53 lines
2.8 KiB
Markdown
53 lines
2.8 KiB
Markdown
|
# independent-verifier-03: the ESP32-C5 signs with credentials provisioned at run time
|
||
|
|
|
||
|
|
The board (COM11, test application `examples/esp_idf_test`, image of
|
||
|
|
[security-device-08](../security-device-08/result.json)) receives the twin chain
|
||
|
|
of [independent-verifier-02](../independent-verifier-02/analysis.md) as a
|
||
|
|
credential bundle over its USB serial diagnostic channel (command 9,
|
||
|
|
`credentials.hpp` format), resets into the secured profile, signs the CAM
|
||
|
|
carriers, and c-its verifies the recorded frames against the twin root.
|
||
|
|
|
||
|
|
| File | Content |
|
||
|
|
| --- | --- |
|
||
|
|
| `device.pcap` | three CAMs signed by the board with `TWIN_AT` (psid 638, 141, 36; region inherited) |
|
||
|
|
| `device2.pcap` | the same with `TWIN_AT2` (without psid 141) |
|
||
|
|
| `host-bundle.pcap` | the host SUT provisioned from the same bundle file (`vidf_sut --security-bundle`), for comparison |
|
||
|
|
| `c-its-*.jsonl` | c-its-pcap output per capture |
|
||
|
|
|
||
|
|
The bundle files are not retained: they carry the tickets' private scalars
|
||
|
|
(the twin chain's public certificates are in -02).
|
||
|
|
|
||
|
|
## Commands
|
||
|
|
|
||
|
|
```
|
||
|
|
credential_bundle.py build --pool twin --root TWIN_RCA --aa TWIN_AA --at TWIN_AT --out twin.vcr
|
||
|
|
credential_bundle.py build --pool twin --root TWIN_RCA --aa TWIN_AA --at TWIN_AT2 --out twin2.vcr
|
||
|
|
capture_pcap.py --port COM11 --bundle twin.vcr --out device.pcap
|
||
|
|
capture_pcap.py --port COM11 --bundle twin2.vcr --out device2.pcap
|
||
|
|
capture_pcap.py --sut vidf_sut --bundle twin.vcr --out host-bundle.pcap
|
||
|
|
c-its-pcap device.pcap / device2.pcap / host-bundle.pcap (ctl/root-TWIN_RCA.oer, ctl/aa-TWIN_AA.oer)
|
||
|
|
```
|
||
|
|
|
||
|
|
## Result
|
||
|
|
|
||
|
|
| Capture | Signer | Message signature | Chain (root, AA, AT) signatures | `security_authorized` |
|
||
|
|
| --- | --- | --- | --- | --- |
|
||
|
|
| `device.pcap` | ESP32-C5, PSA Crypto | verifies (3/3) | verify (3/3) | false (psid 141 without SSP, c-its limitation as in -01) |
|
||
|
|
| `device2.pcap` | ESP32-C5, PSA Crypto | verifies (3/3) | verify (3/3) | **true** (3/3) |
|
||
|
|
| `host-bundle.pcap` | host, OpenSSL | verifies (3/3) | verify (3/3) | false (psid 141) |
|
||
|
|
|
||
|
|
The generation times in `device.pcap` are the board's ITS clock as set by the
|
||
|
|
capture (command 5) and the pcap timestamps the host's wall clock; c-its checks
|
||
|
|
them against each other. The DENM carrier produces no frame because the twin
|
||
|
|
tickets carry no psid 37 (the twin root's DENM range needs SSP version 2).
|
||
|
|
|
||
|
|
## What this shows and what not
|
||
|
|
|
||
|
|
The run-time provisioning path exists end to end (bundle → diagnostic command
|
||
|
|
→ `Credentials` → `apply()` → security entity) and the board's signatures are
|
||
|
|
accepted by an unrelated implementation. It does not show the project root:
|
||
|
|
the twin has the real root's permissions and region but a throwaway key; the
|
||
|
|
real chain is issued by the key holder with the same tools. Persistence across
|
||
|
|
resets is the application's `CredentialStore`; the test application keeps the
|
||
|
|
bundle in RAM and exercises the NVS store in `test_credentials` only.
|