[kmac] D2S Signoff

[msfschaffner]

Description

Ensure D2S signoff criteria are fulfilled after focus area changes have landed.

[vogelpi]

Commits since Earlgrey-ES tapeout

git rev-parse --short HEAD

3d21fe7

git log Earlgrey-M2.5.2-RC0..HEAD --oneline hw/ip/kmac

15f75fa [kmac, sha3] Add REQ/ACK interface to delay Keccak operations
5cb6b89 [kmac] Rework fifo_empty interrupt, change type to status
adf455d [kmac] Add separate FuseSoc core file for kmac_reduced.sv
ddc64ed [kmac] Fix driving conflict in kmac_reduced.sv used for SCA evaluation
642d7a9 [kmac] Switch to Trivium-based PRNG implementation
4414aaa [kmac] Add param to keccak_round/2share to only use external randomness
0237c23 [kmac] Add buffer stage to PRNG output
365dfd2 [kmac] Make DOM multiplier I/O muxing glitch free
dd4b689 [kmac] Move DOM multiplier control from keccak_2share to keccak_round
043b0e0 [kmac] Simplify randomness update requests and PRNG control logic
fa5dc8a [pre_sca] Convert PROLEAD configuration files to Unix format
deb7ee1 [kmac,pre_dv] Check digests produced by kmac_reduced_tb using DPI model
72c05a2 [kmac] Add missing CM annotation
178e088 [kmac, pre_sca] Add PROLEAD setup
b56df44 [kmac,pre_dv] Add scratch Verilator testbench for kmac_reduced module
bf71a0f [kmac,rtl] Add kmac_reduced module suitable for SCA e.g. using PROLEAD
66472e2 [pre_syn] Include csrng_pkg.sv to re-enable Yosys synthesis
5639924 Revert "[edn] Move prim_edn_req out of prim"
c721c51 [rtl, prim] Add 'commit' functionality to prim_count
61a237e [util/reggen] reverse order of substruct generation
fc84846 [reggen,hw] Create index parameter for registers windows
3b4e36e [edn] Move prim_edn_req out of prim
de31bdf [reggen] Remove the devmode input
963a500 [doc] Minor tweak to md sanitisation code
5be278b [aes, kmac, otbn] Perform final clean -purge step in Yosys synthesis
2257a72 [kmac/pre_syn] Re-enable Yosys synthesis flow
975a6eb [adc_ctrl,dv] Tidy up access to intr_state in env_cfg files
1b16ca2 [reggen] Add mubi support SWAccess that sets/clears a reg
b968a16 [kmac,doc] Correct performance numbers
f96f3dc [kmac, doc] Update doc with cmdgen.py
3c02ff2 [kmac, doc] Update MSG_FIFO description
59f8142 [doc] Moved badges over to using hosted images
9efb9cc [doc] kmac registers and interfaces now use CMDGEN
8ef4c55 [chip-test] SiVal test plan updates for KMAC
7688e71 [reggen] Add initial support for version and cip_id hjson fields
fbd888e Revert "[reggen] Add CIP_IDs and bump all major versions"
2db7ac4 [kmac, rtl] Advance LFSR upon randomness consumption during reseeding
e53fe26 [kmac, rtl] Tweak SVA checking that the Keccak core only uses valdi PRD
37314cd [kmac, doc] Fix broken references
9bc003c [aes, kmac] Replace term aggravate in SCA/FI context
b0044a4 [kmac, rtl] Hold entropy_req until it's acknowledged
b156e6d [kmac, rtl] Keep advancing LFSR in StRandErr as during normal operation
0ba10b3 [reggen] Add CIP_IDs and bump all major versions
e47df29 [misc] Use lc_tx_t testing functions at endpoints

Issues closed since the Earlgrey-ES tapeout

DD & DV

• [kmac] Change fifo_empty interrupt from event to status type #21049
  Changing the previously unused fifo_empty interrupt from type Event to Status. The interrupt isn't currently verified at the block level and also wasn't before this change.
• [kmac] Improve PRNG implementation #20828
  The main design change for Earlgrey-PROD. As for AES, the PRNG design has been switched to a Trivium-based implementation to avoid potential brute forcing vulnerabilities on the PRNG state (previously made up by 25 32-bit LFSRs). While doing this work, the controls of the PRNG as well as the control of the masked Keccak core have been optimized to improve the SCA hardening. A full security evaluation has been performed before merging the change.
• [rtl/kmac] Improve handling of dropped edn requests #19232
  Two bugs in the handling of EDN requests (1. dropping the request without ack, 2. not advancing the PRNG if EDN times out). Both have been fixed.
• [dv/kmac] Make sure kmac does not hang when sideload key valid bit is dropped #14596
  A duplicate of [kmac] Expecting error after clearing sideload key #16855 which is tracked for M3.

