'
' OCP Lock: ENABLE_MPK API sequence diagram showing Caliptra FW/HW interactions
'
@startuml

!include utils.inc

note across
    <b>Preconditions:</b>
        * The HEK is present in a KV slot
end note

' Pre-existing state
$activate_kv(hek)
$activate(hpke)
$activate_kv(fw_cdi)

dfw -> cfw++ : ENABLE_MPK

alt VEK not yet initialized
    cfw -> drbg: Get random 256-bit seed

    $preconditioned_key_extract(random seed, cfw, HEK, hek, VEK, vek)

    cfw -> cfw: Zeroize random seed
end

cfw -> sek **: Populate SEK from mailbox command
$activate(sek)

$preconditioned_key_extract(SEK, sek, HEK, hek, EPK, epk)

$zeroize(sek)

$hpke_unwrap(ak, "")

$preconditioned_key_extract(Access key, ak, EPK, epk, Locked MPK Encryption Key, encryption_key)

$zeroize(epk)
$zeroize(ak)

$preconditioned_aes_decrypt(encryption_key, encryption_subkey, locked MPK, mpk)

$preconditioned_aes_encrypt(vek, vek_subkey, ready MPK, mpk)

cfw -> dfw: Command response\nand Enabled MPK
cfw--

@enduml
