rot_verify_hil Directory Reference

Directory dependency graph for rot_verify_hil:

Directories
	inc
	src

Detailed Description

On-silicon proof that a working root of trust can authenticate an image on this hardware. It runs the real ra8_rot verify chain against a signed fixture:

1. SHA-256 of the image body, using the software backend – the RSIP hash hardware is dead on this part.
2. The anti-rollback version bind, SHA-256(img_version_le || body_digest) (T5-05).
3. An ECDSA-P256 signature check through tf-psa-crypto against the RoT public key provisioned in ra8_rot.c.

It then flips one body byte and requires the tampered image to be rejected, so the pass covers both directions.

This is a self-test and cannot brick the board. RA8_ENABLE_ROOT_OF_TRUST is scoped to this app's CMake target only, so nothing here enables the root of trust in the boot path. It is the on-silicon proof that has to pass before the production DFU / secure-boot path turns authentication on.

The fixture in inc/rot_fixture.h is generated by scripts/secrets/rot_sign.py with the project RoT signing key, which is kept out of tree.