Caliptra integrator requirements out-of-date

[varuns-nvidia]

https:/chipsalliance/caliptra-rtl/blob/main/docs/CaliptraIntegrationSpecification.md#soc-integration-requirements
Has outdated items like CSR signing key.
Scrub against main spec to ensure all requirements are captured (IDevID certificate requirements is one example gap)

[bharatpillilli]

There is an ongoing PR to add couple of rows for to that table and we will also remove the CSR signing key rows...what else HW integ requirements exist for IDevID?

[varuns-nvidia]

The high-level problem is that the main spec doesn't explicitly call out requirements to integrators. Scrubbing through it, here's what I think we need to add here:

1. Explicitly note what fuses need to be backed by physical fuses. For example, owner_pk_hash can come from flash instead, but field entropy threat model assumes fuse.
2. Must program the IDevID certificate with fields defined per https:/chipsalliance/Caliptra/blob/main/doc/Caliptra.md#idevid-certificate
3. Must use internal TRNG for production
4. Add https:/chipsalliance/Caliptra/blob/main/doc/Caliptra.md#fuse-requirements
5. Clarify the powergood reset intention with regard to firmware recovery flows

[bharatpillilli]

@varuns-nvidia - I think number#3 point above is a change in POR from what we have been stating. Not everyone has been conveying to us exactly how they intend to implement TRNG. I would rather say "suggest" than "must".

[varuns-nvidia]

@varuns-nvidia - I think number#3 point above is a change in POR from what we have been stating. Not everyone has been conveying to us exactly how they intend to implement TRNG. I would rather say "suggest" than "must".

Fair, can interpret the change here as non-mandatory chipsalliance/Caliptra@52c7100

[andreslagarcavilla]

Is this bug resolved now?