tree 0f4d5afbb9af0e28e822e569332a22036ef9cb51
parent 0fc5403e0904b959b446311e462c75259375b88e
author Sandrine Bailleux <sandrine.bailleux@arm.com> 1580997554 +0100
committer Sandrine Bailleux <sandrine.bailleux@arm.com> 1582538499 +0100

Introduce a new "dualroot" chain of trust

This new chain of trust defines 2 independent signing domains:

1) One for the silicon firmware (BL1, BL2, BL31) and optionally the
   Trusted OS. It is rooted in the Silicon ROTPK, just as in the TBBR
   CoT.

2) One for the Normal World Bootloader (BL33). It is rooted in a new key
   called Platform ROTPK, or PROTPK for short.

In terms of certificates chain,

- Signing domain 1) is similar to what TBBR advocates (see page 21 of
  the TBBR specification), except that the Non-Trusted World Public Key
  has been removed from the Trusted Key Certificate.

- Signing domain 2) only contains the Non-Trusted World Content
  certificate, which provides the hash of the Non-Trusted World
  Bootloader. Compared to the TBBR CoT, there's no Non-Trusted World
  Key certificate for simplicity.

Change-Id: I62f1e952522d84470acc360cf5ee63e4c4b0b4d9
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>