Changes to FMC Specification

Comparing version 2.0 to 1.2
+220 additions -147 deletions
@@ -1,8 +1,10 @@
11 <div style="font-size: 0.85em; color: #656d76; margin-bottom: 1em; padding: 0.5em; background: #f6f8fa; border-radius: 4px;">
2-📄 Source: <a href="https://github.com/chipsalliance/caliptra-sw/blob/e6e5db26702ee88d530d2789ac87749472a6641c/fmc/README.md" target="_blank">chipsalliance/caliptra-sw/fmc/README.md</a> @ <code>e6e5db2</code>
2+📄 Source: <a href="https://github.com/chipsalliance/caliptra-sw/blob/e56467181b5313e53cf6cdc92f705a4127480fc2/fmc/README.md" target="_blank">chipsalliance/caliptra-sw/fmc/README.md</a> @ <code>e564671</code>
33 </div>
44
5-# Caliptra - FMC Specification v1.0
5+# Caliptra - FMC Specification v2.0.1
6+
7+*Spec Version: 0.9*
68
79 ## Scope
810
@@ -106,37 +108,44 @@
106108 | fht_minor_ver | 2 | ROM, FMC | Minor version of FHT. Initially written by ROM but may be changed to a higher version by FMC. |
107109 | manifest_load_addr | 4 | ROM | Physical base address of Manifest in DCCM SRAM. |
108110 | fips_fw_load_addr_hdl | 4 | ROM | Handle of base address of FIPS Module in ROM or ICCM SRAM. May be 0xFF if there is no discrete module. |
109-| rt_fw_entry_point_hdl | 4 | ROM | Handle of entry point of Runtime FW Module value in data vault. SRAM. |
110-| fmc_tci_dv_hdl | 4 | ROM | Handle of FMC TCI value in the Data Vault. |
111111 | fmc_cdi_kv_hdl | 4 | ROM | Handle of FMC CDI value in the Key Vault. Value of 0xFF indicates not present. |
112-| fmc_priv_key_kv_hdl | 4 | ROM | Handle of FMC Private Alias Key in the Key Vault. |
113-| fmc_pub_key_x_dv_hdl | 4 | ROM | Handle of FMC Public Alias Key X Coordinate in the Data Vault. |
114-| fmc_pub_key_y_dv_hdl | 4 | ROM | Handle of FMC Public Alias Key Y Coordinate in the Data Vault |
115-| fmc_cert_sig_r_dv_hdl | 4 | ROM | Handle of FMC Certificate Signature R Component in the Data Vault. |
116-| fmc_cert_sig_s_dv_hdl | 4 | ROM | Handle of FMC Certificate Signature S Component in the Data Vault. |
117-| fmc_svn_dv_hdl | 4 | ROM | Handle of FMC SVN value in the Data Vault. |
118-| rt_tci_dv_hdl | 4 | ROM | Handle of RT TCI value in the Data Vault. |
112+| fmc_priv_key_ecdsa_kv_hdl | 4 | ROM | Handle of FMC Alias ECDSA Private Key in the Key Vault. |
113+| fmc_keypair_seed_mldsa_kv_hdl | 4 | ROM | Handle of FMC Alias MLDSA Key Pair Generation Seed in the Key Vault. |
114+| fmc_pub_key_ecdsa_x_dv_hdl | 4 | ROM | Handle of FMC Alias ECDSA Public Key X Coordinate in the DCCM datavault. |
115+| fmc_pub_key_ecdsa_y_dv_hdl | 4 | ROM | Handle of FMC Alias ECDSA Public Key Y Coordinate in the DCCM datavault. |
116+| fmc_pub_key_mldsa_dv_hdl | 4 | ROM | Handle of FMC Alias MLDSA Public Key in the DCCM datavault. |
117+| fmc_cert_sig_ecdsa_r_dv_hdl | 4 | ROM | Handle of FMC Certificate ECDSA Signature R Component in the DCCM datavault. |
118+| fmc_cert_sig_ecdsa_s_dv_hdl | 4 | ROM | Handle of FMC Certificate ECDSA Signature S Component in the DCCM datavault. |
