> Markdown version of https://docs.laavat.io/glossary/ from the LAAVAT PKI and Signing Platform documentation. All pages: https://docs.laavat.io/llms.txt # Understand key terms and concepts used in the LAAVAT Platform ## Definitions Acronyms and Abbreviations Term/Acronym | Description ------------------|---------------------------- AAD |Azure Active Directory AHAB |[Advanced High Assurance Boot](https://spsdk.readthedocs.io/en/v3.0.0/images/ahab.html) AES |Advanced Encryption Standard Ansible |Ansible is an open-source software provisioning, configuration management, and application-deployment tool enabling infrastructure as code. Ansible Vault |Ansible encrypted storage. API |Application Programming Interface Approval rule |Per-operation rule naming which identity-provider groups may submit a request and which may approve it. A *blanket* group is auto-approved, which is how unattended CI signs. Artifactory |[JFrog Enterprise Universal Repository Manager](https://jfrog.com/artifactory/) AWS |[Amazon Web Services](https://aws.amazon.com/) Blanket group |A group named in an approval rule whose submissions are approved automatically, without a second person. Used for CI pipelines; it bypasses two-person review, so scope it narrowly. Bootgen |AMD/Xilinx tool and image format for Zynq and Zynq UltraScale+ boot images. CA |Certificate Authority CI/CD |Combined practices of continuous integration, continuous delivery, and continuous deployment. CP |Certificate Policy is a named set of rules that indicates the applicability of a certificate to a particular community and class of application with common security requirements. For example, a particular CP might indicate the applicability of a type of certificate to the authentication of parties engaging in business-to-business transactions for the trading of goods or services within a given price range. [rfc3647](https://www.ietf.org/rfc/rfc3647.txt) CPS |Certificate Practice Statement is a statement of the practices that a certification authority employs in issuing, managing, revoking, and renewing or re-keying certificates. [rfc3647](https://www.ietf.org/rfc/rfc3647.txt) CRA |[EU Cyber Resilience Act](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) (Regulation (EU) 2024/2847), which sets mandatory cybersecurity requirements for products with digital elements. CRL |Certificate Revocation List — the published list of certificates revoked before their expiry. CSF |Command Sequence File (Used in HAB) CSR |Certificate Signing Request — a request containing a public key and subject details, submitted to a CA to be signed into a certificate. CST |NXP Code Signing Tool. Command-line tool used to sign HAB (i.MX6/7/8M) and, legacy, AHAB images. Docker |Docker is a tool designed to make it easier to create, deploy, and run applications by using containers. Containers allow a developer to package up an application with all of the parts it needs, such as libraries and other dependencies, and deploy it as one package. EC |Elliptic Curve ECDSA |Elliptic Curve Digital Signature Algorithm EFK |Elasticsearch, Fluentd, and Kibana for logging. Escrow |A controlled key-recovery path. Superseded on the platform by the export paths described in [key custody and export](https://docs.laavat.io/security/#key-custody-and-export). EST |[Enrollment over Secure Transport](https://datatracker.ietf.org/doc/html/rfc7030) (RFC 7030), the protocol used for automated device certificate enrollment. Exportable token |A product key (AES, RSA or EC) held by an `ExportableToken` operation, which has no operation behind it. It is always extractable and exists only to be exported; see [key custody and export](https://docs.laavat.io/security/#key-custody-and-export). Extractable |A platform flag on an encryption key token allowing that key to be wrapped out of the platform online. Valid only on encryption keys — the platform rejects it on signing keys. Exportable tokens are always extractable. FIT |Flattened Image Tree — the U-Boot multi-component image format, which supports signatures over its constituent images. Fluentd |An open-source data collector for unified logging layer. Fusemap |The set of values to be burned into a device's one-time-programmable fuses, such as an SRK hash or an AES key. Golang |Golang is a statically typed, compiled programming language designed at Google. HA |High Availability. HAB |[High Assurance Boot](https://community.nxp.com/docs/DOC-105193) HKDF |HMAC