secure_boot_s_keys.c

uint8_t SK_T[64];
uint8_t PK_S[32];
uint8_t SK_S[64];
sha3_ctx_t hash_ctx;
uint8_t seed[64];

// uint8_t S_H[64] has been previously computed

/* Retrieve SK_T and prevent any subsequent
   software from accessing it */
get_sk_t(SK_T);
hide_sk_t_until_reboot();

/* Hash SK_T and the measurement of S to
   produce a seed for S's keys */

sha3_init(&hash_ctx, 32);
sha3_update(&hash_ctx, SK_T, 64);
sha3_update(&hash_ctx, S_H, 64);
sha3_final(seed, &hash_ctx);
// derive keys from seed in scratchpad
ed25519_create_keypair(PK_S, SK_S, seed);

/* don't forget to clean up private information before boot */