119+| fmc_cert_sig_mldsa_dv_hdl | 4 | ROM | Handle of FMC Certificate MLDSA Signature in the DCCM datavault. |
119120 | rt_cdi_kv_hdl | 4 | FMC | Handle of RT CDI value in the Key Vault. |
120-| rt_priv_key_kv_hdl | 4 | FMC | Handle of RT Private Alias Key in the Key Vault. |
121-| rt_svn_dv_hdl | 4 | FMC | Handle of RT SVN value in the Data Vault. |
122-| rt_min_svn_dv_hdl | 4 | FMC | Handle of Min RT SVN value in the Data Vault. |
123-| ldevid_tbs_addr | 4 | ROM | Local Device ID TBS Address. |
124-| fmcalias_tbs_addr | 4 | ROM | FMC Alias TBS Address. |
125-| ldevid_tbs_size | 2 | ROM | Local Device ID TBS Size. |
126-| fmcalias_tbs_size | 2 | ROM | FMC Alias TBS Size. |
121+| rt_priv_key_ecdsa_kv_hdl | 4 | FMC | Handle of RT Alias ECDSA Private Key in the Key Vault. |
122+| rt_keygen_seed_mldsa_kv_hdl | 4 | FMC | Handle of RT Alias MLDSA Key Generation Seed in the Key Vault. |
123+| ldevid_tbs_ecdsa_addr | 4 | ROM | Local Device ID ECDSA TBS Address. |
124+| fmcalias_tbs_ecdsa_addr | 4 | ROM | FMC Alias TBS ECDSA Address. |
125+| ldevid_tbs_mldsa_addr | 4 | ROM | Local Device ID MLDSA TBS Address. |
126+| fmcalias_tbs_mldsa_addr | 4 | ROM | FMC Alias TBS MLDSA Address. |
127+| ldevid_tbs_ecdsa_size | 2 | ROM | Local Device ID ECDSA TBS Size. |
128+| fmcalias_tbs_ecdsa_size | 2 | ROM | FMC Alias TBS ECDSA Size. |
129+| ldevid_tbs_mldsa_size | 2 | ROM | Local Device ID MLDSA TBS Size. |
130+| fmcalias_tbs_mldsa_size | 2 | ROM | FMC Alias TBS MLDSA Size. |
127131 | pcr_log_addr | 4 | ROM | PCR Log Address. |
128132 | pcr_log_index | 4 | ROM | Last empty PCR log entry slot index. |
129133 | meas_log_addr | 4 | ROM | Measurement Log Address. |
130134 | meas_log_index | 4 | ROM | Last empty Measurement log entry slot index. |
131135 | fuse_log_addr | 4 | ROM | Fuse Log Address. |
132-| rt_dice_pub_key | 96 | FMC | RT Alias DICE Public Key. |
133-| rt_dice_sign | 96 | FMC | RT Alias DICE signature. |
134-| ldevid_cert_sig_r_dv_hdl | 4 | ROM | Handle of LDevId Certificate Signature R Component in the Data Vault. |
135-| ldevid_cert_sig_s_dv_hdl | 4 | ROM | Handle of LDevId Certificate Signature S Component in the Data Vault. |
136-| idev_dice_pub_key | 96 | ROM | Initial Device ID Public Key. |
137-| rom_info_addr | 4 | ROM | Address of ROMInfo struct describing the ROM digest and git commit. |
138-| rtalias_tbs_size | 2 | FMC | RT Alias TBS Size. |
139-| reserved | 1650 || Reserved for future use. |
136+| rt_dice_pub_key_ecdsa | 96 | FMC | RT Alias DICE ECDSA Public Key. |
137+| rt_dice_pub_key_mldsa_dv_hdl | 4 | FMC | RT Alias DICE MLDSA Public Key in the DCCM datavault. |
138+| rt_dice_sign_ecdsa | 96 | FMC | RT Alias DICE ECDSA signature. |
139+| rt_dice_sign_mldsa_dv_hdl | 4 | FMC | RT Alias DICE MLDSA signature in the DCCM datavault. |
140+| ldevid_cert_sig_ecdsa_r_dv_hdl | 4 | ROM | Handle of LDevId Certificate ECDSA Signature R Component in the DCCM datavault. |
