Add supports for generating identity signing key (IDK_S)

dev_tests/src/ratchet.rs

@@ -37,7 +37,7 @@ fn ratchet_globals() -> Result<()> {
             ("litebox/", 9),
             ("litebox_platform_linux_kernel/", 6),
             ("litebox_platform_linux_userland/", 5),
-            ("litebox_platform_lvbs/", 24),
+            ("litebox_platform_lvbs/", 25),
             ("litebox_platform_multiplex/", 1),
             ("litebox_platform_windows_userland/", 8),
             ("litebox_runner_lvbs/", 6),

litebox_platform_lvbs/Cargo.toml

@@ -33,6 +33,7 @@ aligned-vec = { version = "0.6.4", default-features = false }
 raw-cpuid = "11.6.0"
 zerocopy = { version = "0.8", default-features = false, features = ["derive"] }
 zeroize = { version = "1.8", default-features = false }
+p384 = { version = "0.13.1", default-features = false, features = ["arithmetic", "ecdsa"] }
 
 [target.'cfg(target_arch = "x86_64")'.dependencies]
 x86_64 = { version = "0.15.2", default-features = false, features = ["instructions"] }

litebox_platform_lvbs/src/host/lvbs_impl.rs

@@ -120,6 +120,10 @@ pub(crate) const PRK_LEN: usize = 32;
 
 static PRK_ONCE: spin::Once<[u8; PRK_LEN]> = spin::Once::new();
 
+// Do not expose a raw PRK getter (i.e., no `get_platform_root_key`).
+// Consumers should provide key derivation function and context
+// through `DerivedKeyProvider` so PRK access stays in this module.
+
 /// Sets the Platform Root Key (PRK) for this platform.
 ///
 /// This should be called once during platform initialization with a key derived
@@ -136,6 +140,22 @@ pub(crate) fn set_platform_root_key(key: &[u8]) {
     });
 }
 
+impl litebox::platform::DerivedKeyProvider for LvbsLinuxKernel {
+    fn derive_key<E>(
+        &self,
+        kdf: Option<fn(&[u8], litebox::platform::KDFParams) -> Result<(), E>>,
+        params: litebox::platform::KDFParams,
+    ) -> Result<(), litebox::platform::DerivedKeyError<E>> {
+        let Some(prk) = PRK_ONCE.get() else {
+            return Err(litebox::platform::DerivedKeyError::UnsupportedRebootPersistentKey);
+        };
+        match kdf {
+            None => Err(litebox::platform::DerivedKeyError::ShimKDFRequired),
+            Some(kdf) => Ok(kdf(prk, params)?),
+        }
+    }
+}
+
 pub struct HostLvbsInterface;
 
 impl HostLvbsInterface {}

litebox_platform_lvbs/src/mshv/error.rs

@@ -105,6 +105,13 @@ pub enum VsmError {
     #[error("{0} is not supported")]
     OperationNotSupported(&'static str),
 
+    // Key Management Errors
+    #[error("platform root key is not set")]
+    PlatformRootKeyNotSet,
+
+    #[error("failed to generate identity signing key")]
+    IdentitySigningKeyGenerationFailed,
+
     // VTL0 Memory Copy Errors
     #[error("failed to copy data from/to VTL0")]
     Vtl0CopyFailed,
@@ -177,7 +184,8 @@ impl From<VsmError> for Errno {
             // Not found errors
             VsmError::SystemCertificatesNotFound
             | VsmError::KernelSymbolTableNotFound
-            | VsmError::PrecomputedPatchNotFound => Errno::ENOENT,
+            | VsmError::PrecomputedPatchNotFound
+            | VsmError::PlatformRootKeyNotSet => Errno::ENOENT,
 
             // Operation not permitted after end of boot
             VsmError::OperationAfterEndOfBoot(_) => Errno::EPERM,
@@ -199,7 +207,9 @@ impl From<VsmError> for Errno {
             | VsmError::SymbolTableOutOfRange => Errno::ERANGE,
 
             // Init/hardware failures - I/O error
-            VsmError::ApInitFailed(_) | VsmError::HypercallFailed(_) => Errno::EIO,
+            VsmError::ApInitFailed(_)
+            | VsmError::HypercallFailed(_)
+            | VsmError::IdentitySigningKeyGenerationFailed => Errno::EIO,
 
             // True format/validation errors - invalid argument
             VsmError::AddressNotPageAligned

litebox_platform_lvbs/src/mshv/mod.rs

@@ -131,6 +131,9 @@ pub const VSM_VTL_CALL_FUNC_ID_ALLOCATE_RINGBUFFER_MEMORY: u32 = 0x1_ffec;
 // This VSM function ID for setting the platform root key is subject to change
 pub const VSM_VTL_CALL_FUNC_ID_SET_PLATFORM_ROOT_KEY: u32 = 0x1_ffed;
 
+// This VSM function ID for generating the identity signing key is subject to change
+pub const VSM_VTL_CALL_FUNC_ID_GENERATE_IDENTITY_SIGNING_KEY: u32 = 0x1_ffee;
+
 // This VSM function ID for OP-TEE messages is subject to change
 pub const VSM_VTL_CALL_FUNC_ID_OPTEE_MESSAGE: u32 = 0x1_fff0;
 
@@ -154,6 +157,7 @@ pub enum VsmFunction {
     OpteeMessage = VSM_VTL_CALL_FUNC_ID_OPTEE_MESSAGE,
     AllocateRingbufferMemory = VSM_VTL_CALL_FUNC_ID_ALLOCATE_RINGBUFFER_MEMORY,
     SetPlatformRootKey = VSM_VTL_CALL_FUNC_ID_SET_PLATFORM_ROOT_KEY,
+    GenerateIdentitySigningKey = VSM_VTL_CALL_FUNC_ID_GENERATE_IDENTITY_SIGNING_KEY,
 }
 
 pub const MSR_EFER: u32 = 0xc000_0080;