wolfBoot DICE attestation with wolfCOSE

.github/workflows/test-external-library-paths.yml

@@ -89,4 +89,5 @@ jobs:
             WOLFBOOT_LIB_WOLFPKCS11="$(realpath ../external-libs/wolfPKCS11)" \
             WOLFBOOT_LIB_WOLFPSA="$(realpath ../external-libs/wolfPSA)" \
             WOLFBOOT_LIB_WOLFTPM="$(realpath ../external-libs/wolfTPM)" \
-            WOLFBOOT_LIB_WOLFHSM="$(realpath ../external-libs/wolfHSM)"
+            WOLFBOOT_LIB_WOLFHSM="$(realpath ../external-libs/wolfHSM)" \
+            WOLFBOOT_LIB_WOLFCOSE="$(realpath ../external-libs/wolfCOSE)"

.github/workflows/trustzone-emulator-tests.yml

@@ -101,10 +101,16 @@ jobs:
 
       - name: Clean and build test with DICE attestation (stm32h5)
         run: |
+          set -o pipefail
           make clean distclean
           cp config/examples/stm32h5-tz-psa.config .config
           make
-          m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600
+          m33mu wolfboot.bin test-app/image_v1_signed.bin:0x60000 --uart-stdout --expect-bkpt 0x7f --timeout 600 \
+            | tee /tmp/m33mu-dice.log
+          grep -q "IAT size match: challenge=64 token=" /tmp/m33mu-dice.log
+          grep -q "PSA boot attestation: success" /tmp/m33mu-dice.log
+          grep -q "\\[BKPT\\] imm=0x7f" /tmp/m33mu-dice.log
+          grep -q "\\[EXPECT BKPT\\] Success" /tmp/m33mu-dice.log
 
       - name: Clean and build test with fwTPM (stm32h5)
         run: |

.gitmodules

@@ -16,3 +16,6 @@
 [submodule "lib/wolfHAL"]
 	path = lib/wolfHAL
 	url = https://github.com/wolfSSL/wolfHAL.git
+[submodule "lib/wolfCOSE"]
+	path = lib/wolfCOSE
+	url = https://github.com/wolfSSL/wolfCOSE.git

CMakeLists.txt

@@ -566,6 +566,10 @@ endif()
 
 if(DEFINED WOLFCRYPT_TZ_PSA AND NOT WOLFCRYPT_TZ_PSA STREQUAL "0")
     list(APPEND WOLFBOOT_SOURCES "src/dice/dice.c")
+    list(APPEND WOLFBOOT_SOURCES "lib/wolfCOSE/src/wolfcose.c")
+    list(APPEND WOLFBOOT_SOURCES "lib/wolfCOSE/src/wolfcose_cbor.c")
+    list(APPEND WOLFBOOT_INCLUDE_DIRS ${WOLFBOOT_ROOT}/lib/wolfCOSE/include)
+    list(APPEND WOLFBOOT_DEFS WOLFCOSE_LEAN WOLFCOSE_ENABLE_EXT_SIGN)
 endif()
 
 # build bin-assemble tool Windows

Makefile

@@ -179,20 +179,23 @@ WOLFBOOT_LIB_WOLFTPM?=lib/wolfTPM
 WOLFBOOT_LIB_WOLFPKCS11?=lib/wolfPKCS11
 WOLFBOOT_LIB_WOLFPSA?=lib/wolfPSA
 WOLFBOOT_LIB_WOLFHSM?=lib/wolfHSM
+WOLFBOOT_LIB_WOLFCOSE?=lib/wolfCOSE
 
 # Convert to absolute paths using abspath function
 WOLFBOOT_LIB_WOLFSSL:=$(abspath $(WOLFBOOT_LIB_WOLFSSL))
 WOLFBOOT_LIB_WOLFTPM:=$(abspath $(WOLFBOOT_LIB_WOLFTPM))
 WOLFBOOT_LIB_WOLFPKCS11:=$(abspath $(WOLFBOOT_LIB_WOLFPKCS11))
 WOLFBOOT_LIB_WOLFPSA:=$(abspath $(WOLFBOOT_LIB_WOLFPSA))
 WOLFBOOT_LIB_WOLFHSM:=$(abspath $(WOLFBOOT_LIB_WOLFHSM))
+WOLFBOOT_LIB_WOLFCOSE:=$(abspath $(WOLFBOOT_LIB_WOLFCOSE))
 
 # Export variables so they are available to sub-makefiles
 export WOLFBOOT_LIB_WOLFSSL
 export WOLFBOOT_LIB_WOLFTPM
 export WOLFBOOT_LIB_WOLFPKCS11
 export WOLFBOOT_LIB_WOLFPSA
 export WOLFBOOT_LIB_WOLFHSM
+export WOLFBOOT_LIB_WOLFCOSE
 
 ## Architecture/CPU configuration
 include arch.mk

docs/DICE.md

@@ -22,15 +22,24 @@ an attestation key derived by DICE or supplied as a provisioned IAK.
 
 The implementation lives under `src/dice/` and is shared across targets. The
 service is invoked through the PSA Initial Attestation API and builds the
-COSE_Sign1 token using a minimal CBOR encoder.
+EAT claim set with wolfCOSE's CBOR API. wolfCOSE then wraps and signs the
+payload as an untagged COSE_Sign1 object using ES256. Hardware DICE targets use
+wolfCOSE's external-signer callback so the attestation private key never leaves
+the platform security boundary. Token-size queries use wolfCOSE's prediction
+API and do not derive a key, advance the CDI, or invoke a signer.
 
