full report (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
for NXP HSM were used, which cannot work for multiple CASE
session establishments
or HW-backed keys, like can be done for operational keys
Issue #20036
Change overview
abstraction
in a way that now OperationalKeystore targeting NXP HSM could
do the right thing
Testing