Skip to content

Combine PRK and IDK_S generation VTL calls - #1130

Open
Angelina Vu (athvu) wants to merge 4 commits into
mainfrom
avu/keys
Open

Combine PRK and IDK_S generation VTL calls#1130
Angelina Vu (athvu) wants to merge 4 commits into
mainfrom
avu/keys

Conversation

@athvu

Copy link
Copy Markdown
Contributor

No description provided.

@athvu
Angelina Vu (athvu) force-pushed the avu/keys branch 2 times, most recently from cdef9e4 to e06c50f Compare August 6, 2026 20:33
@athvu
Angelina Vu (athvu) force-pushed the avu/keys branch 2 times, most recently from b60829c to 56260e3 Compare August 13, 2026 22:24
@athvu
Angelina Vu (athvu) marked this pull request as ready for review August 13, 2026 22:34

@sangho2 Sangho Lee (sangho2) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Angelina,

Thank you for your effort! I have one recommendation: rather than modifying the fill_bytes_crng interface in the litebox crate, could you install a trusted seed throughVtl1Gate (e.g., set a new global var) and use that seed in LVBS's fill_bytes_crng implementation? As you already observed, the litebox crate is a shared common interface/abstraction. any changes of it affect many other subsystems, such that we require strong justification.

Comment thread litebox_runner_lvbs/src/lib.rs Outdated
Comment thread litebox_runner_lvbs/src/lib.rs Outdated
Comment thread litebox_shim_optee/src/idk.rs Outdated
Angelina Vu added 3 commits August 24, 2026 16:46
Signed-off-by: Angelina Vu <angelinavu@microsoft.com>
…neration.

Signed-off-by: Angelina Vu <angelinavu@microsoft.com>
Undo changes to fill_bytes_crng interface
Set trusted seed through Vtl1Gate to use in LVBS fill_bytes_crng implementation

Signed-off-by: Angelina Vu <angelinavu@microsoft.com>
Signed-off-by: Angelina Vu <angelinavu@microsoft.com>
@github-actions

Copy link
Copy Markdown

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details
--- failure enum_variant_added: enum variant added on exhaustive enum ---

Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/enum_variant_added.ron

Failed in:
  variant VsmFunction:ExchangeSecrets in /home/runner/work/litebox/litebox/litebox_common_lvbs/src/lib.rs:79

--- failure enum_variant_missing: pub enum variant removed or renamed ---

Description:
A publicly-visible enum has at least one variant that is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/enum_variant_missing.ron

Failed in:
  variant VsmFunction::SetPlatformRootKey, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6e21ee1f8110d60a251b3057c5092d1ec6161a18/litebox_common_lvbs/src/lib.rs:79
  variant VsmFunction::GenerateIdentitySigningKey, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6e21ee1f8110d60a251b3057c5092d1ec6161a18/litebox_common_lvbs/src/lib.rs:80

--- failure pub_module_level_const_missing: pub module-level const is missing ---

Description:
A public const is missing or renamed
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/pub_module_level_const_missing.ron

Failed in:
  VSM_VTL_CALL_FUNC_ID_GENERATE_IDENTITY_SIGNING_KEY in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6e21ee1f8110d60a251b3057c5092d1ec6161a18/litebox_common_lvbs/src/lib.rs:55
  VSM_VTL_CALL_FUNC_ID_SET_PLATFORM_ROOT_KEY in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/6e21ee1f8110d60a251b3057c5092d1ec6161a18/litebox_common_lvbs/src/lib.rs:52

--- failure trait_method_added: pub trait method added ---

Description:
A non-sealed public trait added a new method without a default implementation, which breaks downstream implementations of the trait
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/trait_method_added.ron

Failed in:
  trait method litebox_common_lvbs::Vtl1Gate::set_crng_seed in file /home/runner/work/litebox/litebox/litebox_common_lvbs/src/lib.rs:973

@sangho2 Sangho Lee (sangho2) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall, looks good to me. I left some comments and suggestion.

}

fn crng_seed_from_prk_and_rdrand(prk: &[u8; PRK_LEN], rdrand_seed: CrngSeed) -> CrngSeed {
fn crng_seed_from_tpm_and_rdrand(seed: &[u8], rdrand_seed: CrngSeed) -> CrngSeed {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tpm -> rot/hrot?

It'd be better to use &[u8; CRNG_SEED_LEN].

}
VsmFunction::ExchangeSecrets => vtl1
.set_platform_root_key(params[0])
.and_then(|()| vtl1.set_crng_seed(params[0] + PRK_LEN as u64))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nits: let's use checked_add to catch integer overflow.


impl LvbsCrng {
fn new(prk: &[u8; PRK_LEN], rdrand_seed: CrngSeed) -> Self {
fn new(seed: &[u8], rdrand_seed: CrngSeed) -> Self {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seed: &[u8; CRNG_SEED_LEN] would be better.

}
VsmFunction::ExchangeSecrets => vtl1
.set_platform_root_key(params[0])
.and_then(|()| vtl1.set_crng_seed(params[0] + PRK_LEN as u64))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This depends on the ABI, but, at least for now, separating set_platform_root_key and set_crng_seed is a bit bad for performance and atomicity (redundant page mapping/copying and potential partial failure). That is, we can copy 64 bytes at once, rather than copy two 32 bytes in order. Anyway, it depends on VTL0-side argument passing, so it's up to you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants