Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-03 03:31:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(esp_tee): Add some required fields in the attestation token

Browse Source 
- Chip ID from the ROM
- Device MAC address from eFuse BLK1
- Device Optional Unique ID from eFuse BLK2
This commit is contained in:
Laukik Hase
2026-05-11 16:29:19 +05:30
parent cb4a55ace2
commit 4f3f1dff5a
6 changed files with 86 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_tee/subproject/components/attestation/esp_att_utils_json.c
+25 -1
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -174,8 +174,31 @@ esp_err_t esp_att_utils_eat_data_to_json(struct esp_att_sw_claim_list *head, con
free(auth_challenge_hexstr);
json_gen_obj_set_int(&json_gen, "client_id", cfg->client_id);
json_gen_obj_set_int(&json_gen, "chip_id", cfg->chip_id);
json_gen_obj_set_int(&json_gen, "device_ver", cfg->device_ver);
json_gen_push_object(&json_gen, "ueid");
char mac_hexstr[ESP_ATT_EAT_UEID_MAC_SZ * 2 + 1] = {0};
err = esp_att_utils_hexbuf_to_hexstr(cfg->ueid_mac, sizeof(cfg->ueid_mac),
mac_hexstr, sizeof(mac_hexstr));
if (err != ESP_OK) {
free(json_buf);
return err;
}
json_gen_obj_set_string(&json_gen, "mac", mac_hexstr);
char opt_id_hexstr[ESP_ATT_EAT_UEID_OPT_ID_SZ * 2 + 1] = {0};
err = esp_att_utils_hexbuf_to_hexstr(cfg->ueid_opt_id, sizeof(cfg->ueid_opt_id),
opt_id_hexstr, sizeof(opt_id_hexstr));
if (err != ESP_OK) {
free(json_buf);
return err;
}
json_gen_obj_set_string(&json_gen, "optional_id", opt_id_hexstr);
json_gen_pop_object(&json_gen);
char dev_id_hexstr[ESP_ATT_EAT_DEV_ID_SZ * 2 + 1] = {0};
err = esp_att_utils_hexbuf_to_hexstr(cfg->device_id, sizeof(cfg->device_id), dev_id_hexstr, sizeof(dev_id_hexstr));
if (err != ESP_OK) {
@@ -201,6 +224,7 @@ esp_err_t esp_att_utils_eat_data_to_json(struct esp_att_sw_claim_list *head, con
esp_err_t err = part_metadata_to_json(&claim->metadata, &claim_json);
if (err != ESP_OK || claim_json == NULL) {
ESP_LOGE(TAG, "Failed to format the FW metadata to JSON!");
free(json_buf);
return err;
}
components/esp_tee/subproject/components/attestation/esp_attestation.c
+25 -33
View File
@@ -48,44 +48,23 @@ static void free_sw_claim_list(void)
}
}
static esp_err_t fetch_device_id(uint8_t *devid_buf)
static esp_err_t fetch_ueids(esp_att_token_cfg_t *cfg)
{
if (devid_buf == NULL) {
return ESP_ERR_INVALID_ARG;
}
uint8_t mac_addr[6] = {0};
esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_MAC, mac_addr, sizeof(mac_addr) * 8);
/* UEID: raw eFuse MAC */
esp_err_t err = esp_efuse_read_field_blob(ESP_EFUSE_MAC, cfg->ueid_mac,
ESP_ATT_EAT_UEID_MAC_SZ * 8);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to read MAC from eFuse!");
goto exit;
return err;
}
psa_hash_operation_t hash_op = PSA_HASH_OPERATION_INIT;
psa_status_t status = psa_hash_setup(&hash_op, PSA_ALG_SHA_256);
if (status != PSA_SUCCESS) {
return ESP_FAIL;
}
status = psa_hash_update(&hash_op, mac_addr, sizeof(mac_addr));
if (status != PSA_SUCCESS) {
return ESP_FAIL;
}
size_t digest_len = 0;
status = psa_hash_finish(&hash_op, devid_buf, SHA256_DIGEST_SZ, &digest_len);
if (status != PSA_SUCCESS) {
return ESP_FAIL;
}
if (digest_len != SHA256_DIGEST_SZ) {
return ESP_ERR_INVALID_SIZE;
/* UEID: 128-bit OPTIONAL_UNIQUE_ID */
err = esp_efuse_read_field_blob(ESP_EFUSE_OPTIONAL_UNIQUE_ID, cfg->ueid_opt_id,
