Repository: chipsalliance/caliptra-sw
Pull request #553 (2023-07-28 00:28:15)

[feat] LMS related updates
This PR adds the following LMS related changes:
	1. Removes owner pub key index from Preamble, Header, Fuse log.
	2. Logs Vendor pub key index to data vault.
	3. Extends Vendor pub key index to pcr 0.
	4. Logs Vendor pub key index to PCR log.


Patch:
diff --git a/common/src/fuse.rs b/common/src/fuse.rs
index 3a7b79b1..6f64d425 100644
--- a/common/src/fuse.rs
+++ b/common/src/fuse.rs
@@ -28,7 +28,6 @@ pub enum FuseLogEntryId {
     FuseRtSvn = 8,                  // 4 bytes
     VendorLmsPubKeyIndex = 9,       // 4 bytes  (From Manifest)
     VendorLmsPubKeyRevocation = 10, // 4 bytes  (From Fuse)
-    OwnerLmsPubKeyIndex = 11,       // 4 bytes  (From Manifest)
 }
 
 impl From<u32> for FuseLogEntryId {
@@ -44,7 +43,6 @@ impl From<u32> for FuseLogEntryId {
             8 => FuseLogEntryId::FuseRtSvn,
             9 => FuseLogEntryId::VendorLmsPubKeyIndex,
             10 => FuseLogEntryId::VendorLmsPubKeyRevocation,
-            11 => FuseLogEntryId::OwnerLmsPubKeyIndex,
             _ => FuseLogEntryId::Invalid,
         }
     }
diff --git a/common/src/pcr.rs b/common/src/pcr.rs
index 3eebc4df..f550954f 100644
--- a/common/src/pcr.rs
+++ b/common/src/pcr.rs
@@ -23,15 +23,16 @@ use zerocopy::{AsBytes, FromBytes};
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PcrLogEntryId {
     Invalid = 0,
-    DeviceLifecycle = 1,      // data size = 1 byte
-    DebugLocked = 2,          // data size = 1 byte
-    AntiRollbackDisabled = 3, // data size = 1 byte
-    VendorPubKeyHash = 4,     // data size = 48 bytes
-    OwnerPubKeyHash = 5,      // data size = 48 bytes
-    VendorPubKeyIndex = 6,    // data size = 1 byte
-    FmcTci = 7,               // data size = 48 bytes
-    FmcSvn = 8,               // data size = 1 byte
-    FmcFuseSvn = 9,           // data size = 1 byte
+    DeviceLifecycle = 1,       // data size = 1 byte
+    DebugLocked = 2,           // data size = 1 byte
+    AntiRollbackDisabled = 3,  // data size = 1 byte
+    VendorPubKeyHash = 4,      // data size = 48 bytes
+    OwnerPubKeyHash = 5,       // data size = 48 bytes
+    EccVendorPubKeyIndex = 6,  // data size = 1 byte
+    FmcTci = 7,                // data size = 48 bytes
+    FmcSvn = 8,                // data size = 1 byte
+    FmcFuseSvn = 9,            // data size = 1 byte
+    LmsVendorPubKeyIndex = 10, // data size = 1 byte
 }
 
 impl From<u16> for PcrLogEntryId {
@@ -43,10 +44,11 @@ impl From<u16> for PcrLogEntryId {
             3 => PcrLogEntryId::AntiRollbackDisabled,
             4 => PcrLogEntryId::VendorPubKeyHash,
             5 => PcrLogEntryId::OwnerPubKeyHash,
-            6 => PcrLogEntryId::VendorPubKeyIndex,
+            6 => PcrLogEntryId::EccVendorPubKeyIndex,
             7 => PcrLogEntryId::FmcTci,
             8 => PcrLogEntryId::FmcSvn,
             9 => PcrLogEntryId::FmcFuseSvn,
+            10 => PcrLogEntryId::LmsVendorPubKeyIndex,
             _ => PcrLogEntryId::Invalid,
         }
     }
diff --git a/drivers/src/data_vault.rs b/drivers/src/data_vault.rs
index 3c2f0c64..29fb5609 100644
--- a/drivers/src/data_vault.rs
+++ b/drivers/src/data_vault.rs
@@ -72,7 +72,8 @@ pub enum ColdResetEntry4 {
     FmcSvn = 0,
     Reserved0 = 1,
     FmcEntryPoint = 2,
-    VendorPubKeyIndex = 3,
+    EccVendorPubKeyIndex = 3,
+    LmsVendorPubKeyIndex = 4,
 }
 
 impl TryFrom<u8> for ColdResetEntry4 {
@@ -81,7 +82,8 @@ impl TryFrom<u8> for ColdResetEntry4 {
         match value {
             0 => Ok(Self::FmcSvn),
             2 => Ok(Self::FmcEntryPoint),
-            3 => Ok(Self::VendorPubKeyIndex),
+            3 => Ok(Self::EccVendorPubKeyIndex),
+            4 => Ok(Self::LmsVendorPubKeyIndex),
             _ => Err(()),
         }
     }
@@ -349,23 +351,42 @@ impl DataVault {
         self.read_cold_reset_entry4(ColdResetEntry4::FmcEntryPoint)
     }
 
-    /// Set the vendor public key index used for image verification
+    /// Set the Ecc vendor public key index used for image verification
     ///
     /// # Arguments
     ///
     /// * `pk_index` - Vendor public key index
     ///
-    pub fn set_vendor_pk_index(&mut self, pk_index: u32) {
-        self.write_lock_cold_reset_entry4(ColdResetEntry4::VendorPubKeyIndex, pk_index);
+    pub fn set_ecc_vendor_pk_index(&mut self, pk_index: u32) {
+        self.write_lock_cold_reset_entry4(ColdResetEntry4::EccVendorPubKeyIndex, pk_index);
     }
 
-    /// Get the vendor public key index used for image verification.
+    /// Get the Ecc vendor public key index used for image verification.
     ///
     /// # Returns
     ///
     /// * `u32` - Vendor public key index
-    pub fn vendor_pk_index(&self) -> u32 {
-        self.read_cold_reset_entry4(ColdResetEntry4::VendorPubKeyIndex)
+    pub fn ecc_vendor_pk_index(&self) -> u32 {
+        self.read_cold_reset_entry4(ColdResetEntry4::EccVendorPubKeyIndex)
+    }
+
+    /// Set the Lms vendor public key index used for image verification
+    ///
+    /// # Arguments
+    ///
+    /// * `pk_index` - Vendor public key index
+    ///
+    pub fn set_lms_vendor_pk_index(&mut self, pk_index: u32) {
+        self.write_lock_cold_reset_entry4(ColdResetEntry4::LmsVendorPubKeyIndex, pk_index);
+    }
+
+    /// Get the Lms vendor public key index used for image verification.
+    ///
+    /// # Returns
+    ///
+    /// * `u32` - Vendor public key index
+    pub fn lms_vendor_pk_index(&self) -> u32 {
+        self.read_cold_reset_entry4(ColdResetEntry4::LmsVendorPubKeyIndex)
     }
 
     /// Set the rt tcb component identifier.
diff --git a/error/src/lib.rs b/error/src/lib.rs
index 09293b8d..2d80ed53 100644
--- a/error/src/lib.rs
+++ b/error/src/lib.rs
@@ -221,12 +221,8 @@ impl CaliptraError {
         CaliptraError::new_const(0x000b0033);
     pub const IMAGE_VERIFIER_ERR_FMC_RUNTIME_LOAD_ADDR_OVERLAP: CaliptraError =
         CaliptraError::new_const(0x000b0034);
-    pub const IMAGE_VERIFIER_ERR_OWNER_LMS_PUB_KEY_INDEX_MISMATCH: CaliptraError =
-        CaliptraError::new_const(0x000b0035);
     pub const IMAGE_VERIFIER_ERR_OWNER_LMS_VERIFY_FAILURE: CaliptraError =
         CaliptraError::new_const(0x000b0036);
-    pub const IMAGE_VERIFIER_ERR_OWNER_LMS_PUB_KEY_INDEX_OUT_OF_BOUNDS: CaliptraError =
-        CaliptraError::new_const(0x000b0037);
     pub const IMAGE_VERIFIER_ERR_OWNER_LMS_SIGNATURE_INVALID: CaliptraError =
         CaliptraError::new_const(0x000b0038);
     pub const RUNTIME_HANDOFF_FHT_NOT_LOADED: CaliptraError = CaliptraError::new_const(0x000b0039);
diff --git a/fmc/Makefile b/fmc/Makefile
index b1bdff30..f3315154 100644
--- a/fmc/Makefile
+++ b/fmc/Makefile
@@ -71,7 +71,6 @@ build-fw-image: gen-certs build-emu build-test-rt
 		--key-config $(TARGET_DIR)/keys.toml \
 		--ecc-pk-idx 3 \
 		--lms-pk-idx 3 \
-		--owner-lms-pk-idx 0 \
 		--fmc $(TARGET_DIR)/caliptra-fmc \
 		--fmc-svn 0 \
 		--fmc-min-svn 0 \
diff --git a/image/app/src/create/config.rs b/image/app/src/create/config.rs
index 6ac7e8a7..8a23acbd 100644
--- a/image/app/src/create/config.rs
+++ b/image/app/src/create/config.rs
@@ -13,7 +13,7 @@ Abstract:
 --*/
 
 use anyhow::Context;
-use caliptra_image_types::{OWNER_LMS_KEY_COUNT, VENDOR_ECC_KEY_COUNT, VENDOR_LMS_KEY_COUNT};
+use caliptra_image_types::{VENDOR_ECC_KEY_COUNT, VENDOR_LMS_KEY_COUNT};
 use serde_derive::{Deserialize, Serialize};
 use std::path::PathBuf;
 
@@ -36,9 +36,9 @@ pub(crate) struct OwnerKeyConfig {
 
     pub ecc_priv_key: Option<String>,
 
-    pub lms_pub_keys: [String; OWNER_LMS_KEY_COUNT as usize],
+    pub lms_pub_key: String,
 
-    pub lms_priv_keys: Option<[String; OWNER_LMS_KEY_COUNT as usize]>,
+    pub lms_priv_key: Option<String>,
 }
 
