device-identity-provisioning: add keypair discovery and rename to Att…

[fdamato]

…ested CSR

[fdamato]

Following up on our earlier discussion on attesting components involved in Attested CSR key derivation.

Recap

• The current OID list does not map 1:1 across all RoTs.
• This can force vendors to define custom OIDs for valid DICE derivation inputs not covered by OCP.
• A single fixed bitfield is cheaper, but may be too rigid for vendor-specific needs.

Proposal

Define a CDDL map: OID -> Bitfield.

1. OCP global OID (required)
   One OCP-defined OID maps to a common high-level bitfield:

   • UDS
   • FIELD_ENTROPY
   • OWNER_PROVISIONED_NON_CONFIDENTIAL_FUSE
   • VENDOR_PROVISIONED_NON_CONFIDENTIAL_FUSE
   • FIRST_MUTABLE_CODE
   • RUNTIME_FIRMWARE

2. Vendor OIDs (optional)
   Vendors may add their own OIDs with vendor-specific bitfields for additional derivation components.

Why this helps

• Keeps encoding compact (bitfields).
• Preserves a mandatory baseline all operators can interpret.
• Allows extensibility without requiring every vendor to mint OIDs just to participate.

Would this approach work for the team? Happy to hear objections or gaps.

[xiaoyuruan]

I think it's a good idea starting point, Fabrizio.
We can make the global set more comprehensive and cover all common components, so most adopters other than Caliptra would not need to define their own list.

Following up on our earlier discussion on attesting components involved in Attested CSR key derivation.

Recap

• The current OID list does not map 1:1 across all RoTs.
• This can force vendors to define custom OIDs for valid DICE derivation inputs not covered by OCP.
• A single fixed bitfield is cheaper, but may be too rigid for vendor-specific needs.

Proposal

Define a CDDL map: OID -> Bitfield.

1. OCP global OID (required)
   One OCP-defined OID maps to a common high-level bitfield:

   • UDS
   • FIELD_ENTROPY
   • OWNER_PROVISIONED_NON_CONFIDENTIAL_FUSE
   • VENDOR_PROVISIONED_NON_CONFIDENTIAL_FUSE
   • FIRST_MUTABLE_CODE
   • RUNTIME_FIRMWARE

2. Vendor OIDs (optional)
   Vendors may add their own OIDs with vendor-specific bitfields for additional derivation components.

Why this helps

• Keeps encoding compact (bitfields).
• Preserves a mandatory baseline all operators can interpret.
• Allows extensibility without requiring every vendor to mint OIDs just to participate.

Would this approach work for the team? Happy to hear objections or gaps.

[xiaoyuruan]

The Friday WG reviewed this PR and approved it. Great job Fabrizio!