ESP_ATT_EAT_UEID_OPT_ID_SZ * 8);
if (err != ESP_OK) {
return err;
}
return ESP_OK;
exit:
return err;
}
static esp_err_t populate_att_token_cfg(esp_att_token_cfg_t *cfg, const esp_att_ecdsa_keypair_t *keypair)
@@ -94,18 +73,31 @@ static esp_err_t populate_att_token_cfg(esp_att_token_cfg_t *cfg, const esp_att_
return ESP_ERR_INVALID_ARG;
}
esp_err_t err = fetch_device_id(cfg->device_id);
esp_err_t err = fetch_ueids(cfg);
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to get the device ID!");
ESP_LOGE(TAG, "Failed to get the UEIDs!");
return err;
}
/* Device ID = SHA-256 of the MAC */
size_t digest_len = 0;
psa_status_t status = psa_hash_compute(PSA_ALG_SHA_256, cfg->ueid_mac, sizeof(cfg->ueid_mac),
cfg->device_id, sizeof(cfg->device_id), &digest_len);
if (status != PSA_SUCCESS || digest_len != sizeof(cfg->device_id)) {
ESP_LOGE(TAG, "Failed to derive the device ID!");
return ESP_FAIL;
}
err = esp_att_utils_ecdsa_get_pubkey_digest(keypair, cfg->instance_id, sizeof(cfg->instance_id));
if (err != ESP_OK) {
ESP_LOGE(TAG, "Failed to get ECDSA public key hash!");
return err;
}
/* Chip ID read from the ROM */
extern const uint32_t _rom_chip_id;
cfg->chip_id = _rom_chip_id;
/* Chip revision read from eFuse */
cfg->device_ver = efuse_hal_chip_revision();
/* TODO: Decide what all fields we need here */
cfg->device_stat = 0xA5;
components/esp_tee/subproject/components/attestation/private_include/esp_attestation_utils.h
+15 -10
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -37,8 +37,10 @@ extern "C" {
#define ESP_ATT_HDR_JSON_MAX_SZ (128)
#define ESP_ATT_EAT_DEV_ID_SZ (32)
#define ESP_ATT_EAT_UEID_MAC_SZ (6) /* eFuse MAC */
#define ESP_ATT_EAT_UEID_OPT_ID_SZ (16) /* eFuse OPTIONAL_UNIQUE_ID */
#define ESP_ATT_CLAIM_JSON_MAX_SZ (448)
#define ESP_ATT_EAT_JSON_MAX_SZ (1344)
#define ESP_ATT_EAT_JSON_MAX_SZ (1600)
#define ESP_ATT_PUBKEY_JSON_MAX_SZ (128)
#define ESP_ATT_SIGN_JSON_MAX_SZ (192)
@@ -119,14 +121,17 @@ typedef struct {
* @brief Structure to hold the Entity Attestation Token initial configuration
*/
typedef struct {
uint8_t *auth_challenge; /**< Authentication challenge */
size_t challenge_size; /**< Challenge size */
uint32_t client_id; /**< Client identifier (Attestation relying party) */
uint32_t device_ver; /**< Device version */
uint8_t device_id[SHA256_DIGEST_SZ]; /**< Device identifier */
uint8_t instance_id[SHA256_DIGEST_SZ]; /**< Instance identifier */
char psa_cert_ref[32]; /**< PSA certificate reference */
uint8_t device_stat; /**< Flags indicating device status */
uint8_t *auth_challenge; /**< Authentication challenge */
size_t challenge_size; /**< Challenge size */
uint32_t client_id; /**< Client identifier (Attestation relying party) */
uint32_t chip_id; /**< Chip identifier */
uint32_t device_ver; /**< Device version */
uint8_t ueid_mac[ESP_ATT_EAT_UEID_MAC_SZ]; /**< Device UEID: MAC from eFuse*/
uint8_t ueid_opt_id[ESP_ATT_EAT_UEID_OPT_ID_SZ]; /**< Device UEID: OPTIONAL_UNIQUE_ID from eFuse*/
uint8_t device_id[SHA256_DIGEST_SZ]; /**< Device identifier (SHA-256 of MAC) */
uint8_t instance_id[SHA256_DIGEST_SZ]; /**< Instance identifier */
char psa_cert_ref[32]; /**< PSA certificate reference */
uint8_t device_stat; /**< Flags indicating device status */
} esp_att_token_cfg_t;
/**