 //Key Configuration
diff --git a/image/app/src/create/mod.rs b/image/app/src/create/mod.rs
index c4769116..efa52e2f 100644
--- a/image/app/src/create/mod.rs
+++ b/image/app/src/create/mod.rs
@@ -116,10 +116,6 @@ pub(crate) fn run_cmd(args: &ArgMatches) -> anyhow::Result<()> {
         .get_one::<u32>("lms-pk-idx")
         .with_context(|| "lms-pk-idx arg not specified")?;
 
-    let owner_lms_key_idx: &u32 = args
-        .get_one::<u32>("owner-lms-pk-idx")
-        .with_context(|| "owner-lms-pk-idx arg not specified")?;
-
     let out_path: &PathBuf = args
         .get_one::<PathBuf>("out")
         .with_context(|| "out arg not specified")?;
@@ -181,13 +177,7 @@ pub(crate) fn run_cmd(args: &ArgMatches) -> anyhow::Result<()> {
             mfg_from_date,
             mfg_to_date,
         )?,
-        owner_config: owner_config(
-            config_dir,
-            &config.owner,
-            *owner_lms_key_idx,
-            own_from_date,
-            own_to_date,
-        )?,
+        owner_config: owner_config(config_dir, &config.owner, own_from_date, own_to_date)?,
         fmc,
         runtime,
     };
@@ -277,7 +267,6 @@ fn vendor_config(
 fn owner_config(
     path: &Path,
     config: &Option<OwnerKeyConfig>,
-    lms_key_idx: u32,
     from_date: [u8; 15],
     to_date: [u8; 15],
 ) -> anyhow::Result<Option<ImageGeneratorOwnerConfig>> {
@@ -288,16 +277,10 @@ fn owner_config(
         let pub_key_path = path.join(pem_file);
         gen_config.pub_keys.ecc_pub_key = ecc_pub_key_from_pem(&pub_key_path)?;
 
-        let lms_pub_keys = &config.lms_pub_keys;
+        let pem_file = &config.lms_pub_key;
 
-        for (i, pem_file) in lms_pub_keys
-            .iter()
-            .enumerate()
-            .take(OWNER_LMS_KEY_COUNT as usize)
-        {
-            let pub_key_path = path.join(pem_file);
-            gen_config.pub_keys.lms_pub_keys[i] = lms_pub_key_from_pem(&pub_key_path)?;
-        }
+        let pub_key_path = path.join(pem_file);
+        gen_config.pub_keys.lms_pub_key = lms_pub_key_from_pem(&pub_key_path)?;
 
         let mut priv_keys = ImageOwnerPrivKeys::default();
         if let Some(pem_file) = &config.ecc_priv_key {
@@ -306,18 +289,11 @@ fn owner_config(
             gen_config.priv_keys = Some(priv_keys);
         }
 
-        if let Some(lms_priv_keys) = &config.lms_priv_keys {
-            for (i, pem_file) in lms_priv_keys
-                .iter()
-                .enumerate()
-                .take(OWNER_LMS_KEY_COUNT as usize)
-            {
-                let priv_key_path = path.join(pem_file);
-                priv_keys.lms_priv_keys[i] = lms_priv_key_from_pem(&priv_key_path)?;
-            }
+        if let Some(pem_file) = &config.lms_priv_key {
+            let priv_key_path = path.join(pem_file);
+            priv_keys.lms_priv_key = lms_priv_key_from_pem(&priv_key_path)?;
             gen_config.priv_keys = Some(priv_keys);
         }
-        gen_config.lms_key_idx = lms_key_idx;
         gen_config.not_before = from_date;
         gen_config.not_after = to_date;
 
diff --git a/image/app/src/main.rs b/image/app/src/main.rs
index 83c721b3..63818e0a 100644
--- a/image/app/src/main.rs
+++ b/image/app/src/main.rs
@@ -36,11 +36,6 @@ fn main() {
                 .required(false)
                 .value_parser(value_parser!(u32)),
         )
-        .arg(
-            arg!(--"owner-lms-pk-idx" <U32> "Owner LMS Public Key Index")
-                .required(false)
-                .value_parser(value_parser!(u32)),
-        )
         .arg(
             arg!(--"fmc" <FILE> "FMC ELF binary")
                 .required(true)
diff --git a/image/fake-keys/src/lib.rs b/image/fake-keys/src/lib.rs
index 762b004d..b4e1617d 100644
--- a/image/fake-keys/src/lib.rs
+++ b/image/fake-keys/src/lib.rs
@@ -41,7 +41,7 @@ use zerocopy::AsBytes;
 /// print_public_key("OWNER_KEY", "../../target/riscv32imc-unknown-none-elf/firmware/own-pub-key.pem");
 /// print_private_key("OWNER_KEY", "../../target/riscv32imc-unknown-none-elf/firmware/own-priv-key.pem");
 /// ```
-pub const VENDOR_KEY_0_PUBLIC: ImageEccPubKey = ImageEccPubKey {
+pub const VENDOR_ECC_KEY_0_PUBLIC: ImageEccPubKey = ImageEccPubKey {
     x: [
         0xc69fe67f, 0x97ea3e42, 0x21a7a603, 0x6c2e070d, 0x1657327b, 0xc3f1e7c1, 0x8dccb9e4,
         0xffda5c3f, 0x4db0a1c0, 0x567e0973, 0x17bf4484, 0x39696a07,
@@ -51,11 +51,11 @@ pub const VENDOR_KEY_0_PUBLIC: ImageEccPubKey = ImageEccPubKey {
         0x27789964, 0x7735fde8, 0x328afd84, 0xcd4d4aa8, 0x72d40b42,
     ],
 };
-pub const VENDOR_KEY_0_PRIVATE: ImageEccPrivKey = [
+pub const VENDOR_ECC_KEY_0_PRIVATE: ImageEccPrivKey = [
     0x29f939ea, 0x41746499, 0xd550c6fa, 0x6368b0d7, 0x61e09b4c, 0x75b21922, 0x86f96240, 0x00ea1d99,
     0xace94ba6, 0x7ae89b0e, 0x3f210cf1, 0x9a45b6b5,
 ];
-pub const VENDOR_KEY_1_PUBLIC: ImageEccPubKey = ImageEccPubKey {
+pub const VENDOR_ECC_KEY_1_PUBLIC: ImageEccPubKey = ImageEccPubKey {
     x: [
         0xa6309750, 0xf0a05ddb, 0x956a7f86, 0x2812ec4f, 0xec454e95, 0x3b53dbfb, 0x9eb54140,
         0x15ea7507, 0x084af93c, 0xb7fa33fe, 0x51811ad5, 0xe754232e,
@@ -65,11 +65,11 @@ pub const VENDOR_KEY_1_PUBLIC: ImageEccPubKey = ImageEccPubKey {
         0x58c39b86, 0x272ef548, 0xe572b937, 0x1ecf1994, 0x1b8d4ea7,
     ],
 };
-pub const VENDOR_KEY_1_PRIVATE: ImageEccPrivKey = [
+pub const VENDOR_ECC_KEY_1_PRIVATE: ImageEccPrivKey = [
     0xf2ee427b, 0x4412f46f, 0x8fb020a5, 0xc23b0154, 0xb3fcb201, 0xf93c2ee2, 0x923fd577, 0xf85320bb,
     0x289eb276, 0x2b6b21d3, 0x5cdb3925, 0xa57d5043,
 ];
-pub const VENDOR_KEY_2_PUBLIC: ImageEccPubKey = ImageEccPubKey {
+pub const VENDOR_ECC_KEY_2_PUBLIC: ImageEccPubKey = ImageEccPubKey {
     x: [
         0xa0d25693, 0xc4251e48, 0x185615b0, 0xa6c27f6d, 0xe62c39f5, 0xa9a32f75, 0x9553226a,
         0x4d1926c1, 0x7928910f, 0xb7adc1b6, 0x89996733, 0x10134881,
@@ -79,11 +79,11 @@ pub const VENDOR_KEY_2_PUBLIC: ImageEccPubKey = ImageEccPubKey {
         0x3fbd0501, 0x9bdc8118, 0x4be5f33c, 0xbb21b41d, 0x93a8c523,
     ],
 };
-pub const VENDOR_KEY_2_PRIVATE: ImageEccPrivKey = [
+pub const VENDOR_ECC_KEY_2_PRIVATE: ImageEccPrivKey = [
     0xaf72a74c, 0xfbbacc3c, 0x7ad2f9d9, 0xc969d1c9, 0x19c2d803, 0x0a53749a, 0xee730267, 0x7c11a52d,
     0xee63e4c8, 0x0b5c0293, 0x28d35c27, 0x5f959aee,
 ];
-pub const VENDOR_KEY_3_PUBLIC: ImageEccPubKey = ImageEccPubKey {
+pub const VENDOR_ECC_KEY_3_PUBLIC: ImageEccPubKey = ImageEccPubKey {
     x: [
         0x002a82b6, 0x8e03e9a0, 0xfd3b4c14, 0xca2cb3e8, 0x14350a71, 0x0e43956d, 0x21694fb4,
         0xf34485e8, 0xf0e33583, 0xf7ea142d, 0x50e16f8b, 0x0225bb95,
@@ -93,12 +93,12 @@ pub const VENDOR_KEY_3_PUBLIC: ImageEccPubKey = ImageEccPubKey {
         0x1abc25e7, 0x0b05c426, 0x843dcd6f, 0x944ef6ff, 0xfa53ec5b,
     ],
 };
-pub const VENDOR_KEY_3_PRIVATE: ImageEccPrivKey = [
+pub const VENDOR_ECC_KEY_3_PRIVATE: ImageEccPrivKey = [
     0xafbdfc7d, 0x36b54629, 0xd12c4cb5, 0x33926c30, 0x20611617, 0x86b50b23, 0x6046ff93, 0x17ea0144,
     0xbc900c70, 0xb8cb36ac, 0x268b8079, 0xe3aeaaaf,
 ];
 
-pub const VENDOR_LMS_KEY0_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
+pub const VENDOR_LMS_KEY_0_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -110,7 +110,7 @@ pub const VENDOR_LMS_KEY0_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
         0x73, 0x45, 0x86, 0xb0, 0x32, 0x86, 0xc7, 0x69, 0x74,
     ]),
 };
-pub const VENDOR_LMS_KEY0_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
+pub const VENDOR_LMS_KEY_0_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -123,7 +123,7 @@ pub const VENDOR_LMS_KEY0_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     ]),
 };
 