141+| ldevid_cert_sig_ecdsa_s_dv_hdl | 4 | ROM | Handle of LDevId Certificate ECDSA Signature S Component in the DCCM datavault. |
142+| ldevid_cert_sig_mldsa_dv_hdl | 4 | ROM | Handle of LDevId Certificate MLDSA Signature in the DCCM datavault. |
143+| idev_dice_pub_key_ecdsa | 96 | ROM | Initial Device ID ECDSA Public Key. |
144+| idev_dice_pub_key_mldsa_dv_hdl | 4 | ROM | Initial Device ID MLDSA Public Key in the DCCM datavault. |
145+| rom_info_addr | 4 | ROM | Address of ROM Info struct describing the ROM digest and git commit. |
146+| rtalias_tbs_ecdsa_size | 2 | FMC | RT Alias ECDSA TBS Size. |
147+| rtalias_tbs_mldsa_size | 2 | FMC | RT Alias MLDSA TBS Size. |
148+| reserved | 1588 || Reserved for future use. |
140149
141150
142151 *FHT is currently defined to be 2048 bytes in length.*
@@ -167,69 +176,77 @@
167176 discrete FIPS module does not exist, then this field shall be 0xFF and ROM, FMC, and RT FW must all carry their own code for accessing crypto resources and
168177 keys.
169178
170-### rt_fw_entry_point_hdl
171-
172-This field provides the Handle of the DV entry that stores the physical address of the Entry Point of Runtime FW Module in ICCM SRAM.
173-
174-### fmc_tci_dv_hdl
175-
176-This field provides the Handle into the Data Vault where the TCI<sub>FMC</sub> is stored. TCI<sub>FMC</sub> is a SHA-384 Hash of the FMC Module.
177-
178179 ### fmc_cdi_kv_hdl
179180
180181 This field provides the Handle into the Key Vault where the CDI<sub>FMC</sub> is stored.
181182
182-### fmc_priv_key_kv_hdl
183-
184-This field provides the Handle into the Key Vault where the PrivateKey<sub>FMC</sub> is stored.
185-
186-### fmc_pub_key_x_dv_hdl, fmc_pub_key_y_dv_hdl
187-
188-These fields provide the indices into the Data Vault where the PublicKey<sub>FMC</sub> X and Y coordinates are stored.
189-
190-### fmc_cert_sig_r_dv_hdl, fmc_cert_sig_s_dv_hdl
191-
192-These fields provide the indices into the Data Vault where the Signature<sub>FMC</sub> R and S coordinates are stored.
193-
194-### fmc_svn_dv_hdl
195-
196-This field provides the Handle into the Data Vault where the SVN<sub>FMC</sub> is stored.
197-
198-### rt_tci_dv_hdl
199-
200-This field provides the Handle into the Data Vault where the TCI<sub>RT</sub> is stored. TCI<sub>RT</sub> is a SHA-384 Hash of the RT FW Module.
183+### fmc_priv_key_ecdsa_kv_hdl
184+
185+This field provides the Handle into the Key Vault where the ECDSA PrivateKey<sub>FMC</sub> is stored.
186+
187+### fmc_keypair_seed_mldsa_kv_hdl
188+
189+This field provides the Handle into the Key Vault where the MLDSA Key Generation Seed<sub>FMC</sub> is stored.
190+
191+### fmc_pub_key_ecdsa_x_dv_hdl, fmc_pub_key_ecdsa_y_dv_hdl
192+
193+These fields provide the Handle into the DCCM datavault where the ECDSA PublicKey<sub>FMC</sub> X and Y coordinates are stored.
194+
195+### fmc_pub_key_mldsa_dv_hdl
196+
197+This field provides the Handle into the DCCM datavault where the MLDSA PublicKey<sub>FMC</sub> is stored.