Doc

• [dv] Add countermeasure annotations in RTL #20887
• [doc] Replace term "aggravate" in SCA/FI context  #17256

SW

• [kmac, sca] Rework SCA setup to work with ES silicon #20674
  Some changes to the SCA setup to enable measurements using the actual ES silicon.

SiVal / Chip-level tests

• [chip-test] chip_sw_lc_ctrl_kmac_error #21436
  Chip-level test issue, duplicate of [chip-test] chip_sw_lc_ctrl_kmac_error #16069 .
• [chip-test] chip_sw_kmac_enc #21403
  Chip-level test issue, duplicate of [chip-test] chip_sw_kmac_enc #20443 .
• [chip-test] chip_sw_kmac_enc #20443
  Chip-level test issue, the test was already implemented but not yet cross referenced.

Misc

• [kmac] SCA hardening follow-up tasks #12323
  A couple of follow-up tasks. Fanned out into separate issues where appropriate, provided arguments of what can be closed / ignored.

Currently open issues

DD / DV

• [kmac] ROM_CTRL reset glitch alert not working? #10724
  A minor RTL fix / security improvement in the ROM_CTRL / KMAC interface. Uncontroversial and tracked for M3.
• [kmac] kmac does not check key validation in sw initiated sequence #10704
  A small security improvement tracked for implementation in M3. No big area of physical design impact.
• [kmac] Expecting error after clearing sideload key #16855
  Strongly related to [kmac] kmac does not check key validation in sw initiated sequence #10704 if not a duplicate. small security improvement. No PD impact, tracked for M3.
• [kmac] Consider moving message masking to output of sha3pad #17209
  Moving the message masking to after the padding to improve SCA hardening. No PD impact. Now that the masking is improved, most likely no longer needed. M3.
• [aes, kmac, sca] Repeat formal masking verification experiments prior to tapeout #16202
  No work for KMAC needed as the KMAC S-Box is super simple compared to the AES one.
• [keymgr, kmac] Context Switch (save/restore) #3479
  Context save and restore. Not under discussion for implementation currently.
• [kmac] Handle If Width is not integer divisible by DInWidth #18029
  For Keccak state sizes other than what is used for Earlgrey and Darjeeling, a width mismatch could occur inside keccak_round.sv. This will most likely generate a lint error and simulation stops due to an SVA. This can be fixed if it really turns out it's needed sometime in the future.
• [keymgr, security] Assume adversarial SW model regarding keymgr analysis #17585
  A security item tracked for keymgr (M3).

DV

• [dv, kmac] Test sideload capacity zeroing #17759
  A V3 item (M5)
  [dv/sec_cm] Add assertions to check if local escalation can trigger fatal alerts #16269
  A V2S item (M5)
• [test-triage] keymgr_kmac_rsp_err #18644
  A failing block-level test, should be investigated as part of V3 closure (M5)

Doc

• [keymgr, kmac] Entropy error code SW guideline #17785
  Entropy-related error conditions inside KMAC are not reported to keymgr (see [kmac] Entropy error code #15088). This issue is about formulating some guidance for software developers to check for those error conditions inside KMAC when using keymgr.
• [kmac] Entropy error code #15088
  See above.
• [keymgr/kmac] how kmac should send kmac_data_i.error #16792
  Formulating guidance for software developers.

SiVal / Chip-level tests

• [chip-test] chip_sw_kmac_error_conditions #21413
• [chip-test] chip_sw_kmac_entropy_stress #21412
• [chip-test] chip_sw_kmac_endianess #21411
• [chip-test] chip_sw_kmac_kmac_key_sideload #21410
• [chip-test] chip_sw_kmac_kmac_stress #21409
• [chip-test] chip_sw_kmac_cshake_stress #21408
• [chip-test] chip_sw_kmac_shake_stress #21407
• [chip-test] chip_sw_kmac_sha3_stress #21406
• [chip-test] chip_sw_kmac_idle #21405
• [chip-test] chip_sw_kmac_entropy #21404

Misc

• [hw/kmac] Setup kmac for security verification and check for key leakage from keymgr port #6543
  A penetration testing item.

Summary

Since Earlgrey-M2.5.2-RC0, there have been two notable RTL changes to KMAC (besides some minor bug fixes):

• The change of the PRNG (together with optimizing the masking SCA countermeasure)
• The change of the interrupt type for the fifo_empty interrupt
  Both changes are reflected in the documentation and DV has been aligned where possible. A full security evaluation has been performed for the masking / PRNG change. The fifo_empty interrupt isn't verified (but it wasn't before the change) and software currently does not use it. Based on this, I feel confident to declare D2S.

