Fail-closed PSA external-RNG hook for the verify-only secure boot (#172). More...

#include <stddef.h>
#include <stdint.h>
#include "mbedtls/platform_util.h"
#include "psa/crypto.h"

Include dependency graph for psa_verify_rng.c:

Functions
psa_status_t	mbedtls_psa_external_get_random (mbedtls_psa_external_random_context_t context, uint8_t output, size_t output_size, size_t *output_length)
	PSA external-RNG hook – fails closed (verification draws no entropy).

Detailed Description

Fail-closed PSA external-RNG hook for the verify-only secure boot (#172).

Tag: [Ring 6 / APP] {World: S}

The vendored tf-psa-crypto port sets MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG, so the PSA core needs an mbedtls_psa_external_get_random symbol at link time. This app performs exactly ONE cryptographic operation on the boot path: ECDSA-P256 signature verification of the Non-Secure image (via ra8_rot_verify_image inside ra8_tz_secure_boot_jump_ns). That operation is mathematically deterministic and draws NO randomness, and the app never signs, generates a key, or derives a secret – there is no secret here for randomness to protect.

Rather than link a deterministic placeholder RNG (a latent catastrophe if this image were ever repurposed to sign or keygen), this hook FAILS CLOSED: any request for entropy returns PSA_ERROR_INSUFFICIENT_ENTROPY. On the verify-only boot path it is never called, so the secure boot authenticates and BLXNS-es normally. A call would mean an unexpected path drew randomness – and failing loudly (denying the boot) is the correct, safe response, never emitting predictable bytes that could masquerade as entropy.

Warning: If a future feature genuinely needs entropy (a challenge-response, a signing step, a key exchange), wire a real hardware TRNG here. Do NOT relax this to a deterministic generator.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Since: 0.1.0

Definition in file psa_verify_rng.c.

Function Documentation

◆ mbedtls_psa_external_get_random()

psa_status_t mbedtls_psa_external_get_random	(	mbedtls_psa_external_random_context_t *	context,
		uint8_t *	output,
		size_t	output_size,
		size_t *	output_length )

PSA external-RNG hook – fails closed (verification draws no entropy).

Parameters

[in]	context	Unused external-RNG context.
[out]	output	Unused entropy output buffer.
[in]	output_size	Unused requested byte count.
[out]	output_length	Set to 0 when non-NULL.

Returns: Always PSA_ERROR_INSUFFICIENT_ENTROPY.

Definition at line 48 of file psa_verify_rng.c.

Functions

Detailed Description

Function Documentation

◆ mbedtls_psa_external_get_random()