-pub const VENDOR_LMS_KEY1_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
+pub const VENDOR_LMS_KEY_1_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -135,7 +135,7 @@ pub const VENDOR_LMS_KEY1_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
         0x56, 0x0c, 0x58, 0x1e, 0xbf, 0x7b, 0x50, 0xc5, 0x14,
     ]),
 };
-pub const VENDOR_LMS_KEY1_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
+pub const VENDOR_LMS_KEY_1_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -148,7 +148,7 @@ pub const VENDOR_LMS_KEY1_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     ]),
 };
 
-pub const VENDOR_LMS_KEY2_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
+pub const VENDOR_LMS_KEY_2_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -160,7 +160,7 @@ pub const VENDOR_LMS_KEY2_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
         0xa9, 0x44, 0x44, 0x46, 0xbd, 0xe2, 0x86, 0xe5, 0xe6,
     ]),
 };
-pub const VENDOR_LMS_KEY2_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
+pub const VENDOR_LMS_KEY_2_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -173,7 +173,7 @@ pub const VENDOR_LMS_KEY2_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     ]),
 };
 
-pub const VENDOR_LMS_KEY3_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
+pub const VENDOR_LMS_KEY_3_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -185,7 +185,7 @@ pub const VENDOR_LMS_KEY3_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
         0x90, 0xcb, 0x4f, 0xa1, 0xbc, 0x26, 0xbb, 0xa2, 0x34,
     ]),
 };
-pub const VENDOR_LMS_KEY3_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
+pub const VENDOR_LMS_KEY_3_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -198,7 +198,7 @@ pub const VENDOR_LMS_KEY3_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     ]),
 };
 
-pub const OWNER_LMS_KEY0_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
+pub const OWNER_LMS_KEY_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -210,7 +210,7 @@ pub const OWNER_LMS_KEY0_PRIVATE: ImageLmsPrivKey = ImageLmsPrivKey {
         0x4d, 0x59, 0xd0, 0xb0, 0x83, 0x79, 0xa9, 0xf7, 0x5d,
     ]),
 };
-pub const OWNER_LMS_KEY0_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
+pub const OWNER_LMS_KEY_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
     tree_type: IMAGE_LMS_TREE_TYPE,
     otstype: IMAGE_LMS_OTS_TYPE,
     id: [
@@ -222,7 +222,7 @@ pub const OWNER_LMS_KEY0_PUBLIC: ImageLmsPublicKey = ImageLmsPublicKey {
         0x56, 0x08, 0x6f, 0x8f, 0x8c, 0xfa, 0x05, 0xb5, 0xbb,
     ]),
 };
-pub const OWNER_KEY_PUBLIC: ImageEccPubKey = ImageEccPubKey {
+pub const OWNER_ECC_KEY_PUBLIC: ImageEccPubKey = ImageEccPubKey {
     x: [
         0xc6f82e2b, 0xdcf3e157, 0xa162e7f3, 0x3eca35c4, 0x55ea08a9, 0x13811779, 0xb6f2646d,
         0x92c817cd, 0x4094bd1a, 0xdb215f62, 0xcf36f017, 0x012d5aeb,
@@ -232,103 +232,103 @@ pub const OWNER_KEY_PUBLIC: ImageEccPubKey = ImageEccPubKey {
         0xf9624bd7, 0x2733dcdd, 0xce24ec5e, 0x961c00e3, 0x4372ba17,
     ],
 };
-pub const OWNER_KEY_PRIVATE: ImageEccPrivKey = [
+pub const OWNER_ECC_KEY_PRIVATE: ImageEccPrivKey = [
     0x59fdf849, 0xe39f4256, 0x19342ed2, 0x81d28d3d, 0x45ab3219, 0x5174582c, 0xecb4e9df, 0x9cc2e991,
     0xb75f88fd, 0xfa4bc6a4, 0x6b88340f, 0x05dd8890,
 ];
 pub const VENDOR_PUBLIC_KEYS: ImageVendorPubKeys = ImageVendorPubKeys {
     ecc_pub_keys: [
-        VENDOR_KEY_0_PUBLIC,
-        VENDOR_KEY_1_PUBLIC,
-        VENDOR_KEY_2_PUBLIC,
-        VENDOR_KEY_3_PUBLIC,
+        VENDOR_ECC_KEY_0_PUBLIC,
+        VENDOR_ECC_KEY_1_PUBLIC,
+        VENDOR_ECC_KEY_2_PUBLIC,
+        VENDOR_ECC_KEY_3_PUBLIC,
     ],
     lms_pub_keys: [
-        VENDOR_LMS_KEY0_PUBLIC,
-        VENDOR_LMS_KEY1_PUBLIC,
-        VENDOR_LMS_KEY2_PUBLIC,
-        VENDOR_LMS_KEY3_PUBLIC,
-        VENDOR_LMS_KEY0_PUBLIC,
-        VENDOR_LMS_KEY1_PUBLIC,
-        VENDOR_LMS_KEY2_PUBLIC,
-        VENDOR_LMS_KEY3_PUBLIC,
-        VENDOR_LMS_KEY0_PUBLIC,
-        VENDOR_LMS_KEY1_PUBLIC,
-        VENDOR_LMS_KEY2_PUBLIC,
-        VENDOR_LMS_KEY3_PUBLIC,
-        VENDOR_LMS_KEY0_PUBLIC,
-        VENDOR_LMS_KEY1_PUBLIC,
-        VENDOR_LMS_KEY2_PUBLIC,
-        VENDOR_LMS_KEY3_PUBLIC,
-        VENDOR_LMS_KEY0_PUBLIC,
-        VENDOR_LMS_KEY1_PUBLIC,
-        VENDOR_LMS_KEY2_PUBLIC,
-        VENDOR_LMS_KEY3_PUBLIC,
-        VENDOR_LMS_KEY0_PUBLIC,
-        VENDOR_LMS_KEY1_PUBLIC,
-        VENDOR_LMS_KEY2_PUBLIC,
-        VENDOR_LMS_KEY3_PUBLIC,
-        VENDOR_LMS_KEY0_PUBLIC,
-        VENDOR_LMS_KEY1_PUBLIC,
-        VENDOR_LMS_KEY2_PUBLIC,
-        VENDOR_LMS_KEY3_PUBLIC,
-        VENDOR_LMS_KEY0_PUBLIC,
-        VENDOR_LMS_KEY1_PUBLIC,
-        VENDOR_LMS_KEY2_PUBLIC,
-        VENDOR_LMS_KEY3_PUBLIC,
+        VENDOR_LMS_KEY_0_PUBLIC,
+        VENDOR_LMS_KEY_1_PUBLIC,
+        VENDOR_LMS_KEY_2_PUBLIC,
+        VENDOR_LMS_KEY_3_PUBLIC,
+        VENDOR_LMS_KEY_0_PUBLIC,
+        VENDOR_LMS_KEY_1_PUBLIC,
+        VENDOR_LMS_KEY_2_PUBLIC,
+        VENDOR_LMS_KEY_3_PUBLIC,
+        VENDOR_LMS_KEY_0_PUBLIC,
+        VENDOR_LMS_KEY_1_PUBLIC,
+        VENDOR_LMS_KEY_2_PUBLIC,
+        VENDOR_LMS_KEY_3_PUBLIC,
+        VENDOR_LMS_KEY_0_PUBLIC,
+        VENDOR_LMS_KEY_1_PUBLIC,
+        VENDOR_LMS_KEY_2_PUBLIC,
+        VENDOR_LMS_KEY_3_PUBLIC,
+        VENDOR_LMS_KEY_0_PUBLIC,
+        VENDOR_LMS_KEY_1_PUBLIC,
+        VENDOR_LMS_KEY_2_PUBLIC,
+        VENDOR_LMS_KEY_3_PUBLIC,
+        VENDOR_LMS_KEY_0_PUBLIC,
+        VENDOR_LMS_KEY_1_PUBLIC,
+        VENDOR_LMS_KEY_2_PUBLIC,
+        VENDOR_LMS_KEY_3_PUBLIC,
+        VENDOR_LMS_KEY_0_PUBLIC,
+        VENDOR_LMS_KEY_1_PUBLIC,
+        VENDOR_LMS_KEY_2_PUBLIC,
+        VENDOR_LMS_KEY_3_PUBLIC,
+        VENDOR_LMS_KEY_0_PUBLIC,
+        VENDOR_LMS_KEY_1_PUBLIC,
+        VENDOR_LMS_KEY_2_PUBLIC,
+        VENDOR_LMS_KEY_3_PUBLIC,
     ],
 };
 
