[pa] add protos / stub for GenLcToken RPC

This adds protos and a function stub for the `GenLcToken` RPC call
which the PA must implement to support OpenTitan A1 provisioning flows.

This RPC function will generate test unlock/exit LC tokens and RMA
tokens to inject into an OpenTitan device during provisioning.

This partially addresses #4.

Signed-off-by: Tim Trippel <[email protected]>

src/pa/proto/pa.proto

@@ -23,6 +23,8 @@ service ProvisioningApplianceService {
  returns (CreateKeyAndCertResponse) {}
  rpc EndorseCerts(EndorseCertsRequest)
  returns (EndorseCertsResponse) {}
+ rpc GenLcToken(GenLcTokenRequest)
+ returns (GenLcTokenResponse) {}
  rpc SendDeviceRegistrationPayload(RegistrationRequest)
  returns (RegistrationResponse) {}
 }
@@ -46,6 +48,55 @@ message EndorseCertsResponse {
  repeated crypto.cert.Certificate certs = 1;
 }
 
+// OpenTitan Lifecycle Token Types.
+enum LcTokenType {
+ // Unspecified.
+ LC_TOKEN_TYPE_UNSPECIFIED = 0;
+ // Test Unlock Token.
+ LC_TOKEN_TYPE_TEST_UNLOCK = 1;
+ // Test Exit Token.
+ LC_TOKEN_TYPE_TEST_EXIT = 2;
+ // RMA Token.
+ LC_TOKEN_TYPE_RMA = 3;
+}
+
+// OpenTitan Lifecycle Token Formats.
+enum LcTokenFormat {
+ // Unspecified.
+ LC_TOKEN_FORMAT_UNSPECIFIED = 0;
+ // Raw.
+ //
+ // This format is used when the raw token must be generated in order to move
+ // the device from one LC state to another.
+ LC_TOKEN_FORMAT_RAW = 1;
+ // Hashed.
+ //
+ // This format is used when the cSHAKE128 hashed form of the token needs to
+ // be generated to program into the device's OTP memory.
+ //
+ // protolint:disable:next MAX_LINE_LENGTH
+ // See https://opentitan.org/book/hw/ip/lc_ctrl/doc/theory_of_operation.html#token-hashing-mechanism
+ // for more details on how OpenTitan LC tokens are stored in OTP.
+ LC_TOKEN_FORMAT_HASHED = 2;
+}
+
+// Generate lifecycle token request.
+message GenLcTokenRequest {
+ // Device identifier. Required.
+ device_id.DeviceId device_id = 1;
+ // Lifecycle token type. Required.
+ LcTokenType token_type = 2;
+ // Lifecycle token format. Required.
+ LcTokenFormat token_format = 3;
+}
+
+// Generate lifecycle token response.
+message GenLcTokenResponse {
+ // A 128 bit LC token in either raw or hashed form (based on request sent).
+ // Size is enforced at a higher level.
+ bytes token = 1;
+}
+
 // Create key and endorsement certificates request.
 // The `sku` fields is used as an unique key to
 // implement the specific key gen and endorsement certificate flow for a

src/pa/services/pa.go

@@ -108,6 +108,14 @@ func (s *server) EndorseCerts(ctx context.Context, request *pbp.EndorseCertsRequ
  return nil, nil
 }
 
+// GenLcToken generates a specific OpenTitan Lifecycle Token and returns it.
+func (s *server) GenLcToken(ctx context.Context, request *pbp.GenLcTokenRequest) (*pbp.GenLcTokenResponse, error) {
+ log.Printf("In PA - Recieved GenLcToken request for DeviceID: %v", request.DeviceId)
+
+ // TODO(#4) implement backend operations.
+ return nil, nil
+}
+
 // SendDeviceRegistrationPayload registers a new device record to the local MySql DB.
 func (s *server) SendDeviceRegistrationPayload(ctx context.Context, request *pbp.RegistrationRequest) (*pbp.RegistrationResponse, error) {
  log.Printf("In PA - Received SendDeviceRegistrationPayload request with DeviceID: %v", request.DeviceRecord.Id)