198+
199+### fmc_cert_sig_ecdsa_r_dv_hdl, fmc_cert_sig_ecdsa_s_dv_hdl
200+
201+These fields provide the Handle into the DCCM datavault where the ECDSA Signature<sub>FMC</sub> R and S coordinates are stored.
202+
203+### fmc_cert_sig_mldsa_dv_hdl
204+
205+This field provides the Handle into the DCCM datavault where the MLDSA Signature<sub>FMC</sub> is stored.
201206
202207 ### rt_cdi_kv_hdl
203208
204209 This field provides the Handle into the Key Vault where the CDI<sub>RT</sub> is stored.
205210
206-### rt_priv_key_kv_hdl
207-
208-This field provides the Handle into the Key Vault where the PrivateKey<sub>RT</sub> is stored.
209-
210-### rt_svn_dv_hdl
211-
212-This field provides the Handle into the Data Vault where the SVN<sub>RT</sub> is stored.
213-
214-### rt_min_svn_dv_hdl
215-
216-This field provides the Handle into the Data Vault where the Min-SVN<sub>RT</sub> is stored. Upon cold-boot this is set to SVN<sub>RT</sub>. On subsequent boots this is set to MIN(SVN<sub>RT</sub>, Min-SVN<sub>RT</sub>).
217-
218-### ldevid_tbs_addr
219-
220-This field provides the address of the *To Be Signed* portion of the LDevID certificate.
221-
222-### fmcalias_tbs_addr
223-
224-This field provides the address of the *To Be Signed* portion of the FMC Alias certificate.
225-
226-### ldevid_tbs_size
227-
228-This field provides the size of the *To Be Signed* portion of the LDevID certificate.
229-
230-### fmcalias_tbs_size
231-
232-This field provides the size of the *To Be Signed* portion of the FMC Alias certificate.
211+### rt_priv_key_ecdsa_kv_hdl
212+
213+This field provides the Handle into the Key Vault where the ECDSA PrivateKey<sub>RT</sub> is stored.
214+
215+### rt_keygen_seed_mldsa_kv_hdl
216+
217+This field provides the Handle into the Key Vault where the MLDSA Key Generation Seed<sub>RT</sub> is stored.
218+
219+### ldevid_tbs_ecdsa_addr
220+
221+This field provides the address of the *To Be Signed* portion of the LDevID ECDSA certificate.
222+
223+### fmcalias_tbs_ecdsa_addr
224+
225+This field provides the address of the *To Be Signed* portion of the FMC Alias ECDSA certificate.
226+
227+### ldevid_tbs_mldsa_addr
228+
229+This field provides the address of the *To Be Signed* portion of the LDevID MLDSA certificate.
230+
231+### fmcalias_tbs_mldsa_addr
232+
233+This field provides the address of the *To Be Signed* portion of the FMC Alias MLDSA certificate.
234+
235+### ldevid_tbs_ecdsa_size
236+
237+This field provides the size of the *To Be Signed* portion of the LDevID ECDSA certificate.
238+
239+### fmcalias_tbs_ecdsa_size
240+
241+This field provides the size of the *To Be Signed* portion of the FMC Alias ECDSA certificate.
242+
243+### ldevid_tbs_mldsa_size
244+
245+This field provides the size of the *To Be Signed* portion of the LDevID MLDSA certificate.
246+
247+### fmcalias_tbs_mldsa_size
248+
249+This field provides the size of the *To Be Signed* portion of the FMC Alias MLDSA certificate.
233250
234251 ### pcr_log_addr
235252
@@ -251,38 +268,58 @@
251268
252269 This field provides the address of the Fuse Log
253270
254-### rt_dice_pub_key
255-
256-This field provides the Runtime Alias Public Key.
257-
258-### rt_dice_sign
259-
260-This field provides the Runtime Alias certificate signature.