 pub const OWNER_PUBLIC_KEYS: ImageOwnerPubKeys = ImageOwnerPubKeys {
-    ecc_pub_key: OWNER_KEY_PUBLIC,
-    lms_pub_keys: [OWNER_LMS_KEY0_PUBLIC],
+    ecc_pub_key: OWNER_ECC_KEY_PUBLIC,
+    lms_pub_key: OWNER_LMS_KEY_PUBLIC,
 };
 pub const VENDOR_PRIVATE_KEYS: ImageVendorPrivKeys = ImageVendorPrivKeys {
     ecc_priv_keys: [
-        VENDOR_KEY_0_PRIVATE,
-        VENDOR_KEY_1_PRIVATE,
-        VENDOR_KEY_2_PRIVATE,
-        VENDOR_KEY_3_PRIVATE,
+        VENDOR_ECC_KEY_0_PRIVATE,
+        VENDOR_ECC_KEY_1_PRIVATE,
+        VENDOR_ECC_KEY_2_PRIVATE,
+        VENDOR_ECC_KEY_3_PRIVATE,
     ],
     lms_priv_keys: [
-        VENDOR_LMS_KEY0_PRIVATE,
-        VENDOR_LMS_KEY1_PRIVATE,
-        VENDOR_LMS_KEY2_PRIVATE,
-        VENDOR_LMS_KEY3_PRIVATE,
-        VENDOR_LMS_KEY0_PRIVATE,
-        VENDOR_LMS_KEY1_PRIVATE,
-        VENDOR_LMS_KEY2_PRIVATE,
-        VENDOR_LMS_KEY3_PRIVATE,
-        VENDOR_LMS_KEY0_PRIVATE,
-        VENDOR_LMS_KEY1_PRIVATE,
-        VENDOR_LMS_KEY2_PRIVATE,
-        VENDOR_LMS_KEY3_PRIVATE,
-        VENDOR_LMS_KEY0_PRIVATE,
-        VENDOR_LMS_KEY1_PRIVATE,
-        VENDOR_LMS_KEY2_PRIVATE,
-        VENDOR_LMS_KEY3_PRIVATE,
-        VENDOR_LMS_KEY0_PRIVATE,
-        VENDOR_LMS_KEY1_PRIVATE,
-        VENDOR_LMS_KEY2_PRIVATE,
-        VENDOR_LMS_KEY3_PRIVATE,
-        VENDOR_LMS_KEY0_PRIVATE,
-        VENDOR_LMS_KEY1_PRIVATE,
-        VENDOR_LMS_KEY2_PRIVATE,
-        VENDOR_LMS_KEY3_PRIVATE,
-        VENDOR_LMS_KEY0_PRIVATE,
-        VENDOR_LMS_KEY1_PRIVATE,
-        VENDOR_LMS_KEY2_PRIVATE,
-        VENDOR_LMS_KEY3_PRIVATE,
-        VENDOR_LMS_KEY0_PRIVATE,
-        VENDOR_LMS_KEY1_PRIVATE,
-        VENDOR_LMS_KEY2_PRIVATE,
-        VENDOR_LMS_KEY3_PRIVATE,
+        VENDOR_LMS_KEY_0_PRIVATE,
+        VENDOR_LMS_KEY_1_PRIVATE,
+        VENDOR_LMS_KEY_2_PRIVATE,
+        VENDOR_LMS_KEY_3_PRIVATE,
+        VENDOR_LMS_KEY_0_PRIVATE,
+        VENDOR_LMS_KEY_1_PRIVATE,
+        VENDOR_LMS_KEY_2_PRIVATE,
+        VENDOR_LMS_KEY_3_PRIVATE,
+        VENDOR_LMS_KEY_0_PRIVATE,
+        VENDOR_LMS_KEY_1_PRIVATE,
+        VENDOR_LMS_KEY_2_PRIVATE,
+        VENDOR_LMS_KEY_3_PRIVATE,
+        VENDOR_LMS_KEY_0_PRIVATE,
+        VENDOR_LMS_KEY_1_PRIVATE,
+        VENDOR_LMS_KEY_2_PRIVATE,
+        VENDOR_LMS_KEY_3_PRIVATE,
+        VENDOR_LMS_KEY_0_PRIVATE,
+        VENDOR_LMS_KEY_1_PRIVATE,
+        VENDOR_LMS_KEY_2_PRIVATE,
+        VENDOR_LMS_KEY_3_PRIVATE,
+        VENDOR_LMS_KEY_0_PRIVATE,
+        VENDOR_LMS_KEY_1_PRIVATE,
+        VENDOR_LMS_KEY_2_PRIVATE,
+        VENDOR_LMS_KEY_3_PRIVATE,
+        VENDOR_LMS_KEY_0_PRIVATE,
+        VENDOR_LMS_KEY_1_PRIVATE,
+        VENDOR_LMS_KEY_2_PRIVATE,
+        VENDOR_LMS_KEY_3_PRIVATE,
+        VENDOR_LMS_KEY_0_PRIVATE,
+        VENDOR_LMS_KEY_1_PRIVATE,
+        VENDOR_LMS_KEY_2_PRIVATE,
+        VENDOR_LMS_KEY_3_PRIVATE,
     ],
 };
 
 pub const OWNER_PRIVATE_KEYS: ImageOwnerPrivKeys = ImageOwnerPrivKeys {
-    ecc_priv_key: OWNER_KEY_PRIVATE,
-    lms_priv_keys: [OWNER_LMS_KEY0_PRIVATE],
+    ecc_priv_key: OWNER_ECC_KEY_PRIVATE,
+    lms_priv_key: OWNER_LMS_KEY_PRIVATE,
 };
 
 pub const VENDOR_CONFIG_KEY_0: ImageGeneratorVendorConfig = ImageGeneratorVendorConfig {
@@ -360,14 +360,13 @@ pub const VENDOR_CONFIG_KEY_3: ImageGeneratorVendorConfig = ImageGeneratorVendor
 
 pub const OWNER_CONFIG: ImageGeneratorOwnerConfig = ImageGeneratorOwnerConfig {
     pub_keys: ImageOwnerPubKeys {
-        ecc_pub_key: OWNER_KEY_PUBLIC,
-        lms_pub_keys: [OWNER_LMS_KEY0_PUBLIC],
+        ecc_pub_key: OWNER_ECC_KEY_PUBLIC,
+        lms_pub_key: OWNER_LMS_KEY_PUBLIC,
     },
     priv_keys: Some(ImageOwnerPrivKeys {
-        ecc_priv_key: OWNER_KEY_PRIVATE,
-        lms_priv_keys: [OWNER_LMS_KEY0_PRIVATE],
+        ecc_priv_key: OWNER_ECC_KEY_PRIVATE,
+        lms_priv_key: OWNER_LMS_KEY_PRIVATE,
     }),
-    lms_key_idx: 0,
     not_before: [0u8; 15],
     not_after: [0u8; 15],
 };
@@ -401,30 +400,21 @@ fn test_write_lms_keys() {
         file.write_all(VENDOR_PUBLIC_KEYS.lms_pub_keys[i].as_bytes())
             .unwrap();
     }
-    for i in 0..OWNER_PRIVATE_KEYS.lms_priv_keys.len() {
-        let mut file = fs::OpenOptions::new()
-            .create(true)
-            .write(true)
-            .truncate(true)
-            .open(format!(
-                "../../target/riscv32imc-unknown-none-elf/firmware/own-lms-priv-key-{}.pem",
-                i
-            ))
-            .unwrap();
-        file.write_all(OWNER_PRIVATE_KEYS.lms_priv_keys[i].as_bytes())
-            .unwrap();
-    }
-    for i in 0..OWNER_PUBLIC_KEYS.lms_pub_keys.len() {
-        let mut file = fs::OpenOptions::new()
-            .create(true)
-            .write(true)
-            .truncate(true)
-            .open(format!(
-                "../../target/riscv32imc-unknown-none-elf/firmware/own-lms-pub-key-{}.pem",
-                i
-            ))
-            .unwrap();
-        file.write_all(OWNER_PUBLIC_KEYS.lms_pub_keys[i].as_bytes())
-            .unwrap();
-    }
+    let mut file = fs::OpenOptions::new()
+        .create(true)
+        .write(true)
+        .truncate(true)
+        .open("../../target/riscv32imc-unknown-none-elf/firmware/own-lms-priv-key.pem")
+        .unwrap();
+    file.write_all(OWNER_PRIVATE_KEYS.lms_priv_key.as_bytes())
+        .unwrap();
+
+    let mut file = fs::OpenOptions::new()
+        .create(true)
+        .write(true)
+        .truncate(true)
+        .open("../../target/riscv32imc-unknown-none-elf/firmware/own-lms-pub-key.pem")
+        .unwrap();
+    file.write_all(OWNER_PUBLIC_KEYS.lms_pub_key.as_bytes())
+        .unwrap();
 }
diff --git a/image/gen/src/generator.rs b/image/gen/src/generator.rs
index dcd8919c..6d4abf37 100644
--- a/image/gen/src/generator.rs
+++ b/image/gen/src/generator.rs
@@ -73,11 +73,6 @@ impl<Crypto: ImageGeneratorCrypto> ImageGenerator<Crypto> {
 
         let ecc_key_idx = config.vendor_config.ecc_key_idx;
         let lms_key_idx = config.vendor_config.lms_key_idx;
-        let owner_lms_key_idx = if let Some(owner_config) = &config.owner_config {
-            owner_config.lms_key_idx
-        } else {
-            OWNER_LMS_KEY_COUNT
-        };
 
         // Create Header
         let toc_digest = self.toc_digest(&fmc_toc, &runtime_toc)?;
@@ -85,7 +80,6 @@ impl<Crypto: ImageGeneratorCrypto> ImageGenerator<Crypto> {
             config,
             ecc_key_idx,
             lms_key_idx,
-            owner_lms_key_idx,
             Self::DEFAULT_FLAGS,
             toc_digest,
         )?;
@@ -97,7 +91,6 @@ impl<Crypto: ImageGeneratorCrypto> ImageGenerator<Crypto> {
             config,
             ecc_key_idx,
             lms_key_idx,
-            owner_lms_key_idx,
             &header_digest_vendor,
             &header_digest_owner,
         )?;
@@ -126,9 +119,8 @@ impl<Crypto: ImageGeneratorCrypto> ImageGenerator<Crypto> {
     pub fn gen_preamble<E>(
         &self,
         config: &ImageGeneratorConfig<E>,
-        ecc_key_idx: u32,
-        lms_key_idx: u32,
-        owner_lms_key_idx: u32,
+        ecc_vendor_key_idx: u32,
+        lms_vendor_key_idx: u32,
         digest_vendor: &ImageDigest,
         digest_owner: &ImageDigest,
     ) -> anyhow::Result<ImagePreamble>
@@ -141,13 +133,13 @@ impl<Crypto: ImageGeneratorCrypto> ImageGenerator<Crypto> {
         if let Some(priv_keys) = config.vendor_config.priv_keys {
             let sig = self.crypto.ecdsa384_sign(
                 digest_vendor,
-                &priv_keys.ecc_priv_keys[ecc_key_idx as usize],
-                &config.vendor_config.pub_keys.ecc_pub_keys[ecc_key_idx as usize],
+                &priv_keys.ecc_priv_keys[ecc_vendor_key_idx as usize],
+                &config.vendor_config.pub_keys.ecc_pub_keys[ecc_vendor_key_idx as usize],
             )?;
             vendor_sigs.ecc_sig = sig;
             let lms_sig = self.crypto.lms_sign(
                 digest_vendor,
-                &priv_keys.lms_priv_keys[lms_key_idx as usize],
+                &priv_keys.lms_priv_keys[lms_vendor_key_idx as usize],
             )?;
             vendor_sigs.lms_sig = lms_sig;
         }
@@ -160,19 +152,17 @@ impl<Crypto: ImageGeneratorCrypto> ImageGenerator<Crypto> {
                     &owner_config.pub_keys.ecc_pub_key,
                 )?;
                 owner_sigs.ecc_sig = sig;
-                let lms_sig = self.crypto.lms_sign(
-                    digest_owner,
-                    &priv_keys.lms_priv_keys[owner_lms_key_idx as usize],
-                )?;
+                let lms_sig = self
+                    .crypto
+                    .lms_sign(digest_owner, &priv_keys.lms_priv_key)?;
                 owner_sigs.lms_sig = lms_sig;
             }
         }
 
