PSA_IOT_PROFILE_1 attestation Certification Reference - TF-M

12 May 2025


      Hi,
Per https://datatracker.ietf.org/doc/html/draft-tschofenig-rats-psa-token-07 (which is latest spec I can find for profile 1 token):
The Certification Reference claim is used to link the class of chip and PSA RoT of the attesting device to an associated entry in the PSA Certification database. It MUST be represented as a thirteen-digit [EAN-13https://www.gs1.org/standards/barcodes/ean-upc].¶https://datatracker.ietf.org/doc/html/draft-tschofenig-rats-psa-token-07#section-3.2.3-1
Linking to the PSA Certification entry can still be achieved if this claim is not present in the token by making an association at a Verifier between the reference value and other token claim values - for example, the Implementation ID.¶https://datatracker.ietf.org/doc/html/draft-tschofenig-rats-psa-token-07#section-3.2.3-2
psa-certification-reference-type = text .regexp "[0-9]{13}"
psa-certification-reference = (
? psa-certification-reference-key =>
psa-certification-reference-type
)
But in the tf-m-tools repo:
iat-verifier\iatverifier\psa_iot_profile1_token_claims.py it checks for PSA 2.0 profile HW version which is EAN-13 + 5.
class HardwareVersionClaim(AttestationClaim):
    """Class representing a PSA Attestation Token Hardware version claim"""
    def verify(self, token_item):
        self._check_type('HARDWARE_VERSION', token_item.value, str)
value_len = len(token_item.value)
        expected_len = 19 # 'EAN13-Version' 13 + 1 + 5. e.g.:0604565272829-10010
        if len(token_item.value) != expected_len:
            msg = 'Invalid HARDWARE_VERSION length; must be {} characters, found {} characters'
            self.verifier.error(msg.format(expected_len, value_len))
        for idx, character in enumerate(token_item.value):
            if character not in string.digits:
                if idx != 13 or character not in '-':
                    msg = 'Invalid character {} at position {}'
                    self.verifier.error(msg.format(character, idx+1))
It seems like this was changed 3yrs ago:
SHA-1: 8ac8d17d15353c7f7933ae8065646946ae47f993
* Fix HW Version claim expected length
www.psacertified.org issuing HW versions of format '[0-9]{13}-[0-9]{5}'.
It is called 'certification reference':
https://www.psacertified.org/certified-products/
Signed-off-by: Tamas Ban tamas.ban@arm.com
Change-Id: I0417e1ce76896f1128864676f29a4314b3fd1fb8
When I run "check_iat" script, I get these errors:
./scripts/check_iat -k public_key.pem -K -p -t PSA-IoT-Profile1-token cc27xx.cbor
ERROR:iat-verifiers:Invalid HARDWARE_VERSION length; must be 19 characters, found 13 characters
ERROR:iat-verifiers:Invalid character i at position 1
ERROR:iat-verifiers:Invalid character r at position 2
ERROR:iat-verifiers:Invalid character m at position 3
ERROR:iat-verifiers:Invalid character w at position 4
ERROR:iat-verifiers:Invalid character a at position 5
ERROR:iat-verifiers:Invalid character r at position 6
ERROR:iat-verifiers:Invalid character e at position 7
ERROR:iat-verifiers:Invalid character . at position 8
ERROR:iat-verifiers:Invalid character o at position 9
ERROR:iat-verifiers:Invalid character r at position 10
ERROR:iat-verifiers:Invalid character g at position 11
ERROR:iat-verifiers:Invalid character  at position 12
ERROR:iat-verifiers:Invalid character  at position 13
Is the verifier tool incorrect or should I be following "EAN13-Version' 13 + 1 + 5" even for profile 1 token?
Regards,
Brian Quach
SimpleLink MCU
Texas Instruments Inc.
12500 TI Blvd, MS F-4000
Dallas, TX 75243
214-479-4076