Key Derivation function HMAC |Keyed-hash message authentication code (HMAC) is a specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key. HSM |A Hardware Security Module (HSM) is a physical computing device that safeguards and manages digital keys for strong authentication and provides crypto processing. HW |Hardware IDevID |Initial Device Identifier — a long-lived device identity certificate installed during manufacturing ([IEEE 802.1AR](https://standards.ieee.org/ieee/802.1AR/7115/)). See [Trusted device identities](https://docs.laavat.io/solutions/trusted-device-identities/). IMG |Image signing certificate in HAB IoT |The Internet of things (IoT) is the extension of Internet connectivity into physical devices and everyday objects. IP |Intellectual Property ISG |Installation and Setup Guide IV |Initialization Vector Jenkins |Open source automation server [www.jenkins.io](https://www.jenkins.io) JWE |JSON Web Encryption [rfc7516](https://tools.ietf.org/html/rfc7516) KEK |Key Encryption Key Kubernetes(K8s) |Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. K8s cluster |Set of virtual machines implementing the K8 system. LDevID |Local Device Identifier — an operationally issued device identity certificate, typically enrolled in the field against an IDevID ([IEEE 802.1AR](https://standards.ieee.org/ieee/802.1AR/7115/)). See [Trusted device identities](https://docs.laavat.io/solutions/trusted-device-identities/). MCUboot |[MCUboot](https://www.mcuboot.com/) — a secure bootloader for 32-bit microcontrollers. ML-DSA |Module-Lattice-Based Digital Signature Algorithm, the NIST post-quantum signature standard [FIPS 204](https://csrc.nist.gov/pubs/fips/204/final). Supported as the key types `MLDSA44`, `MLDSA65` and `MLDSA87`; see [supported keys](https://docs.laavat.io/appendixes/supported-keys/#post-quantum-ml-dsa). MS Graph |Microsoft Graph is the gateway to data and intelligence in Microsoft 365. Nginx |Nginx [engine x] is an HTTP and reverse proxy server, a mail proxy server, and a generic TCP/UDP proxy server. OCI |The Open Container Initiative (OCI) is a Linux Foundation project, started in June 2015 by Docker, to design open standards for operating-system-level virtualization (software containers), most importantly Linux containers. PKI |Public Key Infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store & revoke digital certificates and manage public-key encryption. Product |The central configuration object in the platform: the keys, PKI and operations belonging to one device, product family or use case. Product operation |A callable action on a product — for example a signing or encryption operation — with its own key token and approval rule. Prometheus |Prometheus is an open-source system monitoring and alerting toolkit. R&D |Research and Development RAUC |[Robust Auto-Update Controller](https://rauc.io/) — an update framework for embedded Linux, using signed update bundles. REST |Representational State Transfer (REST) RSA |RSA (Rivest–Shamir–Adleman) is one of the first public-key cryptosystems. RSA-PSS |RSA signature scheme with PSS padding. Required for RSA AHAB SRK certificates signed via SPSDK. SBOM |Software Bill of Materials — an inventory of the components in a product, required for CRA vulnerability handling. SBSFU |Secure Boot and Secure Firmware Update — STMicroelectronics' secure boot framework. SGK |Subordinate key of the SRK key and is used to verify signatures across product software. signing-tool |The reference client — a Python CLI published on PyPI that drives every platform operation from a desktop or CI/CD. SPSDK |[NXP Secure Provisioning SDK](https://spsdk.readthedocs.io/). Tool used by the platform to sign AHAB boot containers (the SignSPSDK operation). SRK |Super Root Key. A key pair (RSA or elliptic-curve) that forms the start of the boot-time authentication chain. SRK Hash |Hash value of the SRK table. Sub-CA |Subordinate Certificate Authority SW |Software TLS |Transport Layer Security Truststore |A CA trust list uploaded to the platform, used to validate mTLS, EST or provisioning client certificates. UML |Unified Modeling Language X.509 |X.509 is a standard defining the format of public key certificates. [rfc5280](https://tools.ietf.org/html/rfc5280) YAML |(a recursive acronym for "YAML Ain't Markup Language") is a human-readable data-serialization language. # |Commands prefixed with this are run as root $ |Commands prefixed with this are run as user