         let mut preamble = ImagePreamble {
             vendor_pub_keys: config.vendor_config.pub_keys,
-            vendor_ecc_pub_key_idx: ecc_key_idx,
-            vendor_lms_pub_key_idx: lms_key_idx,
-            owner_lms_pub_key_idx: owner_lms_key_idx,
+            vendor_ecc_pub_key_idx: ecc_vendor_key_idx,
+            vendor_lms_pub_key_idx: lms_vendor_key_idx,
             vendor_sigs,
             owner_sigs,
             ..Default::default()
@@ -191,7 +181,6 @@ impl<Crypto: ImageGeneratorCrypto> ImageGenerator<Crypto> {
         config: &ImageGeneratorConfig<E>,
         ecc_key_idx: u32,
         lms_key_idx: u32,
-        owner_lms_key_idx: u32,
         flags: u32,
         digest: ImageDigest,
     ) -> anyhow::Result<ImageHeader>
@@ -201,7 +190,6 @@ impl<Crypto: ImageGeneratorCrypto> ImageGenerator<Crypto> {
         let mut header = ImageHeader {
             vendor_ecc_pub_key_idx: ecc_key_idx,
             vendor_lms_pub_key_idx: lms_key_idx,
-            owner_lms_pub_key_idx: owner_lms_key_idx,
             flags,
             toc_len: MAX_TOC_ENTRY_COUNT,
             toc_digest: digest,
diff --git a/image/gen/src/lib.rs b/image/gen/src/lib.rs
index e9ab511a..d58db9b3 100644
--- a/image/gen/src/lib.rs
+++ b/image/gen/src/lib.rs
@@ -82,8 +82,6 @@ pub struct ImageGeneratorVendorConfig {
 /// Image Generator Owner Configuration
 #[derive(Default)]
 pub struct ImageGeneratorOwnerConfig {
-    pub lms_key_idx: u32,
-
     pub pub_keys: ImageOwnerPubKeys,
 
     pub priv_keys: Option<ImageOwnerPrivKeys>,
diff --git a/image/types/src/lib.rs b/image/types/src/lib.rs
index 09566dfb..8f3fa149 100644
--- a/image/types/src/lib.rs
+++ b/image/types/src/lib.rs
@@ -26,7 +26,6 @@ use zerocopy::{AsBytes, FromBytes};
 pub const MANIFEST_MARKER: u32 = 0x4E414D43;
 pub const VENDOR_ECC_KEY_COUNT: u32 = 4;
 pub const VENDOR_LMS_KEY_COUNT: u32 = 32;
-pub const OWNER_LMS_KEY_COUNT: u32 = 1;
 pub const MAX_TOC_ENTRY_COUNT: u32 = 2;
 pub const IMAGE_REVISION_BYTE_SIZE: usize = 20;
 pub const ECC384_SCALAR_WORD_SIZE: usize = 12;
@@ -228,14 +227,14 @@ pub struct ImageVendorPrivKeys {
 #[derive(AsBytes, FromBytes, Default, Debug, Clone, Copy)]
 pub struct ImageOwnerPubKeys {
     pub ecc_pub_key: ImageEccPubKey,
-    pub lms_pub_keys: [ImageLmsPublicKey; OWNER_LMS_KEY_COUNT as usize],
+    pub lms_pub_key: ImageLmsPublicKey,
 }
 
 #[repr(C)]
 #[derive(AsBytes, FromBytes, Default, Debug, Clone, Copy)]
 pub struct ImageOwnerPrivKeys {
     pub ecc_priv_key: ImageEccPrivKey,
-    pub lms_priv_keys: [ImageLmsPrivKey; OWNER_LMS_KEY_COUNT as usize],
+    pub lms_priv_key: ImageLmsPrivKey,
 }
 
 #[repr(C)]
@@ -264,9 +263,6 @@ pub struct ImagePreamble {
     /// Owner Public Key
     pub owner_pub_keys: ImageOwnerPubKeys,
 
-    /// Owner LMS Public Key Index
-    pub owner_lms_pub_key_idx: u32,
-
     /// Owner Signatures
     pub owner_sigs: ImageSignatures,
 
@@ -310,9 +306,6 @@ pub struct ImageHeader {
     /// Vendor LMS Public Key Index
     pub vendor_lms_pub_key_idx: u32,
 
-    /// Owner LMS Public Key Index
-    pub owner_lms_pub_key_idx: u32,
-
     /// Flags
     pub flags: u32,
 
diff --git a/image/verify/src/lib.rs b/image/verify/src/lib.rs
index 08874747..917da96a 100644
--- a/image/verify/src/lib.rs
+++ b/image/verify/src/lib.rs
@@ -65,9 +65,6 @@ pub struct ImageVerificationLogInfo {
     // LMS Vendor Public Key Index
     pub vendor_lms_pub_key_idx: Option<u32>,
 
-    // LMS Owner Public Key Index To Log
-    pub owner_lms_pub_key_idx: Option<u32>,
-
     /// Vendor LMS Public Key Revocation Fuse
     pub fuse_vendor_lms_pub_key_revocation: Option<u32>,
 
@@ -87,9 +84,6 @@ pub struct ImageVerificationInfo {
     /// Vendor LMS public key index
     pub vendor_lms_pub_key_idx: Option<u32>,
 
-    /// Owner LMS public key index
-    pub owner_lms_pub_key_idx: Option<u32>,
-
     /// Digest of vendor public keys that verified the image
     pub vendor_pub_keys_digest: ImageDigest,
 
diff --git a/image/verify/src/verifier.rs b/image/verify/src/verifier.rs
index b548a5dd..48160242 100644
--- a/image/verify/src/verifier.rs
+++ b/image/verify/src/verifier.rs
@@ -25,7 +25,6 @@ const ZERO_DIGEST: ImageDigest = [0u32; SHA384_DIGEST_WORD_SIZE];
 struct HeaderInfo<'a> {
     vendor_ecc_pub_key_idx: u32,
     vendor_lms_pub_key_idx: Option<u32>,
-    owner_lms_pub_key_idx: Option<u32>,
     vendor_ecc_pub_key_revocation: VendorPubKeyRevocation,
     vendor_ecc_info: (&'a ImageEccPubKey, &'a ImageEccSignature),
     vendor_lms_info: Option<(&'a ImageLmsPublicKey, &'a ImageLmsSignature)>,
@@ -113,7 +112,6 @@ impl<Env: ImageVerificationEnv> ImageVerifier<Env> {
         let info = ImageVerificationInfo {
             vendor_ecc_pub_key_idx: header_info.vendor_ecc_pub_key_idx,
             vendor_lms_pub_key_idx: header_info.vendor_lms_pub_key_idx,
-            owner_lms_pub_key_idx: header_info.owner_lms_pub_key_idx,
             vendor_pub_keys_digest: self.make_vendor_key_digest(header_info)?,
             owner_pub_keys_digest: header_info.owner_pub_keys_digest,
             fmc: fmc_info,
@@ -125,7 +123,6 @@ impl<Env: ImageVerificationEnv> ImageVerifier<Env> {
                 rt_log_info,
                 fuse_vendor_lms_pub_key_revocation: header_info.vendor_lms_pub_key_revocation,
                 vendor_lms_pub_key_idx: header_info.vendor_lms_pub_key_idx,
-                owner_lms_pub_key_idx: header_info.owner_lms_pub_key_idx,
             },
         };
 
@@ -172,39 +169,25 @@ impl<Env: ImageVerificationEnv> ImageVerifier<Env> {
         }
 
         // Owner Information
-        let (owner_lms_pub_key_idx, owner_pub_keys_digest, owner_ecc_info, owner_lms_info) =
+        let (owner_pub_keys_digest, owner_ecc_info, owner_lms_info) =
             if let Some(digest) = owner_pk_digest {
                 (
-                    if self.env.lms_verify_enabled() {
-                        if preamble.owner_lms_pub_key_idx >= OWNER_LMS_KEY_COUNT {
-                            return Err(CaliptraError::IMAGE_VERIFIER_ERR_OWNER_LMS_PUB_KEY_INDEX_OUT_OF_BOUNDS);
-                        } else {
-                            Some(preamble.owner_lms_pub_key_idx)
-                        }
-                    } else {
-                        None
-                    },
                     digest,
                     Some((
                         &preamble.owner_pub_keys.ecc_pub_key,
                         &preamble.owner_sigs.ecc_sig,
                     )),
                     if self.env.lms_verify_enabled() {
-                        if preamble.owner_lms_pub_key_idx >= OWNER_LMS_KEY_COUNT {
-                            return Err(CaliptraError::IMAGE_VERIFIER_ERR_OWNER_LMS_PUB_KEY_INDEX_OUT_OF_BOUNDS);
-                        } else {
-                            Some((
-                                &preamble.owner_pub_keys.lms_pub_keys
-                                    [preamble.owner_lms_pub_key_idx as usize],
-                                &preamble.owner_sigs.lms_sig,
-                            ))
-                        }
+                        Some((
+                            &preamble.owner_pub_keys.lms_pub_key,
+                            &preamble.owner_sigs.lms_sig,
+                        ))
                     } else {
                         None
                     },
                 )
             } else {
-                (None, ZERO_DIGEST, None, None)
+                (ZERO_DIGEST, None, None)
             };
 
         let info = HeaderInfo {
@@ -212,7 +195,6 @@ impl<Env: ImageVerificationEnv> ImageVerifier<Env> {
             vendor_lms_pub_key_idx,
             vendor_ecc_info,
             vendor_lms_info,
-            owner_lms_pub_key_idx,
             owner_lms_info,
             owner_pub_keys_digest,
             owner_ecc_info,
@@ -388,22 +370,16 @@ impl<Env: ImageVerificationEnv> ImageVerifier<Env> {
             }
         }
 
