[aes] D2S Signoff

[msfschaffner]

Description

Ensure D2S signoff criteria are fulfilled after focus area changes have landed.

[vogelpi]

Commits since Earlgrey-ES tapeout

$ git log Earlgrey-M2.5.2-RC0..HEAD --oneline hw/ip/lc_ctrl

fa5dc8a [pre_sca] Convert PROLEAD configuration files to Unix format
66472e2 [pre_syn] Include csrng_pkg.sv to re-enable Yosys synthesis
0891b2f [aes,pre_sca] Modify evaluation parameters for PROLEAD
b9afd40 [aes,rtl] Switch to Bivium-based masking PRNG implementation
0726a6d [alma, aes] Add README for the verification flow
7e76564 [aes, alma] Add verification script for AES S-box
82dc6dc [alma] Add yosys template for AES S-box flattening
8354636 [alma] Add patching tool for techlib
25f488d [aes,dv] Fix aes_ctrl_cg sample function declaration
61a237e [util/reggen] reverse order of substruct generation
de31bdf [reggen] Remove the devmode input
895c541 [aes, doc] Clarify availability of sideload, change cryptolib link
ac5a127 [aes, pre_sca] Enable masking evaluation of AES with PROLEAD
5be278b [aes, kmac, otbn] Perform final clean -purge step in Yosys synthesis
2d0887b [aes,SiVal] Add features of AES module
78abd88 [aes, doc] Fix broken links
1b16ca2 [reggen] Add mubi support SWAccess that sets/clears a reg
59f8142 [doc] Moved badges over to using hosted images
7688e71 [reggen] Add initial support for version and cip_id hjson fields
fbd888e Revert "[reggen] Add CIP_IDs and bump all major versions"
ba2ca76 [aes, doc] Mention option of implementing GCM with Ibex and bitmanip
9bc003c [aes, kmac] Replace term aggravate in SCA/FI context
4dc21fb [aes, pre_dv] Add very basic scratch Verilator testbench for cipher core
0ba10b3 [reggen] Add CIP_IDs and bump all major versions
5b12b34 [aes, dv] Enable aes_stress_all(_with_rand_reset) tests
69fa03a [aes, dv] Move end detection of last message from scoreboard to env
3dbbf0b [aes, dv] Rework tracking of good, corrupted, split and skipped messages
af95b78 [aes, dv] Encapsulate vseqs in fork/join_any and disable fork blocks
30aee10 [aes, dv] Add randomization constraints for aes_alert_reset_vseq
f1dcf7a [aes, dv] Reorder test list, add comments to explain grouping
2526b01 [aes, dv] Fix aes_manual_config_err_vseq
cb90c98 [aes, dv] Fix cfg_error_type constraint resolution for aes_message_item
e47df29 [misc] Use lc_tx_t testing functions at endpoints
6744fe2 [aes, dv] Switch from csr_update() to csr_wr() for set_regwen()
f2b781b [aes, dv] Move regwen testing into base sequence
9cb2a1c [aes, dv] Add alert_test testing to aes_alert_reset_test
9d0f701 [aes, dv] Increase manual operation percentage for config error test
89f58b3 [aes, dv] Simplify handling of different modes in process_tl_access()
b392590 [aes, dv] Enable configuration error testing with sideload keys
5255197 [aes, dv] Comment and fix usage of status_fsm() task inside send_msg()
bd45097 [aes, dv] Make sure aes_status_cg.cp_alert_recov is hit
be7bae1 [aes, dv] Always set PRNG reseed rate during setup_dut()

Issues closed since the Earlgrey-ES tapeout

DD (& DV)

• [aes, prim_lfsr, sca] Verification of the masked AES with PRNG #19091
  This issue led us to replacing the previous LFSR-based PRNG architecture with a PRNG based on a stream cipher primitive to avoid brute-forcing attacks on the PRNG state. The change is fully transparent to software and full security evaluation has been performed before merging the change.
• [aes] Consider adding a repetition check for the EDN interface #15777
  Closed as not planned as this is potential defense in depth.
• Aligning behavior on local caching of entropy for secure wipe #15473
  Closed as were not going change the behavior of our hardware blocks at this point. An issue to track the creation of guidelines has been created here [doc] Potential additions to comportability definition and specification #20680

DV

• [aes,dv] Fix coverage definition of AES operation (enc/dec) #20753
  When changing the corresponding configuration flag to a one-hot encoding, we forgot to align the coverage definition. This revealed a little coverage hole now tracked separately in [aes,dv] Randomly drive invalid operation values to fix coverage hole #20941
• [aes, dv] Extend tests to hit missing functional coverpoints #19039
  Various functional coverage holes got fixed.
• [aes, dv] Debug and enable stress_all test #19025
  Enable previously disabled (and failing) stress_all test

Doc

• [aes/doc] Mention possibility of implementing GCM with Ibex and bitmanip #17280
• [doc] Replace term "aggravate" in SCA/FI context  #17256

Community support requests

• opentitan aes module #20670
• IP AES aes_cipher_core  #19955
• [chip-test] yes #18154
• [aes] aes_core simulation using ModelSim #16994

Misc

• [chip-test] chip_sw_aes_masking_off #19985
  Erroneously created SiVal issue. The feature of interest only be tested with a SCA setup.
• [cryptotest/AES] Long-running uJSON session causes AES on device to fail #20277
  Non-AES-specific test failure discovered when requiring lots of entropy. The entropy complex wasn't configured properly.

Currently open issues

DD (& DV)

• [aes] Potential minor PRNG-related modifications for production  #21167
  Some follow-up work related to the PRNG. No area and timing impact but improving SCA hardening, requires a security evaluation again.
• [aes, kmac, sca] Repeat formal masking verification experiments prior to tapeout #16202
  Needs to be done by tapeout partner in secure environment close to tapeout.
• [top, aes] Disable SecAllowForcingMasks parameter #15674
  No changes for Earlgrey A1. We want to keep this feature to ease our own security analysis. The feature can be locked down in ROM_ext.

DV

• [aes,dv] Randomly drive invalid operation values to fix coverage hole #20941
  Fixing a small, uncritical coverage hole.
• [dv, test_vectors] Integrate AES test vectors into existing NIST vector testing package #7143
  DV cleanup work, uncritical and very low priority.

Misc

• [chip-test] chip_sw_aes_masking_off #21511
  Erroneously created SiVal issue. Duplicate of the closed [chip-test] chip_sw_aes_masking_off #19985

Summary

The only relevant RTL change in this block was #19091 where we replaced the LFSR-based PRNG
with an implementation based on the Bivium stream cipher primitive to prevent brute-forcing attacks on the PRNG state. The change itself is very isolated to the PRNG itself and all SCA experiments (including a newly set up simulation-based tool flow) have been repeated to ensure the change doesn't negatively impact the SCA hardening and the masking off feature still works as expected. The change is very well understood.

The block should still fulfill the D2S criteria.

[vogelpi]

@msfschaffner and @andreaskurth , would you mind reviewing this please?

Since there was just the isolated PRNG change in the RTL, I didn't downgrade AES to D1/V1. Hence, there is no associated PR for the sign-off. Similarly, the changes are fully transparent to software meaning no version increment is needed.

[vogelpi]

FYI @johngt

[msfschaffner]

Thanks for the analysis @vogelpi.
The analysis that we would have had to perform to go from D2 -> D2S has already been performed in this case, so leaving this at D2S sounds good from my side.