From 26078dcc7daafe99d03aa231ca75bfe4c9eeae6c Mon Sep 17 00:00:00 2001 From: bunnie Date: Sat, 1 Nov 2025 22:59:07 +0800 Subject: [PATCH] add keystore to dabao configuration After some contemplation, we should include the keystore in the core service set featured by the dabao-xous configuration. The pros are: any compatibility/sharing of resources that require access to RRAM, one-way counters, UUIDs, etc. will either require a wholly separate implementation that is "insecure" or it could just reuse the baosec work. Furthermore, as cryptographic accelerators are laid into the keystore, the APIs become available to the dabao environment The cons are: more space is used in a space-constrained dabao environment (roughly 140k "deadweight" at the start, but as cryptographic APIs get layered in this can grow substantially); the key slots are "used up" in part by the scheme, which leaves less key slots available for user-defined purposes. This is mitigated by the fact that there are a couple thousand key slots, and so even though we use a couple hundred of them it's still not the whole range. Also, the baosec/dabao feature flag can be used to feature-out cryptographic APIs/accelerators that are too obscure or not useful for the dabao environment, to "lighten up" the firmware load. --- Cargo.lock | 1 - libs/bao1x-api/src/offsets/dabao.rs | 5 ++++- services/keystore/Cargo.toml | 15 +++++---------- services/keystore/src/platform.rs | 5 +++-- xtask/src/main.rs | 3 ++- 5 files changed, 14 insertions(+), 15 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a1b81aae9..6bf7ebce1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3311,7 +3311,6 @@ dependencies = [ "sha2", "subtle", "utralib 0.1.26", - "ux-api", "xous 0.9.67 (registry+https://github.com/rust-lang/crates.io-index)", "xous-api-log", "xous-api-names", diff --git a/libs/bao1x-api/src/offsets/dabao.rs b/libs/bao1x-api/src/offsets/dabao.rs index fb2b44861..7e9477da4 100644 --- a/libs/bao1x-api/src/offsets/dabao.rs +++ b/libs/bao1x-api/src/offsets/dabao.rs @@ -42,4 +42,7 @@ pub const DATA_SLOTS: [SlotIndex; 8] = [ crate::offsets::BETA_PUBKEY, crate::offsets::DEV_PUBKEY, ]; -pub const KEY_SLOTS: [SlotIndex; 0] = []; + +pub use crate::baosec::{CHAFF_KEYS, NUISANCE_KEYS, NUISANCE_KEYS_0, NUISANCE_KEYS_1, RMA_KEY, ROOT_SEED}; + +pub const KEY_SLOTS: [SlotIndex; 5] = [ROOT_SEED, RMA_KEY, NUISANCE_KEYS_0, NUISANCE_KEYS_1, CHAFF_KEYS]; diff --git a/services/keystore/Cargo.toml b/services/keystore/Cargo.toml index bf17c71ba..fbaca9882 100644 --- a/services/keystore/Cargo.toml +++ b/services/keystore/Cargo.toml @@ -19,7 +19,6 @@ bao1x-hal = { path = "../../libs/bao1x-hal", features = [ "std", ], optional = true } bao1x-hal-service = { path = "../bao1x-hal-service", optional = true } -ux-api = { path = "../../libs/ux-api" } bao1x-emu = { path = "../bao1x-emu", optional = true } bao1x-api = { path = "../../libs/bao1x-api" } xous-ipc = "0.10.7" @@ -42,7 +41,7 @@ blowfish = { version = "0.9.1", features = ["bcrypt"] } # password modals - keep them in this crate to minimize plaintext password manipulations locales = { path = "../../locales" } # non-password modals are outsourced to a common crate -modals = { path = "../modals" } +modals = { path = "../modals", optional = true } # backups aes-gcm-siv = { version = "0.11.1", default-features = false, features = [ @@ -60,7 +59,7 @@ aes = { path = "../aes", default-features = false, optional = true } # engine-25519 = { path = "../engine-25519" } byteorder = "1.4.3" # used by keywrap # hardware acceleration adaptations are inserted into a fork of the main branch. -hex = { version = "0.4.3", default-features = false, features = [] } +hex = { version = "0.4.3", default-features = false, features = ["alloc"] } hkdf = "0.12.4" #[dependencies.curve25519-dalek] @@ -78,15 +77,12 @@ hkdf = "0.12.4" bao1x = ["utralib/bao1x", "aes/bao1x"] board-baosec = [ "utralib/bao1x", - "ux-api/board-baosec", "keystore-api/gen2", - "modals/no-gam", - "modals/bao1x", "bao1x-hal", "bao1x-hal-service/board-baosec", ] # USB form factor token -loader-baosec = ["ux-api/loader-baosec"] -test-baosec = ["ux-api/loader-baosec"] +loader-baosec = [] +test-baosec = [] hosted-baosec = [ "keystore-api/gen2", "modals/no-gam", @@ -101,12 +97,11 @@ loader-baosor = [] board-dabao = [ "utralib/bao1x", "keystore-api/gen2", + "bao1x-hal", "bao1x-hal-service/board-dabao", ] # Dev board form factor loader-dabao = [] -policy-menu = [ -] # provisions for users to set their password retention policies (on the block for deprecation) (note: to re-enable you need to add "rootkeys menu" to the tokens.rs in the GAM) hazardous-debug = [ ] # this feature enables the printing of secret materials for debug purposes tts = [] diff --git a/services/keystore/src/platform.rs b/services/keystore/src/platform.rs index 1cecdb77e..830ef415e 100644 --- a/services/keystore/src/platform.rs +++ b/services/keystore/src/platform.rs @@ -1,6 +1,7 @@ -#[cfg(feature = "board-baosec")] +// Dabao comes along for the ride for baosec +#[cfg(any(feature = "board-baosec", feature = "board-dabao"))] mod baosec; -#[cfg(feature = "board-baosec")] +#[cfg(any(feature = "board-baosec", feature = "board-dabao"))] pub use baosec::*; #[cfg(feature = "hosted-baosec")] diff --git a/xtask/src/main.rs b/xtask/src/main.rs index 8f50fa5a1..63a2be2a7 100644 --- a/xtask/src/main.rs +++ b/xtask/src/main.rs @@ -786,7 +786,8 @@ fn main() -> Result<(), Box> { // minimal set of services for app development on a dabao. Need to save space for the app itself! let bao_rram_pkgs = - ["xous-ticktimer", "xous-log", "xous-names", "usb-bao1x", "bao1x-hal-service"].to_vec(); + ["xous-ticktimer", "keystore", "xous-log", "xous-names", "usb-bao1x", "bao1x-hal-service"] + .to_vec(); let bao_app_pkgs: Vec<&'static str> = ["dabao-console"].to_vec(); builder.add_loader_feature("debug-print");