-        // Verify owner LMS signature
-        if let Some((owner_lms_pub_key, owner_lms_sig)) = info.owner_lms_info {
-            if let Some(idx) = info.owner_lms_pub_key_idx {
-                if header.owner_lms_pub_key_idx != idx {
-                    return Err(CaliptraError::IMAGE_VERIFIER_ERR_OWNER_LMS_PUB_KEY_INDEX_MISMATCH);
-                }
-            }
-
-            self.verify_owner_lms_sig(&digest_owner, owner_lms_pub_key, owner_lms_sig)?;
-        }
-
         // Verify owner ECC signature
         if let Some((owner_ecc_pub_key, owner_ecc_sig)) = info.owner_ecc_info {
             self.verify_owner_ecc_sig(&digest_owner, owner_ecc_pub_key, owner_ecc_sig)?;
         }
 
+        // Verify owner LMS signature
+        if let Some((owner_lms_pub_key, owner_lms_sig)) = info.owner_lms_info {
+            self.verify_owner_lms_sig(&digest_owner, owner_lms_pub_key, owner_lms_sig)?;
+        }
+
         let verif_info = TocInfo {
             len: header.toc_len,
             digest: &header.toc_digest,
@@ -976,7 +952,6 @@ mod tests {
         let header_info: HeaderInfo = HeaderInfo {
             vendor_ecc_pub_key_idx: 0,
             vendor_lms_pub_key_idx: Some(0),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&ImageEccPubKey::default(), &ImageEccSignature::default()),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&ecc_pubkey, &ecc_sig)),
@@ -1006,7 +981,6 @@ mod tests {
         let header_info: HeaderInfo = HeaderInfo {
             vendor_ecc_pub_key_idx: 0,
             vendor_lms_pub_key_idx: Some(0),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &ImageEccSignature::default()),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&owner_ecc_pubkey, &owner_ecc_sig)),
@@ -1042,7 +1016,6 @@ mod tests {
         let header_info: HeaderInfo = HeaderInfo {
             vendor_ecc_pub_key_idx: 0,
             vendor_lms_pub_key_idx: Some(0),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &VENDOR_ECC_SIG),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&owner_ecc_pubkey, &owner_ecc_sig)),
@@ -1079,7 +1052,6 @@ mod tests {
             vendor_ecc_pub_key_idx: 0,
             vendor_lms_pub_key_idx: Some(0),
             vendor_ecc_pub_key_revocation: Default::default(),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &VENDOR_ECC_SIG),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&owner_ecc_pubkey, &owner_ecc_sig)),
@@ -1112,7 +1084,6 @@ mod tests {
         let header_info: HeaderInfo = HeaderInfo {
             vendor_ecc_pub_key_idx: 1,
             vendor_lms_pub_key_idx: Some(0),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &VENDOR_ECC_SIG),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&owner_ecc_pubkey, &owner_ecc_sig)),
@@ -1146,7 +1117,6 @@ mod tests {
         let header_info: HeaderInfo = HeaderInfo {
             vendor_ecc_pub_key_idx: 0,
             vendor_lms_pub_key_idx: Some(1),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &VENDOR_ECC_SIG),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&owner_ecc_pubkey, &owner_ecc_sig)),
@@ -1162,40 +1132,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn test_header_incorrect_owner_lms_pubkey_index() {
-        let test_env = TestEnv {
-            verify_result: true,
-            verify_lms_result: true,
-            ..Default::default()
-        };
-        let mut verifier = ImageVerifier::new(test_env);
-        let header = ImageHeader::default();
-        let owner_ecc_pubkey = ImageEccPubKey::default();
-        let owner_ecc_sig = ImageEccSignature::default();
-        let owner_lms_pubkey = ImageLmsPublicKey::default();
-        let owner_lms_sig = ImageLmsSignature::default();
-        let binding_vendor_lms_pubkey = vendor_lms_pubkey();
-        let binding_vendor_lms_sig = vendor_lms_sig();
-        let header_info: HeaderInfo = HeaderInfo {
-            vendor_ecc_pub_key_idx: 0,
-            vendor_lms_pub_key_idx: Some(0),
-            owner_lms_pub_key_idx: Some(1),
-            vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &VENDOR_ECC_SIG),
-            vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
-            owner_ecc_info: Some((&owner_ecc_pubkey, &owner_ecc_sig)),
-            owner_lms_info: Some((&owner_lms_pubkey, &owner_lms_sig)),
-            owner_pub_keys_digest: ImageDigest::default(),
-            vendor_ecc_pub_key_revocation: Default::default(),
-            vendor_lms_pub_key_revocation: Default::default(),
-        };
-        let result = verifier.verify_header(&header, &header_info);
-        assert_eq!(
-            result.err(),
-            Some(CaliptraError::IMAGE_VERIFIER_ERR_OWNER_LMS_PUB_KEY_INDEX_MISMATCH)
-        );
-    }
-
     #[test]
     fn test_header_owner_pubkey_invalid_arg() {
         let test_env = TestEnv {
@@ -1214,7 +1150,6 @@ mod tests {
         let header_info: HeaderInfo = HeaderInfo {
             vendor_ecc_pub_key_idx: 0,
             vendor_lms_pub_key_idx: Some(0),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &VENDOR_ECC_SIG),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&owner_ecc_pubkey, &owner_ecc_sig)),
@@ -1247,7 +1182,6 @@ mod tests {
         let header_info: HeaderInfo = HeaderInfo {
             vendor_ecc_pub_key_idx: 0,
             vendor_lms_pub_key_idx: Some(0),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &VENDOR_ECC_SIG),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&OWNER_ECC_PUBKEY, &owner_ecc_sig)),
@@ -1283,7 +1217,6 @@ mod tests {
         let header_info: HeaderInfo = HeaderInfo {
             vendor_ecc_pub_key_idx: 0,
             vendor_lms_pub_key_idx: Some(0),
-            owner_lms_pub_key_idx: Some(0),
             vendor_ecc_info: (&VENDOR_ECC_PUBKEY, &VENDOR_ECC_SIG),
             vendor_lms_info: Some((&binding_vendor_lms_pubkey, &binding_vendor_lms_sig)),
             owner_ecc_info: Some((&OWNER_ECC_PUBKEY, &OWNER_ECC_SIG)),
diff --git a/rom/dev/Makefile b/rom/dev/Makefile
index d6da8b7a..74de8300 100644
--- a/rom/dev/Makefile
+++ b/rom/dev/Makefile
@@ -70,7 +70,6 @@ build-fw-image: gen-certs build-test-fmc build-test-rt
 		--key-config $(TARGET_DIR)/keys.toml \
 		--ecc-pk-idx 3 \
 		--lms-pk-idx 3 \
-		--owner-lms-pk-idx 0 \
 		--fmc $(TARGET_DIR)/caliptra-rom-test-fmc \
 		--fmc-svn 0 \
 		--fmc-min-svn 0 \
diff --git a/rom/dev/src/flow/cold_reset/fw_processor.rs b/rom/dev/src/flow/cold_reset/fw_processor.rs
index 24cdf5f3..81127d9e 100644
--- a/rom/dev/src/flow/cold_reset/fw_processor.rs
+++ b/rom/dev/src/flow/cold_reset/fw_processor.rs
@@ -271,14 +271,6 @@ impl FirmwareProcessor {
             )?;
         }
 
-        // Log OwnerLmsPubKeyIndex
-        if let Some(owner_lms_pub_key_idx) = log_info.owner_lms_pub_key_idx {
-            log_fuse_data(
-                FuseLogEntryId::OwnerLmsPubKeyIndex,
-                owner_lms_pub_key_idx.as_bytes(),
-            )?;
-        }
-
         Ok(())
     }
 
@@ -339,11 +331,16 @@ impl FirmwareProcessor {
         );
 
         data_vault.write_cold_reset_entry4(
-            ColdResetEntry4::VendorPubKeyIndex,
+            ColdResetEntry4::EccVendorPubKeyIndex,
             info.vendor_ecc_pub_key_idx,
         );
 
-        // [TODO] Write the Vendor and Owner Public key Indices of LMS keys.
+        // If LMS is not enabled, write the max value to the data vault
+        // to indicate the index is invalid.
+        data_vault.write_cold_reset_entry4(
+            ColdResetEntry4::LmsVendorPubKeyIndex,
+            info.vendor_lms_pub_key_idx.unwrap_or(u32::MAX),
+        );
 
         data_vault.write_warm_reset_entry48(WarmResetEntry48::RtTci, &info.runtime.digest.into());
 
diff --git a/rom/dev/src/lock.rs b/rom/dev/src/lock.rs
index fbf69203..5a036c77 100644
--- a/rom/dev/src/lock.rs
+++ b/rom/dev/src/lock.rs
@@ -65,9 +65,13 @@ fn lock_cold_reset_reg(env: &mut RomEnv) {
     env.data_vault
         .lock_cold_reset_entry48(ColdResetEntry48::OwnerPubKeyHash);
 
-    // Lock the Vendor Public Key Index in data vault until next cold reset
+    // Lock the Ecc Vendor Public Key Index in data vault until next cold reset
     env.data_vault
-        .lock_cold_reset_entry4(ColdResetEntry4::VendorPubKeyIndex);
+        .lock_cold_reset_entry4(ColdResetEntry4::EccVendorPubKeyIndex);
+
+    // Lock the Lms Vendor Public Key Index in data vault until next cold reset
+    env.data_vault
+        .lock_cold_reset_entry4(ColdResetEntry4::LmsVendorPubKeyIndex);
 }
 
 /// Lock all common registers across all reset types
diff --git a/rom/dev/src/pcr.rs b/rom/dev/src/pcr.rs
index 7666a7ee..94fcf9be 100644
--- a/rom/dev/src/pcr.rs
+++ b/rom/dev/src/pcr.rs
@@ -85,14 +85,19 @@ pub(crate) fn extend_pcr0(
         PcrLogEntryId::OwnerPubKeyHash,
     )?;
     pcr.extend_u8(
-        env.data_vault.vendor_pk_index() as u8,
-        PcrLogEntryId::VendorPubKeyIndex,
+        env.data_vault.ecc_vendor_pk_index() as u8,
+        PcrLogEntryId::EccVendorPubKeyIndex,
     )?;
     pcr.extend(env.data_vault.fmc_tci(), PcrLogEntryId::FmcTci)?;
     pcr.extend_u8(env.data_vault.fmc_svn() as u8, PcrLogEntryId::FmcSvn)?;
     pcr.extend_u8(info.fmc.effective_fuse_svn as u8, PcrLogEntryId::FmcFuseSvn)?;
+    if let Some(vendor_lms_pub_key_idx) = info.vendor_lms_pub_key_idx {
+        pcr.extend_u8(
+            vendor_lms_pub_key_idx as u8,
+            PcrLogEntryId::LmsVendorPubKeyIndex,
+        )?;
+    }
 
