Hi

I am trying to use iatverifier tool from tf-m-tools repo to verify token and it seems like the values for Security Lificycle in the tool are wrong, because:

this spec https://www.ietf.org/archive/id/draft-tschofenig-rats-psa-token-21.html defines them as

psa-lifecycle-unknown-type = 0x0000..0x00ff

psa-lifecycle-assembly-and-test-type = 0x1000..0x10ff

psa-lifecycle-psa-rot-provisioning-type = 0x2000..0x20ff

psa-lifecycle-secured-type = 0x3000..0x30ff

psa-lifecycle-non-psa-rot-debug-type = 0x4000..0x40ff

psa-lifecycle-recoverable-psa-rot-debug-type = 0x5000..0x50ff

psa-lifecycle-decommissioned-type = 0x6000..0x60ff

Which is consistent with values of tfm_security_lifecycle_t enum in TFM

enum tfm_security_lifecycle_t {

    TFM_SLC_UNKNOWN                   = 0x0000u,

    TFM_SLC_ASSEMBLY_AND_TEST         = 0x1000u,

    TFM_SLC_PSA_ROT_PROVISIONING      = 0x2000u,

    TFM_SLC_SECURED                   = 0x3000u,

    TFM_SLC_NON_PSA_ROT_DEBUG         = 0x4000u,

    TFM_SLC_RECOVERABLE_PSA_ROT_DEBUG = 0x5000u,

    TFM_SLC_DECOMMISSIONED            = 0x6000u,

    TFM_SLC_MAX_VALUE                 = UINT32_MAX,

};

But in the tf-m-tools/iat-verifier/iatverifier/psa_iot_profile1_token_claims.py these values are defined differently

    # Security Lifecycle claims

    SL_UNKNOWN = 0x1000

    SL_PSA_ROT_PROVISIONING = 0x2000

    SL_SECURED = 0x3000

    SL_NON_PSA_ROT_DEBUG = 0x4000

    SL_RECOVERABLE_PSA_ROT_DEBUG = 0x5000

    SL_PSA_LIFECYCLE_DECOMMISSIONED = 0x6000

Thus I am getting SL_UNKNOWN instead of TFM_SLC_ASSEMBLY_AND_TEST

Is this a known issue? Can this be fixed?

Regards,

Bohdan Hunko

Cypress Semiconductor Ukraine

Engineer

CSUKR CSS ICW SW FW

Mobile: +38099 50 19 714
Bohdan.Hunko@infineon.com