 - Claim construction and COSE_Sign1 encoding: `src/dice/dice.c`.
 - PSA Initial Attestation service dispatch: `src/arm_tee_psa_ipc.c`.
 - NSC wrappers for the PSA Initial Attestation API: `zephyr/src/arm_tee_attest_api.c`.
 
 Measured boot claims reuse the image hashing pipeline already used by
-wolfBoot to validate images. Component claims include a measurement type,
-measurement value, and a description string.
+wolfBoot to validate images. Each software-component map includes measurement
+type (key 1), measurement value (key 2), signer ID (key 5), and measurement
+description (key 6). The boot-image signer ID is the authenticated `HDR_PUBKEY`
+hash from its wolfBoot image header. The running wolfBoot image has no retained
+signing manifest, so its signer ID is the zero-filled unknown-signer value used
+by TF-M for the same case. Unsigned `WOLFBOOT_NO_SIGN` boot images also use the
+unknown-signer value because no signing authority exists.
 
 ## Keying model
 

hal/stm32h5.c

@@ -167,10 +167,11 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
     return 0;
 }
 
-#define STM32H5_BSEC_BASE 0x46009000u
-#define STM32H5_BSEC_UID0 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x14))
-#define STM32H5_BSEC_UID1 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x18))
-#define STM32H5_BSEC_UID2 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x1C))
+/* STM32H5 96-bit unique device ID, factory-programmed (RM0481). */
+#define STM32H5_UID_BASE 0x08FFF800u
+#define STM32H5_UID0 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x0u))
+#define STM32H5_UID1 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x4u))
+#define STM32H5_UID2 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x8u))
 
 #ifdef WOLFBOOT_UDS_OBKEYS
 __attribute__((weak)) int stm32h5_obkeys_read_uds(uint8_t *out, size_t out_len)
@@ -205,18 +206,18 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
 #endif
     size_t copy_len;
 
-    uid[0] = (uint8_t)(STM32H5_BSEC_UID0 >> 0);
-    uid[1] = (uint8_t)(STM32H5_BSEC_UID0 >> 8);
-    uid[2] = (uint8_t)(STM32H5_BSEC_UID0 >> 16);
-    uid[3] = (uint8_t)(STM32H5_BSEC_UID0 >> 24);
-    uid[4] = (uint8_t)(STM32H5_BSEC_UID1 >> 0);
-    uid[5] = (uint8_t)(STM32H5_BSEC_UID1 >> 8);
-    uid[6] = (uint8_t)(STM32H5_BSEC_UID1 >> 16);
-    uid[7] = (uint8_t)(STM32H5_BSEC_UID1 >> 24);
-    uid[8] = (uint8_t)(STM32H5_BSEC_UID2 >> 0);
-    uid[9] = (uint8_t)(STM32H5_BSEC_UID2 >> 8);
-    uid[10] = (uint8_t)(STM32H5_BSEC_UID2 >> 16);
-    uid[11] = (uint8_t)(STM32H5_BSEC_UID2 >> 24);
+    uid[0] = (uint8_t)(STM32H5_UID0 >> 0);
+    uid[1] = (uint8_t)(STM32H5_UID0 >> 8);
+    uid[2] = (uint8_t)(STM32H5_UID0 >> 16);
+    uid[3] = (uint8_t)(STM32H5_UID0 >> 24);
+    uid[4] = (uint8_t)(STM32H5_UID1 >> 0);
+    uid[5] = (uint8_t)(STM32H5_UID1 >> 8);
+    uid[6] = (uint8_t)(STM32H5_UID1 >> 16);
+    uid[7] = (uint8_t)(STM32H5_UID1 >> 24);
+    uid[8] = (uint8_t)(STM32H5_UID2 >> 0);
+    uid[9] = (uint8_t)(STM32H5_UID2 >> 8);
+    uid[10] = (uint8_t)(STM32H5_UID2 >> 16);
+    uid[11] = (uint8_t)(STM32H5_UID2 >> 24);
 
 #if defined(WOLFBOOT_HASH_SHA256)
     wc_InitSha256(&hash);

options.mk

@@ -1122,6 +1122,8 @@ ifeq ($(WOLFCRYPT_TZ_PSA),1)
   CFLAGS+=-DWOLFSSL_PSA_ENGINE
   CFLAGS+=-DWOLFPSA_CUSTOM_STORE
   CFLAGS+=-DNO_DES3 -DNO_DES3_TLS_SUITES
+  CFLAGS+=-I$(WOLFBOOT_LIB_WOLFCOSE)/include
+  CFLAGS+=-DWOLFCOSE_LEAN -DWOLFCOSE_ENABLE_EXT_SIGN
   WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)
   WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)/wolfpsa
   ifeq ($(USE_CLANG),1)
@@ -1135,6 +1137,8 @@ ifeq ($(WOLFCRYPT_TZ_PSA),1)
   WOLFCRYPT_OBJS+=src/psa_store.o
   WOLFCRYPT_OBJS+=src/arm_tee_psa_veneer.o
   WOLFCRYPT_OBJS+=src/arm_tee_psa_ipc.o
+  WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFCOSE)/src/wolfcose.o
+  WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFCOSE)/src/wolfcose_cbor.o
   WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/pwdbased.o
   WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hmac.o
   WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/dh.o