🔑 Caliptra PK Hash Calculator

Compute vendor and owner PK hashes for Caliptra fuse programming.

About

Caliptra uses SHA-384 hashes of public key structures to validate firmware signatures. These hashes are programmed into fuses/OTP during manufacturing.

Vendor PK hash uses two-level hashing: each individual key (ECC, MLDSA) is SHA-384 hashed, then those per-key digests are packed into an ImageVendorPubKeyInfo descriptor (1736 bytes: 4 + 4×48 + 4 + 32×48) which is itself SHA-384 hashed. LMS keys are not included in the hash — only ECC and MLDSA per-key hashes populate the descriptor.

Owner PK hash is a single-level hash: the owner ECC key (96 bytes) and MLDSA key (2592 bytes) are concatenated into ImageOwnerPubKeys (2688 bytes) and SHA-384 hashed directly.

Pre-fills with caliptra-image-fake-keys test values

Vendor PK Hash

Computing...
Per-key SHA-384 hashes (intermediate)
Vendor ECC Keys (4 × 96 bytes)
Vendor MLDSA Keys (4 × 2592 bytes)

Owner PK Hash

Computing...
Owner ECC Key (96 bytes)
Owner MLDSA Key (2592 bytes)