-    // TODO: Check PCR0 != 0
     Ok(())
 }
 
diff --git a/rom/dev/src/verifier.rs b/rom/dev/src/verifier.rs
index 6e66e7c8..4ad5f3c9 100644
--- a/rom/dev/src/verifier.rs
+++ b/rom/dev/src/verifier.rs
@@ -115,7 +115,7 @@ impl<'a> ImageVerificationEnv for &mut RomImageVerificationEnv<'a> {
 
     /// Get the vendor key index saved in data vault on cold boot
     fn vendor_pub_key_idx_dv(&self) -> u32 {
-        self.data_vault.vendor_pk_index()
+        self.data_vault.ecc_vendor_pk_index()
     }
 
     /// Get the owner public key digest saved in the dv on cold boot
diff --git a/rom/dev/tools/keys.toml b/rom/dev/tools/keys.toml
index 472131c2..a2c79426 100644
--- a/rom/dev/tools/keys.toml
+++ b/rom/dev/tools/keys.toml
@@ -85,15 +85,5 @@ lms_priv_keys = [
 [owner]
 ecc_pub_key = "own-pub-key.pem"
 ecc_priv_key = "own-priv-key.pem"
-lms_pub_keys = [
-  "own-lms-pub-key-0.pem",
-  "own-lms-pub-key-1.pem",
-  "own-lms-pub-key-2.pem",
-  "own-lms-pub-key-3.pem",
-]
-lms_priv_keys = [
-  "own-lms-priv-key-0.pem",
-  "own-lms-priv-key-1.pem",
-  "own-lms-priv-key-2.pem",
-  "own-lms-priv-key-3.pem",
-]
+lms_pub_key = "own-lms-pub-key.pem"
+lms_priv_key = "own-lms-priv-key.pem"


Test patch:
diff --git a/rom/dev/tests/test_fmcalias_derivation.rs b/rom/dev/tests/test_fmcalias_derivation.rs
index 10220ecf..8d70c515 100644
--- a/rom/dev/tests/test_fmcalias_derivation.rs
+++ b/rom/dev/tests/test_fmcalias_derivation.rs
@@ -4,6 +4,7 @@ use caliptra_builder::{FwId, ImageOptions, APP_WITH_UART, ROM_WITH_UART};
 use caliptra_common::RomBootStatus::ColdResetComplete;
 use caliptra_common::{FirmwareHandoffTable, FuseLogEntry, FuseLogEntryId};
 use caliptra_common::{PcrLogEntry, PcrLogEntryId};
+use caliptra_drivers::ColdResetEntry4;
 use caliptra_error::CaliptraError;
 use caliptra_hw_model::{BootParams, Fuses, HwModel, InitParams, ModelError, SecurityState};
 use caliptra_image_fake_keys::{OWNER_CONFIG, VENDOR_CONFIG_KEY_1};
@@ -81,6 +82,7 @@ fn test_pcr_log() {
 
     let fuses = Fuses {
         anti_rollback_disable: true,
+        lms_verify: true,
         key_manifest_pk_hash: vendor_pubkey_digest,
         owner_pk_hash: owner_pubkey_digest,
         ..Default::default()
@@ -173,7 +175,7 @@ fn test_pcr_log() {
     pcr_log_entry_offset += core::mem::size_of::<PcrLogEntry>();
     let pcr_log_entry =
         PcrLogEntry::read_from_prefix(pcr_entry_arr[pcr_log_entry_offset..].as_bytes()).unwrap();
-    assert_eq!(pcr_log_entry.id, PcrLogEntryId::VendorPubKeyIndex as u16);
+    assert_eq!(pcr_log_entry.id, PcrLogEntryId::EccVendorPubKeyIndex as u16);
     assert_eq!(pcr_log_entry.pcr_id, 0);
     assert_eq!(
         pcr_log_entry.pcr_data[0] as u8,
@@ -202,6 +204,17 @@ fn test_pcr_log() {
     assert_eq!(pcr_log_entry.id, PcrLogEntryId::FmcFuseSvn as u16);
     assert_eq!(pcr_log_entry.pcr_id, 0);
     assert_eq!(pcr_log_entry.pcr_data[0] as u8, 0); // anti_rollback_disable is true
+
+    // Check PCR entry for LmsVendorPubKeyIndex.
+    pcr_log_entry_offset += core::mem::size_of::<PcrLogEntry>();
+    let pcr_log_entry =
+        PcrLogEntry::read_from_prefix(pcr_entry_arr[pcr_log_entry_offset..].as_bytes()).unwrap();
+    assert_eq!(pcr_log_entry.id, PcrLogEntryId::LmsVendorPubKeyIndex as u16);
+    assert_eq!(pcr_log_entry.pcr_id, 0);
+    assert_eq!(
+        pcr_log_entry.pcr_data[0] as u8,
+        VENDOR_CONFIG_KEY_1.lms_key_idx as u8
+    );
 }
 
 #[test]
@@ -427,16 +440,6 @@ fn test_fuse_log() {
         FuseLogEntryId::VendorLmsPubKeyRevocation as u32
     );
     assert_eq!(fuse_log_entry.log_data[0], 0,);
-
-    // Validate the OwnerLmsPubKeyIndex
-    fuse_log_entry_offset += core::mem::size_of::<FuseLogEntry>();
-    let fuse_log_entry =
-        FuseLogEntry::read_from_prefix(fuse_entry_arr[fuse_log_entry_offset..].as_bytes()).unwrap();
-    assert_eq!(
-        fuse_log_entry.entry_id,
-        FuseLogEntryId::OwnerLmsPubKeyIndex as u32
-    );
-    assert_eq!(fuse_log_entry.log_data[0], OWNER_CONFIG.lms_key_idx);
 }
 
 #[test]
@@ -484,3 +487,63 @@ fn test_fht_info() {
 
     // [TODO] Expand test to validate additional FHT fields.
 }
+
+#[test]
+fn test_check_no_lms_info_in_datavault_on_lms_unavailable() {
+    let (_hw, _image_bundle) =
+        helpers::build_hw_model_and_image_bundle(Fuses::default(), ImageOptions::default());
+
+    pub const TEST_FMC_WITH_UART: FwId = FwId {
+        crate_name: "caliptra-rom-test-fmc",
+        bin_name: "caliptra-rom-test-fmc",
+        features: &["emu"],
+        workspace_dir: None,
+    };
+
+    let fuses = Fuses {
+        lms_verify: false,
+        ..Default::default()
+    };
+    let rom = caliptra_builder::build_firmware_rom(&ROM_WITH_UART).unwrap();
+    let mut hw = caliptra_hw_model::new(BootParams {
+        init_params: InitParams {
+            rom: &rom,
+            security_state: SecurityState::from(fuses.life_cycle as u32),
+            ..Default::default()
+        },
+        fuses,
+        ..Default::default()
+    })
+    .unwrap();
+
+    let image_bundle = caliptra_builder::build_and_sign_image(
+        &TEST_FMC_WITH_UART,
+        &APP_WITH_UART,
+        ImageOptions::default(),
+    )
+    .unwrap();
+
+    assert!(hw
+        .upload_firmware(&image_bundle.to_bytes().unwrap())
+        .is_ok());
+
+    hw.step_until_boot_status(ColdResetComplete.into(), true);
+
+    let result = hw.mailbox_execute(0x1000_0005, &[]);
+    assert!(result.is_ok());
+
+    let coldresetentry4_array = result.unwrap().unwrap();
+    let mut coldresetentry4_offset = core::mem::size_of::<u32>() * 6; // Skip first 3 entries
+
+    // Check LmsVendorPubKeyIndex datavault value.
+    let coldresetentry4_id =
+        u32::read_from_prefix(coldresetentry4_array[coldresetentry4_offset..].as_bytes()).unwrap();
+    assert_eq!(
+        coldresetentry4_id,
+        ColdResetEntry4::LmsVendorPubKeyIndex as u32
+    );
+    coldresetentry4_offset += core::mem::size_of::<u32>();
+    let coldresetentry4_value =
+        u32::read_from_prefix(coldresetentry4_array[coldresetentry4_offset..].as_bytes()).unwrap();
+    assert_eq!(coldresetentry4_value, u32::MAX);
+}
diff --git a/rom/dev/tests/test_image_validation.rs b/rom/dev/tests/test_image_validation.rs
index cec88826..4a8e7db2 100644
--- a/rom/dev/tests/test_image_validation.rs
+++ b/rom/dev/tests/test_image_validation.rs
@@ -16,7 +16,7 @@ use caliptra_image_fake_keys::{
 use caliptra_image_gen::{ImageGenerator, ImageGeneratorConfig, ImageGeneratorVendorConfig};
 use caliptra_image_openssl::OsslCrypto;
 use caliptra_image_types::{
-    ImageBundle, ImageManifest, OWNER_LMS_KEY_COUNT, VENDOR_ECC_KEY_COUNT, VENDOR_LMS_KEY_COUNT,
+    ImageBundle, ImageManifest, VENDOR_ECC_KEY_COUNT, VENDOR_LMS_KEY_COUNT,
 };
 use openssl::asn1::Asn1Integer;
 use openssl::asn1::Asn1Time;
@@ -343,40 +343,6 @@ fn test_preamble_vendor_lms_optional_no_pubkey_out_of_bounds_check() {
     hw.step_until_boot_status(ColdResetComplete.into(), true);
 }
 