261-
262-### ldevid_cert_sig_r_dv_hdl, ldevid_cert_sig_s_dv_hdl
263-
264-These fields provide the indices into the Data Vault where the Signature<sub>LDevId</sub> R and S coordinates are stored.
265-
266-### idev_dice_pub_key
267-
268-This field provides the IDevID Public Key.
271+### rt_dice_pub_key_ecdsa
272+
273+This field provides the Runtime Alias ECDSA Public Key.
274+
275+### rt_dice_pub_key_mldsa_dv_hdl
276+
277+This field provides the Handle into the DCCM datavault where the Runtime Alias MLDSA Public Key is stored.
278+
279+### rt_dice_sign_ecdsa
280+
281+This field provides the Runtime Alias certificate ECDSA signature.
282+
283+### rt_dice_sign_mldsa_dv_hdl
284+
285+This field provides the Handle into the DCCM datavault where the Runtime Alias certificate MLDSA signature is stored.
286+
287+### ldevid_cert_sig_ecdsa_r_dv_hdl, ldevid_cert_sig_ecdsa_s_dv_hdl
288+
289+These fields provide the Handle into the DCCM datavault where the ECDSA Signature<sub>LDevId</sub> R and S coordinates are stored.
290+
291+### ldevid_cert_sig_mldsa_dv_hdl
292+
293+This field provides the Handle into the DCCM datavault where the MLDSA Signature<sub>LDevId</sub> is stored.
294+
295+### idev_dice_pub_key_ecdsa
296+
297+This field provides the ECDSA IDevID Public Key.
298+
299+### idev_dice_pub_key_mldsa_dv_hdl
300+
301+This field provides the Handle into the DCCM datavault where the MLDSA IDevID Public Key is stored.
269302
270303 ### rom_info_addr
271304
272305 This field provides the address of the RomInfo structure.
273306
274-### rtalias_tbs_size
275-
276-This field provides the size of the *To Be Signed* portion of the Runtime Alias certificate.
277-
278-### rt_hash_chain_max_svn
279-
280-This field informs firmware of the maximum RT SVN, which value was used
281-to determine the length of RT FW's hash chain.
282-
283-### rt_hash_chain_kv_hdl
284-
285-This field provides the Handle into the Key Vault where RT's hash chain is stored.
307+### rtalias_tbs_ecdsa_size
308+
309+This field provides the size of the *To Be Signed* portion of the Runtime Alias ECDSA certificate.
310+
311+### rtalias_tbs_mldsa_size
312+
313+This field provides the size of the *To Be Signed* portion of the Runtime Alias MLDSA certificate.
314+
315+### fw_key_ladder_max_svn
316+
317+This field informs firmware of the maximum FW SVN, which value was used
318+to determine the length of FW's key ladder.
319+
320+### fw_key_ladder_kv_hdl
321+
322+This field provides the Handle into the Key Vault where FW's key ladder is stored.
286323
287324 ### reserved
288325
@@ -305,21 +342,22 @@
305342 1. FMC locates the discrete FW-based FIPS Crypto Module in ICCM using fht.fips_fw_base_addr (if not 0xFFFF_FFFF) and calls its initialization routine. Otherwise FMC
306343 utilizes the ROM-based FIPS Crypto Module or its own internal FIPS Crypto services in implementations without a discrete FW-based FIPS Crypto Module.
307344 1. FMC locates the Manifest at fht.manifest_load_addr.
308-1. FMC reads the measurement of the Runtime FW Module, TCI<sub>RT</sub>, from the Data Vault that has previously been validated by ROM.
345+1. FMC reads the measurement of the Runtime FW Module, TCI<sub>RT</sub>, from the DCCM datavault that has previously been validated by ROM.
309346 1. FMC reads the manifest address of the Image Bundle from the HandOff Table, and calculates the SHA-384 TCI<sub>MAN</sub>
310347 1. FMC clears Current PCR
311348 1. FMC extends Current and Journey PCR registers with TCI<sub>RT</sub>.
312349 1. FMC extends Current and Journey PCR registers with TCI<sub>MAN</sub>.
