refactor(fw): make TBOR CU/CO session masking key 32 B AES-256-GCM - #578
Closed
vsonims wants to merge 1 commit into
Closed
refactor(fw): make TBOR CU/CO session masking key 32 B AES-256-GCM#578vsonims wants to merge 1 commit into
vsonims wants to merge 1 commit into
Conversation
The TBOR SessionEx (CU/CO) per-session `masking_key` was carried as an 80 B `aes32 ‖ hmac48` key shaped for the legacy `key_masking::cbc` MBOR masked-key system, even though TBOR masked keys are (and will be) wrapped with `key_masking::aead` (AES-256-GCM), which needs only a 32 B key. The extra 48 B were dead weight in every CU/CO session blob and blurred the key's purpose. Reshape the SessionEx masking key to a native 32 B AES-256-GCM key: * `SESSION_MASKING_KEY_LEN` 80 → 32 (CU/CO only). The legacy MBOR `Session` blob keeps its 80 B cbc key via the std/uno-PAL-local `SESSION_MASKING_KEY_SIZE`, so MBOR's cbc masked-key system is unaffected. * std + uno PAL: CU/CO blob shrinks (CU 120→72 B, CO 216→168 B); the std `session_masking_key` reader now sizes the returned key by blob kind — 32 B for SessionEx blobs, 80 B for the legacy Session blob — so MBOR still reads its full 80 B key. `session_promote` validation follows the const. * `session_open_finish` derives the 32 B key (auto via the const); the `bmk_session` envelope is variable-length (`BMK_SESSION_MAX_LEN`), so the shorter payload needs no schema change. Foundational for the upcoming TBOR HMAC/crypto masked-key commands, which resolve a scope's 32 B AEAD masking key uniformly (Session → this key). Validation: TBOR emu 108/108 (CU + CO sessions, close, reopen, SD roundtrips); MBOR emu 225/225 (masked_key, unmask_key, aes_gen, live-migration/reopen — legacy 80 B path intact); std + uno fmt + clippy clean. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0b09e50a-a9be-4bae-b347-d42dc775a258
Contributor
There was a problem hiding this comment.
Pull request overview
Refactors the firmware’s TBOR SessionEx (CU/CO) per-session masking_key to be a native 32-byte AES-256-GCM key (for key_masking::aead) instead of the legacy 80-byte aes32 ‖ hmac48 shape used by MBOR’s CBC+HMAC masking system, reducing SessionEx blob sizes accordingly while keeping the legacy MBOR Session blob format intact.
Changes:
- Shrinks
SESSION_MASKING_KEY_LENfrom 80 → 32 bytes (explicitly for TBORSessionExsessions). - Updates Std + Uno PAL SessionEx blob sizing/validation to use the new 32-byte masking key length (CU 72 B, CO 168 B).
- Updates TBOR
session_open_finishdocumentation/comments to describe the masking key as AES-256-GCM (32 B).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| fw/plat/uno/fw/pal/src/session.rs | Adjusts Uno PAL SessionEx blob layout and argument validation to use the 32-byte SessionEx masking key. |
| fw/plat/std/pal/src/session.rs | Adjusts Std PAL SessionEx blob sizing and makes session_masking_key return a length based on blob kind (legacy Session vs SessionEx). |
| fw/pal/traits/src/lib.rs | Redefines SESSION_MASKING_KEY_LEN to 32 bytes and clarifies it is for TBOR SessionEx sessions. |
| fw/core/lib/src/ddi/tbor/session_open_finish.rs | Updates handler documentation to match the new 32-byte AES-256-GCM masking key intent for TBOR. |
Comment on lines
266
to
270
| // Build the length-discriminated SessionEx blob: | ||
| // PlainText: api_rev(8) ‖ param_key(32) ‖ masking_key(80) = 120 B | ||
| // Authenticated: above ‖ mac_tx(48) ‖ mac_rx(48) = 216 B | ||
| // PlainText: api_rev(8) ‖ param_key(32) ‖ masking_key(32) = 72 B | ||
| // Authenticated: above ‖ mac_tx(48) ‖ mac_rx(48) = 168 B | ||
| let blob_len = match mac_pair { | ||
| None => SESSION_CU_BLOB_SIZE, |
Comment on lines
+432
to
+437
| /// Length in bytes of the per-session `masking_key` for TBOR | ||
| /// **SessionEx (CU/CO)** sessions. | ||
| /// | ||
| /// 80 B = AES-CBC-256 key (32 B) ‖ HMAC-SHA-384 key (48 B). Consumed | ||
| /// by the `key_masking::cbc`-based MBOR masked-key system; unrelated to | ||
| /// [`SESSION_PARAM_KEY_LEN`] which now refers to the AEAD-GCM | ||
| /// per-session wrap key. Present for both CO and CU sessions. | ||
| pub const SESSION_MASKING_KEY_LEN: usize = 80; | ||
| /// 32 B AES-256-GCM key used by the `key_masking::aead`-based TBOR | ||
| /// masked-key system (masked keys are scoped and wrapped under AES-GCM). | ||
| /// Present for both CO and CU SessionEx blobs. Distinct from the legacy |
This was referenced Jul 18, 2026
Collaborator
Author
|
Folded into #583, which is now based on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Foundational fw-only change for the upcoming TBOR HMAC / crypto masked-key command family.
The TBOR SessionEx (CU/CO) per-session
masking_keywas an 80 Baes32 ‖ hmac48key shaped for the legacykey_masking::cbcMBOR masked-key system. TBOR masked keys are wrapped withkey_masking::aead(AES-256-GCM), which needs only a 32 B key — so the extra 48 B were dead weight and blurred the key's purpose.This reshapes the SessionEx masking key to a native 32 B AES-256-GCM key.
Changes
SESSION_MASKING_KEY_LEN80 → 32 (CU/CO only). The legacy MBORSessionblob keeps its 80 B cbc key via the std/uno-PAL-localSESSION_MASKING_KEY_SIZE, so MBOR's cbc masked-key system is unaffected.session_masking_keyreader now sizes the returned key by blob kind — 32 B for SessionEx blobs, 80 B for the legacy Session blob — so MBOR still reads its full 80 B key.session_promotevalidation follows the const.session_open_finish: derives the 32 B key (auto via the const);bmk_sessionis variable-length (BMK_SESSION_MAX_LEN), so the shorter payload needs no schema change.Why safe
The CU/CO masking key is consumed by nothing today —
session_masking_keyis only read by MBOR's masked-key handlers, and only from legacySessionblobs. The host never derives this key (fw-only).Validation
session_close, reopen, SD roundtrips.masked_key,unmask_key,aes_gen,rsa_unwrap,live_migration/reopen (legacy 80 B path intact).cargo check+clippyclean; nightlyfmtclean.