diff options
| author | Allen Webb <allenwebb@google.com> | 2018-01-31 11:21:20 -0800 |
|---|---|---|
| committer | chrome-bot <chrome-bot@chromium.org> | 2018-04-27 12:22:25 -0700 |
| commit | c61479bbd82bc33c159d09958d79d633755f8735 (patch) | |
| tree | 192c37e31a277b5971aeab498387022cbd1c1be9 /test/test_config.h | |
| parent | 6e7193c4587c13d69e8f4990252623284e84893f (diff) | |
| download | chrome-ec-c61479bbd82bc33c159d09958d79d633755f8735.tar.gz | |
Cr50: Added Pinweaver base implementation.
This adds some of the ground work for hardware backed brute force
resistance on Cr50. The feature is called Pinweaver. It will
initially be used to enable PIN authentication on CrOS devices
without reducing the security of the platform. A Merkle tree is
used to validate encrypted metadata used to track login attempts.
The metadata tracks counts of failed attempts, a timestamp of the
last failed attempt, the secrets, and any associated parameters.
Instead of storing the metadata on Cr50 an AES-CTR is used with an
HMAC to encrypt the data so it can be stored off-chip and loaded
when needed.
The Merkle tree is used to track the current state of all the
metadata to prevent replay attacks of previously exported copies.
It is a tree of hashes whose root hash is stored on Cr50, and whose
leaves are the HMACs of the encrypted metadata.
BRANCH=none
BUG=chromium:809730, chromium:809741, chromium:809743, chromium:809747
TEST=cd ~/src/platform/ec && V=1 make run-pinweaver -j
Change-Id: Id10bb49d8ebc5a487dd90c6093bc0f51dadbd124
Signed-off-by: Allen Webb <allenwebb@google.com>
Reviewed-on: https://chromium-review.googlesource.com/895395
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Diffstat (limited to 'test/test_config.h')
| -rw-r--r-- | test/test_config.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/test/test_config.h b/test/test_config.h index 57b2b413ce..dd14aad6b2 100644 --- a/test/test_config.h +++ b/test/test_config.h @@ -259,6 +259,11 @@ enum nvmem_vars { #define CONFIG_FLASH_NVMEM_VARS_USER_SIZE 600 #endif /* TEST_NVMEM_VARS */ +#ifdef TEST_PINWEAVER +#define CONFIG_PINWEAVER +#define CONFIG_SHA256 +#endif + #ifdef TEST_RTC #define CONFIG_HOSTCMD_RTC #endif |