How to use STASH_MEASUREMENT #2623
Unanswered
bgilsrudHPE
asked this question in
Q&A
Replies: 1 comment
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi, I'm hoping to get some clarity on how to use the STASH_MEASUREMENT command. My expectation is that a bootROM can use this command to extend the DICE chain when loading a firmware, but it's not clear what the fields of the command are expected to be.
Metadata: What should this be? Does it matter?
Measurement: The sha384 of the firmware image to be booted
Context: The command description suggests this is the hash of the key that was used to verify the SVN (I'm assuming this is the same key that was used to verify the image signature?). Is this used? The STASH_MEASUREMENT command indicates it uses the default context, so why is there an argument to specify the context? Is this something different?
svn: I expect this is the security version number of the image to be booted? I'm confused by the references to svn here when there is no equivalent in the DPE DeriveChild command description, which I understand the STASH_MEASUREMENT command is intended to provide a simple interface for.
Thanks,
Ben
All reactions