-#[test]
-fn test_preamble_owner_lms_pubkey_out_of_bounds() {
-    let fuses = caliptra_hw_model::Fuses {
-        lms_verify: true,
-        ..Default::default()
-    };
-    let (mut hw, mut image_bundle) =
-        helpers::build_hw_model_and_image_bundle(fuses, ImageOptions::default());
-    image_bundle.manifest.preamble.owner_lms_pub_key_idx = OWNER_LMS_KEY_COUNT;
-
-    assert_eq!(
-        ModelError::MailboxCmdFailed(
-            CaliptraError::IMAGE_VERIFIER_ERR_OWNER_LMS_PUB_KEY_INDEX_OUT_OF_BOUNDS.into()
-        ),
-        hw.upload_firmware(&image_bundle.to_bytes().unwrap())
-            .unwrap_err()
-    );
-}
-
-#[test]
-fn test_preamble_owner_lms_optional_no_pubkey_out_of_bounds_check() {
-    let fuses = caliptra_hw_model::Fuses {
-        lms_verify: false,
-        ..Default::default()
-    };
-    let (mut hw, mut image_bundle) =
-        helpers::build_hw_model_and_image_bundle(fuses, ImageOptions::default());
-    image_bundle.manifest.preamble.owner_lms_pub_key_idx = OWNER_LMS_KEY_COUNT;
-
-    hw.upload_firmware(&image_bundle.to_bytes().unwrap())
-        .unwrap();
-    hw.step_until_boot_status(ColdResetComplete.into(), true);
-}
-
 #[test]
 fn test_header_verify_vendor_sig_zero_ecc_pubkey() {
     let (mut hw, mut image_bundle) =
@@ -595,14 +561,16 @@ fn test_header_verify_owner_lms_sig_mismatch() {
     };
     let (mut hw, mut image_bundle) =
         helpers::build_hw_model_and_image_bundle(fuses, ImageOptions::default());
-    let owner_lms_pub_key_idx = image_bundle.manifest.preamble.owner_lms_pub_key_idx as usize;
 
     // Modify the owner public key.
-    let lms_pub_key_backup =
-        image_bundle.manifest.preamble.owner_pub_keys.lms_pub_keys[owner_lms_pub_key_idx];
+    let lms_pub_key_backup = image_bundle.manifest.preamble.owner_pub_keys.lms_pub_key;
 
-    image_bundle.manifest.preamble.owner_pub_keys.lms_pub_keys[owner_lms_pub_key_idx].digest =
-        [Default::default(); 6];
+    image_bundle
+        .manifest
+        .preamble
+        .owner_pub_keys
+        .lms_pub_key
+        .digest = [Default::default(); 6];
     assert_eq!(
         ModelError::MailboxCmdFailed(
             CaliptraError::IMAGE_VERIFIER_ERR_OWNER_LMS_SIGNATURE_INVALID.into()
@@ -619,8 +587,7 @@ fn test_header_verify_owner_lms_sig_mismatch() {
         helpers::build_hw_model_and_image_bundle(fuses, ImageOptions::default());
 
     // Modify the owner signature.
-    image_bundle.manifest.preamble.owner_pub_keys.lms_pub_keys[owner_lms_pub_key_idx] =
-        lms_pub_key_backup;
+    image_bundle.manifest.preamble.owner_pub_keys.lms_pub_key = lms_pub_key_backup;
     image_bundle.manifest.preamble.owner_sigs.lms_sig.tree_path[0] = [Default::default(); 6];
 
     assert_eq!(
@@ -640,14 +607,16 @@ fn test_header_verify_owner_lms_optional_no_sig_mismatch_check() {
     };
     let (mut hw, mut image_bundle) =
         helpers::build_hw_model_and_image_bundle(fuses, ImageOptions::default());
-    let owner_lms_pub_key_idx = image_bundle.manifest.preamble.owner_lms_pub_key_idx as usize;
 
     // Modify the owner public key.
-    let lms_pub_key_backup =
-        image_bundle.manifest.preamble.owner_pub_keys.lms_pub_keys[owner_lms_pub_key_idx];
+    let lms_pub_key_backup = image_bundle.manifest.preamble.owner_pub_keys.lms_pub_key;
 
-    image_bundle.manifest.preamble.owner_pub_keys.lms_pub_keys[owner_lms_pub_key_idx].digest =
-        [Default::default(); 6];
+    image_bundle
+        .manifest
+        .preamble
+        .owner_pub_keys
+        .lms_pub_key
+        .digest = [Default::default(); 6];
     hw.upload_firmware(&image_bundle.to_bytes().unwrap())
         .unwrap();
     hw.step_until_boot_status(ColdResetComplete.into(), true);
@@ -660,8 +629,7 @@ fn test_header_verify_owner_lms_optional_no_sig_mismatch_check() {
         helpers::build_hw_model_and_image_bundle(fuses, ImageOptions::default());
 
     // Modify the owner signature.
-    image_bundle.manifest.preamble.owner_pub_keys.lms_pub_keys[owner_lms_pub_key_idx] =
-        lms_pub_key_backup;
+    image_bundle.manifest.preamble.owner_pub_keys.lms_pub_key = lms_pub_key_backup;
     image_bundle.manifest.preamble.owner_sigs.lms_sig.tree_path[0] = [Default::default(); 6];
 
     hw.upload_firmware(&image_bundle.to_bytes().unwrap())
@@ -730,50 +698,6 @@ fn test_header_verify_vendor_lms_optional_no_pub_key_in_preamble_and_header_chec
     hw.step_until_boot_status(ColdResetComplete.into(), true);
 }
 
-#[test]
-fn test_header_verify_owner_lms_pub_key_in_preamble_and_header() {
-    let fuses = caliptra_hw_model::Fuses {
-        lms_verify: true,
-        ..Default::default()
-    };
-
-    let (mut hw, mut image_bundle) =
-        helpers::build_hw_model_and_image_bundle(fuses, ImageOptions::default());
-
-    // Change vendor pubkey index.
-    image_bundle.manifest.header.owner_lms_pub_key_idx =
-        image_bundle.manifest.preamble.owner_lms_pub_key_idx + 1;
-    update_header(&mut image_bundle);
-
-    assert_eq!(
-        ModelError::MailboxCmdFailed(
-            CaliptraError::IMAGE_VERIFIER_ERR_OWNER_LMS_PUB_KEY_INDEX_MISMATCH.into()
-        ),
-        hw.upload_firmware(&image_bundle.to_bytes().unwrap())
-            .unwrap_err()
-    );
-}
-
-#[test]
-fn test_header_verify_owner_lms_optional_no_pub_key_in_preamble_and_header_check() {
-    let fuses = caliptra_hw_model::Fuses {
-        lms_verify: false,
-        ..Default::default()
-    };
-
-    let (mut hw, mut image_bundle) =
-        helpers::build_hw_model_and_image_bundle(fuses, ImageOptions::default());
-
-    // Change vendor pubkey index.
-    image_bundle.manifest.header.owner_lms_pub_key_idx =
-        image_bundle.manifest.preamble.owner_lms_pub_key_idx + 1;
-    update_header(&mut image_bundle);
-
-    hw.upload_firmware(&image_bundle.to_bytes().unwrap())
-        .unwrap();
-    hw.step_until_boot_status(ColdResetComplete.into(), true);
-}
-
 #[test]
 fn test_header_verify_owner_sig_zero_fuses() {
     let image_bundle = caliptra_builder::build_and_sign_image(
@@ -1787,7 +1711,6 @@ fn update_header(image_bundle: &mut ImageBundle) {
             &config,
             image_bundle.manifest.preamble.vendor_ecc_pub_key_idx,
             image_bundle.manifest.preamble.vendor_lms_pub_key_idx,
-            image_bundle.manifest.preamble.owner_lms_pub_key_idx,
             &header_digest_vendor,
             &header_digest_owner,
         )
diff --git a/rom/dev/tools/test-fmc/src/main.rs b/rom/dev/tools/test-fmc/src/main.rs
index 4dcc8c2b..6f9e1327 100644
--- a/rom/dev/tools/test-fmc/src/main.rs
+++ b/rom/dev/tools/test-fmc/src/main.rs
@@ -20,6 +20,7 @@ use caliptra_common::memory_layout::{
 use caliptra_common::FirmwareHandoffTable;
 use caliptra_common::{FuseLogEntry, FuseLogEntryId};
 use caliptra_common::{PcrLogEntry, PcrLogEntryId};
+use caliptra_drivers::ColdResetEntry4::*;
 use caliptra_drivers::{DataVault, Mailbox};
 use caliptra_registers::dv::DvReg;
 use caliptra_x509::{Ecdsa384CertBuilder, Ecdsa384Signature, FmcAliasCertTbs, LocalDevIdCertTbs};
@@ -214,6 +215,9 @@ fn process_mailbox_command(mbox: &caliptra_registers::mbox::RegisterBlock<RealMm
         0x1000_0004 => {
             trigger_update_reset(mbox);
         }
+        0x1000_0005 => {
+            read_datavault_coldresetentry4(mbox);
+        }
         _ => {}
     }
 }
@@ -233,6 +237,25 @@ fn process_mailbox_commands() {
     process_mailbox_command(&mbox);
 }
 
+fn read_datavault_coldresetentry4(mbox: &caliptra_registers::mbox::RegisterBlock<RealMmioMut>) {
+    let data_vault = unsafe { DataVault::new(DvReg::new()) };
+    send_to_mailbox(mbox, (FmcSvn as u32).as_bytes(), false);
+    send_to_mailbox(mbox, data_vault.fmc_svn().as_bytes(), false);
+
+    send_to_mailbox(mbox, (FmcEntryPoint as u32).as_bytes(), false);
+    send_to_mailbox(mbox, data_vault.fmc_entry_point().as_bytes(), false);
+
+    send_to_mailbox(mbox, (EccVendorPubKeyIndex as u32).as_bytes(), false);
+    send_to_mailbox(mbox, data_vault.ecc_vendor_pk_index().as_bytes(), false);
+
+    send_to_mailbox(mbox, (LmsVendorPubKeyIndex as u32).as_bytes(), false);
+    send_to_mailbox(mbox, data_vault.lms_vendor_pk_index().as_bytes(), false);
+
+    mbox.dlen()
+        .write(|_| (core::mem::size_of::<u32>() * 8).try_into().unwrap());
+    mbox.status().write(|w| w.status(|w| w.data_ready()));
+}
+
 fn trigger_update_reset(mbox: &caliptra_registers::mbox::RegisterBlock<RealMmioMut>) {
     mbox.status().write(|w| w.status(|w| w.cmd_complete()));
     const STDOUT: *mut u32 = 0x3003_0624 as *mut u32;