313350 1. FMC locks Current and Journey PCR registers.
314351 1. FMC derives CDI<sub>RT</sub> from CDI<sub>FMC</sub> mixed with TCI<sub>RT</sub> and TCI<sub>MAN</sub>, then stores it in the Key Vault.
315-1. FMC updates fht.rt_cdi_kv_hdl in the FHT.
316-1. FMC derives AliasKeyPair<sub>RT</sub> from CDI<sub>RT</sub>. The Private Key is stored in the Key Vault while the Public Key X and Y coordinates are stored
317- in the Data Vault.
318-1. FMC updates fht.rt_priv_key_kv_hdl, fht.rt_pub_key_x_dv_hdl, and fht.rt_pub_key_y_dv_hdl in the FHT.
319-1. FMC generates an x509 certificate with PubKey<sub>RT</sub> as the subject and signed by PrivKey<sub>FMC</sub>.
320-1. FMC stores the Cert<sub>RT</sub> signature in the Data Vault.
321-1. FMC updates fht.rt_cert_sig_r_dv_hdl and fht.rt_cert_sig_r_dv_hdl in the FHT.
322-1. FMC ensures that CDI<sub>FMC</sub> and PrivateKey<sub>FMC</sub> are locked to block further usage until the next boot.
352+1. FMC updates fht.rt_cdi_ecdsa_kv_hdl and fht.rt_cdi_mldsa_kv_hdl in the FHT.
353+1. FMC derives ECDSA and MLDSA AliasKeyPair<sub>RT</sub> from CDI<sub>RT</sub>. The ECDSA Private Key and the MLDSA Key Generation Seed are stored in the Key Vault, while the ECDSA Public Key X and Y coordinates and MLDSA Public Key are stored in the DCCM datavault.
354+1. FMC updates fht.rt_priv_key_ecdsa_kv_hdl, fht.rt_pub_key_ecdsa_x_dv_hdl, and fht.rt_pub_key_ecdsa_y_dv_hdl in the FHT.
355+1. FMC updates fht.rt_keypair_seed_mldsa_kv_hdl and fht.rt_pub_key_mldsa_dv_hdl in the FHT.
356+1. FMC generates ECDSA and MLDSA x509 certificates with ECDSA and MLDSA PubKeys<sub>RT</sub> as the subject and signed by PrivKeys<sub>FMC</sub>.
357+1. FMC stores the ECDSA and MLDSA Cert<sub>RT</sub> signatures in the DCCM datavault.
358+1. FMC updates fht.rt_cert_sig_ecdsa_r_dv_hdl and fht.rt_cert_sig_ecdsa_s_dv_hdl in the FHT.
359+1. FMC updates fht.rt_cert_sig_mldsa_dv_hdl in the FHT.
360+1. FMC ensures that CDI<sub>FMC</sub>, ECDSA PrivateKey<sub>FMC</sub> and MLDSA KeyPair Generation Seed<sub>FMC</sub> are locked to block further usage until the next boot.
323361 1. FMC locates the Runtime FW Module in ICCM at fht.rt_fw_load_addr.
324362 1. FMC jumps to the Runtime FW Module entry point at fht.rt_fw_entry_point.