For M3, there three minor security improvements outstanding (see open issues). But none of this is going to be a major change. Thus, I am still in favor of declaring D2S (the block was D2S before) but I'd also be okay to go to D2 first. PLMK @msfschaffner , @andreaskurth .

[andreaskurth]

I agree that D2S is still fulfilled. I reviewed the following commits, which change kmac's RTL code (commit list obtained with git log --oneline Earlgrey-M2.5.2-RC0..HEAD -- hw/ip/kmac/rtl):

• 15f75fa [kmac, sha3] Add REQ/ACK interface to delay Keccak operations
• 5cb6b89 [kmac] Rework fifo_empty interrupt, change type to status
• ddc64ed [kmac] Fix driving conflict in kmac_reduced.sv used for SCA evaluation
• 642d7a9 [kmac] Switch to Trivium-based PRNG implementation
• 4414aaa [kmac] Add param to keccak_round/2share to only use external randomness
• 0237c23 [kmac] Add buffer stage to PRNG output
• 365dfd2 [kmac] Make DOM multiplier I/O muxing glitch free
• dd4b689 [kmac] Move DOM multiplier control from keccak_2share to keccak_round
• 043b0e0 [kmac] Simplify randomness update requests and PRNG control logic
• 72c05a2 [kmac] Add missing CM annotation
• bf71a0f [kmac,rtl] Add kmac_reduced module suitable for SCA e.g. using PROLEAD
• c721c51 [rtl, prim] Add 'commit' functionality to prim_count
• 61a237e [util/reggen] reverse order of substruct generation
• fc84846 [reggen,hw] Create index parameter for registers windows
• de31bdf [reggen] Remove the devmode input
• 1b16ca2 [reggen] Add mubi support SWAccess that sets/clears a reg
• fbd888e Revert "[reggen] Add CIP_IDs and bump all major versions"
• 2db7ac4 [kmac, rtl] Advance LFSR upon randomness consumption during reseeding
• e53fe26 [kmac, rtl] Tweak SVA checking that the Keccak core only uses valdi PRD
• 9bc003c [aes, kmac] Replace term aggravate in SCA/FI context
• b0044a4 [kmac, rtl] Hold entropy_req until it's acknowledged
• b156e6d [kmac, rtl] Keep advancing LFSR in StRandErr as during normal operation
• 0ba10b3 [reggen] Add CIP_IDs and bump all major versions
• e47df29 [misc] Use lc_tx_t testing functions at endpoints

The main RTL changes are in the following PRs:

• [kmac, rtl] Fix issues around EDN timeouts #19248
• [kmac, rtl] Very minor tweaks around LFSR reseeding #19262
• [kmac] Rework masked SHA3 core and switch to Trivium-based PRNG implementation #21624
• [kmac] Change fifo_empty interrupt type to status  #21657
• [entropy_src, sha3] Fix CS AES Halt interface and entropy_src_rng_max_rate test #21787

The first three PRs have been thoroughly reviewed, resulting in approval by multiple committers. I scanned the changes again and did not notice problems that would prevent D2S sign-off in my view. The bottom two PRs have not been scrutinized to the same degree, so I reviewed them again in detail and didn't find problems there either. With the security evaluation done as part of #21624, we should be able to maintain the maturity level of the countermeasures.

Thus I think we should proceed with signing KMAC off at D2S.

[andreaskurth]

I justed noticed that KMAC is still at D2S and didn't have its version number increased:

opentitan/hw/ip/kmac/data/kmac.hjson

Lines 27 to 32 in 95d1385

	version: "1.0.0",
	life_stage: "L1",
	design_stage: "D2S",
	verification_stage: "V2S",
	dif_stage: "S2",
	commit_id: "c2a8c64ccbca39707be7883dfd2f8c1100813730",

Given the PRNG reworking, the type change of the fifo_empty interrupt, and the fixing of the CS AES Halt interface, I think we should bump at least the minor version (i.e., 1.1.0) (and remove the outdated commit_id). WDYT @vogelpi @msfschaffner ?

[andreaskurth]

As just discussed in the WG meeting, @msfschaffner recommends a major version bump due to the SW-visible interface change (interrupt type), and I agree. I created PR #21982 to do this.

[vogelpi]

Speaking of SW-visible interface, I've now realized that already the PRNG change (#21624) was software visible because KMAC features a way for SW to reseed the PRNG initially. Since the state size of the PRNG changed, the number of words to be written needed to be changed and to streamline things, I've switched from 5 registers written once each to 1 register written 9 times. So, the major version bump definitely makes sense to me.