1*91f16700Schasinglulu@startuml 2*91f16700Schasingluluskinparam ParticipantPadding 10 3*91f16700Schasingluluskinparam BoxPadding 10 4*91f16700Schasinglulubox AP 5*91f16700Schasingluluparticipant RMM 6*91f16700Schasingluluparticipant BL31 7*91f16700Schasingluluendbox 8*91f16700Schasinglulubox RSS 9*91f16700Schasingluluparticipant DelegAttest 10*91f16700Schasingluluparticipant InitAttest 11*91f16700Schasingluluparticipant MeasuredBoot 12*91f16700Schasingluluparticipant Crypto 13*91f16700Schasingluluendbox 14*91f16700Schasinglulu 15*91f16700Schasinglulu== RMM Boot phase == 16*91f16700Schasinglulu 17*91f16700SchasingluluRMM -> BL31: get_realm_key(\n\t**hash_algo**, ...) 18*91f16700SchasingluluBL31 -> DelegAttest: get_delegated_key 19*91f16700SchasingluluDelegAttest -> MeasuredBoot: read_measurement 20*91f16700SchasingluluRnote over DelegAttest: Compute input\n\ for key derivation\n\ (hash of measurements) 21*91f16700SchasingluluDelegAttest -> Crypto: derive_key 22*91f16700SchasingluluRnote over DelegAttest: Compute public key\n\ hash with **hash_algo**. 23*91f16700SchasingluluRnote over Crypto: Seed is provisioned\n\ in the factory. 24*91f16700SchasingluluDelegAttest --> BL31: get_delegated_key 25*91f16700SchasingluluBL31 --> RMM: get_realm_key 26*91f16700SchasingluluRnote over RMM: Only private key\n\ is returned. Public\n\ key and its hash\n\ must be computed.\n\ 27*91f16700SchasingluluPublic key is included\n\ in the realm token.\n\ Its hash is the input\n\ for get_platform_token 28*91f16700SchasingluluRMM -> BL31: get_platform_token(\n\t**pub_key_hash**, ...) 29*91f16700SchasingluluBL31 -> DelegAttest: get_delegated_token 30*91f16700SchasingluluRnote over DelegAttest: Check **pub_key_hash**\n\ against derived key. 31*91f16700SchasingluluDelegAttest -> InitAttest: get_initial_token 32*91f16700SchasingluluRnote over InitAttest: Create the token including\n\ the **pub_key_hash** as the\n\ challenge claim 33*91f16700SchasingluluInitAttest -> MeasuredBoot: read_measurement 34*91f16700SchasingluluInitAttest -> Crypto: sign_token 35*91f16700SchasingluluInitAttest --> DelegAttest: get_initial_token 36*91f16700SchasingluluDelegAttest --> BL31: get_delegated_token 37*91f16700SchasingluluBL31 --> RMM: get_platform_token 38*91f16700SchasingluluRnote over RMM: Platform token is\n\ cached. It is not\n\ changing within\n\ a power cycle. 39*91f16700Schasinglulu@enduml 40