325363
@@ -327,18 +365,32 @@
327365
328366 - Vault state as follows:
329367
330-| Slot | Key Vault | PCR Bank | Data Vault 48 Byte (Sticky) | Data Vault 4 Byte (Sticky) |
331-| ------ | ----------- | ---------- | ----------------------------- | ---------------------------- |
332-| 0 ||| 🔒LDevID Pub Key X | 🔒FMC SVN |
333-| 1 ||| 🔒LDevID Pub Key Y | 🔒Manufacturer Public Key Index |
334-| 2 ||| 🔒LDevID Cert Signature R |
335-| 3 ||| 🔒LDevID Cert Signature S |
336-| 4 ||| 🔒Alias FMC Pub Key X |
337-| 5 ||| 🔒Alias FMC Pub Key Y |
338-| 6 | Alias FMC CDI (48 bytes) || 🔒Alias FMC Cert Signature R |
339-| 7 | Alias FMC Private Key (48 bytes) || 🔒Alias FMC Cert Signature S |
340-| 8 ||| 🔒FMC Digest |
341-| 9 ||| 🔒Owner PK Hash |
368+| Slot | Key Vault |
369+| ------ | -------------------------------------------- |
370+| 6 | Alias FMC CDI (64 bytes) |
371+| 7 | Alias FMC Private Key - ECDSA (48 bytes) |
372+| 8 | Alias FMC Key Pair Seed - MLDSA (32 bytes) |
373+
374+
375+| DCCM datavault |
376+| ----------------------------------- |
377+| 🔒LDevID ECDSA Pub Key X |
378+| 🔒LDevID ECDSA Pub Key Y |
379+| 🔒LDevID MLDSA Pub Key |
380+| 🔒LDevID Cert ECDSA Signature R |
381+| 🔒LDevID Cert ECDSA Signature S |
382+| 🔒LDevID Cert MLDSA Signature |
383+| 🔒Alias FMC ECDSA Pub Key X |
384+| 🔒Alias FMC ECDSA Pub Key Y |
385+| 🔒Alias FMC MLDSA Pub Key |
386+| 🔒Alias FMC Cert Signature R |
387+| 🔒Alias FMC Cert Signature S |
388+| 🔒Alias FMC Cert MLDSA Signature |
389+| 🔒FMC Digest |
390+| 🔒FW SVN |
391+| 🔒Owner PK Hash |
392+| 🔒Manufacturer Public Key Index |
393+
342394
343395
344396 <center>
@@ -362,7 +414,7 @@
362414 FMC->>+FIPS: InitFipsFw() (if needed)
363415 FIPS-->>-FMC: return()
364416 FMC->>FMC: LocateManifest(fht)
365- FMC->>FMC: GetRtMeasurement(fht.rt_tci_dv_hdl)
417+ FMC->>FMC: GetRtMeasurement(data_vault.rt_tci)
366418
367419 rect rgba(0, 100, 200, .2)
368420
@@ -382,15 +434,20 @@
382434 rect rgba(0, 0, 200, .2)
383435 note over FIPS, FMC: DICE-related derivations will be<br> defined in greater detail later
384436
385- FMC->>+FIPS: DeriveCdi(fht.FmcCdiKvhdl, "rt_alias_cdi", RtTci)
437+ FMC->>+FIPS: DeriveCdi(fht.fmc_cdi_kv_hdl, "alias_rt_cdi", RtTci)
386438 FIPS-->>-FMC: return(fht.rt_cdi_kv_hdl)
387- FMC->>+FIPS: DeriveKeyPair(fht.rt_cdi_kv_hdl, "rt_alias_keygen")
388- FIPS-->>-FMC: return(fht.rt_priv_key_kv_hdl,<br> fht.rt_pub_key_x_dv_hdl,<br> fht.rt_pub_key_y_dv_hdl)
389- FMC->>+FIPS: CertifyKey(fht.rt_pub_key_x_dv_hdl,<br> fht.rt_pub_key_y_dv_hdl,<br> fht.fmc_priv_key_kv_hdl)
390- FIPS-->>-FMC: return(fht.rt_cert_sig_r_dv_hdl, fht.rt_cert_sig_s_dv_hdl)
439+ FMC->>+FIPS: DeriveKeyPair(fht.rt_cdi_kv_hdl, "alias_rt_ecc_key")
