Feasibility of granting ROM access to LDevID CDI after update-reset

[bluegate010]

In 1.x we prevent ROM from ever having access to the LDevID CDI again after cold-boot. We make this work for DICE by allowing ROM to access AliasFMC CDI upon update-reset, and enforcing that FMC cannot change across update-resets.

This is causing some issues with Stable Identity, where ideally ROM would have access to a stable secret on update-reset that it can use to derive stable keys for new FW. Without this feature we can still derive stable keys, but those keys will be based on the minimum SVN that has run since cold-boot, not the currently-running SVN. Update-resets that rev the SVN from X to X+1 will not yield new keys for the new firmware; a cold-reset would be required.

So: is it still advised that we cannot safely latch away a stable secret such that it becomes available again upon update-reset? Or could we alter ROM to preserve LDevID CDI?