A CoRIM Profile for Arm's Platform Security Architecture (PSA)

PSA Endorsements PSA Endorsements describe an attesting device in terms of the hardware and firmware components that make up its PSA Root of Trust (RoT). This includes the identification and expected state of the device as well as the cryptographic key material needed to verify Evidence signed by the device's PSA RoT. Additionally, PSA Endorsements can include information related to the certification status of the attesting device. There are three basic types of PSA Endorsements:

Reference Values (), i.e., measurements of the PSA RoT firmware;
Attestation Verification Claims (), i.e., cryptographic keys that are used to verify signed Evidence produced by the PSA RoT, along with the identifiers that bind the keys to their device instances;
Certification Claims (), i.e., metadata that describe the certification status associated with a PSA device;

There is a fourth PSA Endorsement type that aims at covering more advanced Verifier use cases (e.g., the one described in ):

Software Relations (), used to model upgrade and patch relationships between software components.

PSA Endorsement Profile PSA Endorsements are carried in one or more CoMIDs inside a CoRIM. The profile attribute in the CoRIM MUST be present and MUST be set to the URI http://arm.com/psa/iot/1 as shown in .

PSA IoT version 1, CoRIM profile The list of all, and only, the CoMIDs that are currently "active" (i.e., CoMIDs that contain triples that can be used for appraisal) is provided in a CoBOM tag. TODO CoBOM example

PSA Endorsements to PSA RoT Linkage Each PSA Endorsement - be it a Reference Value, Attestation Verification Claim or Certification Claim - is associated with an immutable PSA RoT. The linkage between a PSA Endorsement and its PSA RoT is made by means of the unique PSA RoT identifier known as Implementation ID (see ). In order to support PSA Implementation IDs, the CoMID type $class-id-type-choice is extended as follows: Besides, a PSA Endorsement can be associated with a specific instance of a certain PSA RoT - as is the case for Attestation Verification Claims. A PSA Endorsement is associated with a PSA RoT instance by means of the Instance ID (see ) and its "parent" Implementation ID. These identifiers are typically found in the subject of a CoMID triple, encoded in an environment-map as shown in .

Example PSA RoT Identification Optional vendor and model can be specified as well. Together, they are interpreted as a unique identifier of the product that embeds the PSA RoT. It is RECOMMENDED to consistently provide a product identifier.

Reference Values Reference Values carry measurements and other metadata associated with the updatable firmware in a PSA RoT. When appraising Evidence, the Verifier compares Reference Values against the values found in the Software Components of the PSA token (see ). When there is more than one measurement associated to a certain PSA RoT, the measurements are spread across multiple reference-triple-records and, in certain cases, across multiple CoMIDs. A single CoBOM MUST completely describe the updatable PSA RoT. The elements of the psa-software-component map defined in are matched against CoMID measurement-map entries as follows: PSA Software Component Mappings

PSA Evidence	PSA Endorsement	Description
`measurement-type`	`measurement-values-map.name`
`measurement-value`	`measurement-values-map.digests[*][1]`
`version`	`measurement-values-map.version.version`
`measurement-desc`	`measurement-values-map.digests[*][0]`
`signer-id`	`authorized-by[0]`

The digests array MUST contain at least one entry and MAY contain more than one entry if multiple digests (obtained with different hash algorithms) of the same measured component exist. The authorized-by in the measurement-map MUST have exactly one entry of type tagged-thumbprint-type (CBOR tag 557) containing the signer-id. The example in shows a CoMID encoding a PSA Endorsement of type Reference Value for a firmware measurement associated with Implementation ID acme-implementation-id-000000001.

Example Reference Value

Attestation Verification Claims An Attestation Verification Claim carries the verification key associated with the Initial Attestation Key (IAK) of a PSA device. When appraising Evidence, the Verifier can use the Implementation ID and Instance ID claims (see ) to look up the verification key that it SHALL use to check the signature on the Evidence. This allows the Verifier to prove (or disprove) the Attester's claimed identity. Each verification key is provided alongside the corresponding device Instance and Implementation IDs (and, possibly, a product identifier) in an attest-key-triple-record. Specifically:

The Instance and Implementation IDs are encoded in the environment-map as shown in ;
The IAK public key is carried in the comid.key entry in the verification-key-map. The IAK public key is a PEM-encoded SubjectPublicKeyInfo . There MUST be only one verification-key-map in an attest-key-triple-record;
The optional comid.keychain entry MUST NOT be set by a CoMID producer that uses the profile described in this document, and MUST be ignored by a CoMID consumer that is parsing according to this profile.

The example in shows the PSA Endorsement of type Attestation Verification Claim carrying a secp256r1 EC public IAK associated with Instance ID 4ca3...d296.

Example Attestation Verification Claim

Certification Claims PSA Certified defines a certification scheme for the PSA ecosystem. A product - either a hardware component, a software component, or an entire device - that is verified to meet the security criteria established by the PSA Certified scheme is warranted a PSA Certified Security Assurance Certificate (SAC). A SAC contains information about the certification of a certain product (e.g., the target system, the attained certification level, the test lab that conducted the evaluation, etc.), and has a unique Certificate Number. The linkage between a PSA RoT -- comprising the immutable part as well as zero or more of the mutable components -- and the associated SAC is provided by a Certification Claim, which binds the PSA RoT Implementation ID and the software component identifiers with the SAC unique Certificate Number. When appraising Evidence, the Verifier can use the Certification Claims associated with the identified Attester as ancillary input to the Appraisal Policy, or to enrich the produced Attestation Result. A Certification Claim is encoded as a conditional-endorsement-triple-record. The SAC is encoded in a psa-cert-num that extends the measurement-values-map: psa-cert-num-type ) psa-cert-num-type = text .regexp "[0-9]{13} - [0-9]{5}" ]]> The conditional-endorsement-triple-record is constructed as follows:

The Implementation ID of the immutable PSA RoT to which the SAC applies is encoded as a tagged-impl-id-type in the environment-map of the stateful-environment-record;
Any software component that is part of the certified PSA RoT is encoded as a reference value (see ) in the measurement-map of the stateful-environment-record;
The unique SAC Certificate Number is encoded as psa-cert-num in the measurement-values-map.

The example in shows a Certification Claim that associates Certificate Number 1234567890123 - 12345 to Implementation ID acme-implementation-id-000000001 and a single "PRoT" software component with version "1.3.5".

Example Certification Claim

Software Upgrades and Patches In order to model software lifecycle events such as updates and patches, this profile defines a new triple that conveys the following semantics:

SUBJECT: a software component
PREDICATE: (non-critically / critically) (updates / patches)
OBJECT: another software component

The triple is reified and used as the object of another triple, psa-swrel-triple-record, whose subject is the embedding environment. [ + psa-swrel-triple-record ] ) psa.updates = 1 psa.patches = 2 psa-swrel-rel = [ type: psa.updates / psa.patches security-critical: bool ; true means it's a fix for a security bug ] sw-rel = [ new: comid.measurement-map ; the "new" firmware rel: psa-swrel-rel ; patches/updates and the security flag old: comid.measurement-map ; the "old" firmware ] psa-swrel-triple-record = [ environment-map sw-rel ] ]]> An example of a security critical update involving versions "1.2.5" and "1.3.0" of software component "PRoT" within the target environment associated with Implementation ID acme-implementation-id-000000001 is shown in .

Example Critical Software Upgrade