440+ FIPS-->>-FMC: return(fht.rt_priv_key_ecdsa_kv_hdl,<br> fht.rt_pub_key_ecdsa_x_dv_hdl,<br> fht.rt_pub_key_ecdsa_y_dv_hdl)
441+ FMC->>+FIPS: CertifyKey(fht.rt_pub_key_ecdsa_x_dv_hdl,<br> fht.rt_pub_key_ecdsa_y_dv_hdl,<br> fht.fmc_priv_key_ecdsa_kv_hdl)
442+ FIPS-->>-FMC: return(fht.rt_cert_sig_ecdsa_r_dv_hdl, fht.rt_cert_sig_ecdsa_s_dv_hdl)
443+ FMC->>+FIPS: DeriveKeyPair(fht.rt_cdi_kv_hdl, "alias_rt_mldsa_key")
444+ FIPS-->>-FMC: return(fht.rt_mldsa_seed_kv_hdl,<br> fht.rt_pub_key_mldsa_dv_hdl)
445+ FMC->>+FIPS: CertifyKey(fht.rt_pub_key_mldsa_dv_hdl,<br> fht.fmc_seed_mldsa_kv_hdl)
446+ FIPS-->>-FMC: return(fht.rt_cert_sig_mldsa_dv_hdl)
391447 FMC->>+FIPS: LockKey(fht.fmc_cdi_kv_hdl)
392448 FIPS-->>-FMC: return()
393- FMC->>+FIPS: LockKey(fht.fmc_priv_key_kv_hdl)
449+ FMC->>+FIPS: LockKey(fht.fmc_priv_key_ecdsa_kv_hdl)
450+ FMC->>+FIPS: LockKey(fht.fmc_seed_mldsa_kv_hdl)
394451 FIPS-->>-FMC: return()
395452
396453 end %% rect
@@ -409,18 +466,34 @@
409466
410467 - Vault state as follows:
411468
412-| Slot | Key Vault | PCR Bank | Data Vault 48 Byte (Sticky) | Data Vault 4 Byte (Sticky) |
413-| ------ | ----------- | ---------- | ----------------------------- | ---------------------------- |
414-| 0 ||| 🔒LDevID Pub Key X | 🔒FMC SVN |
415-| 1 ||| 🔒LDevID Pub Key Y | 🔒Manufacturer Public Key Index |
416-| 2 ||| 🔒LDevID Cert Signature R |
417-| 3 ||| 🔒LDevID Cert Signature S |
418-| 4 | Alias RT CDI (48 bytes) || 🔒Alias FMC Pub Key X |
419-| 5 | Alias RT Private Key (48 bytes) || 🔒Alias FMC Pub Key Y |
420-| 6 | Alias FMC CDI (48 bytes) || 🔒Alias FMC Cert Signature R |
421-| 7 | Alias FMC Private Key (48 bytes) || 🔒Alias FMC Cert Signature S |
422-| 8 ||| 🔒FMC Digest |
423-| 9 ||| 🔒Owner PK Hash |
469+| Slot | Key Vault |
470+| ------ | -------------------------------------------- |
471+| 4 | Alias RT CDI (64 bytes) |
472+| 5 | Alias RT Private Key (48 bytes) |
473+| 6 | Alias FMC CDI (64 bytes) |
474+| 7 | Alias FMC Private Key (48 bytes) |
475+| 8 | Alias FMC Key Pair Seed - MLDSA (32 bytes) |
476+| 9 | Alias RT Key Pair Seed - MLDSA (32 bytes) |
477+
478+
479+| DCCM datavault |
480+| ------------------------------------- |
481+| 🔒LDevID ECDSA Pub Key X |
482+| 🔒LDevID ECDSA Pub Key Y |
483+| 🔒LDevID MLDSA Pub Key |
484+| 🔒LDevID Cert ECDA Signature R |
485+| 🔒LDevID Cert ECDSA Signature S |
486+| 🔒LDevID Cert MLDSA Signature |
487+| 🔒Alias FMC ECDSA Pub Key X |
488+| 🔒Alias FMC ECDSA Pub Key Y |
489+| 🔒Alias FMC MLDSA Pub Key |
490+| 🔒Alias FMC Cert ECDSA Signature R |
491+| 🔒Alias FMC Cert ECDSA Signature S |
492+| 🔒Alias FMC Cert MLDSA Signature |
493+| 🔒FMC Digest |
494+| 🔒FW SVN |
495+| 🔒Owner PK Hash |
496+| 🔒Manufacturer Public Key Index |
424497
425498
426499 ## Resets