secure_boot_endorse_s.c

sha3_ctx_t hash_ctx;
uint8_t cert_hash[64];
uint8_t cert_sig[64];
extern uint8_t PK_T[32];

// uint8_t S_H[64] has been previously computed
// uint8_t PK_S[32] has been previously computed
// uint8_t PK_T[32] has been previously retrieved

/* Hash the parts of the certificate into one message */
sha3_init(&hash_ctx, 64);
sha3_update(&hash_ctx, S_H, 64);
sha3_update(&hash_ctx, PK_S, 32);
sha3_final(cert_hash, &hash_ctx);

/* Sign the message with SK_T */
ed25519_sign(cert_sig, cert_hash, 64, PK_T, SK_T);