Skip to content

Commit 2b7b5d8

Browse files
danielinuxdanielinux
committed
Fixed order of SHA digests. Working hybrid auth.
+ minor fixes.
1 parent 414ae86 commit 2b7b5d8

15 files changed

Lines changed: 420 additions & 317 deletions

File tree

‎Makefile‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -207,14 +207,13 @@ $(PRIVATE_KEY):
207207
$(Q)(test $(SIGN) = NONE) && (echo "// SIGN=NONE" > src/keystore.c) || true
208208
$(Q)(test "$(FLASH_OTP_KEYSTORE)" = "1") && (make -C tools/keytools/otp) || true
209209

210-
$(SECONDARY_PRIVATE_KEY): $(PRIVATE_KEY)
210+
$(SECONDARY_PRIVATE_KEY): $(PRIVATE_KEY) keystore.der
211211
$(Q)$(MAKE) keytools_check
212212
$(Q)rm -f src/keystore.c
213-
$(Q)mv $(PRIVATE_KEY) primary.$(PRIVATE_KEY)
213+
$(Q)dd if=keystore.der of=pubkey_1.der bs=1 skip=16
214214
$(Q)(test $(SIGN_SECONDARY) = NONE) || ("$(KEYGEN_TOOL)" \
215-
$(KEYGEN_OPTIONS) -i primary.$(PRIVATE_KEY) $(SECONDARY_KEYGEN_OPTIONS) \
215+
$(KEYGEN_OPTIONS) -i pubkey_1.der $(SECONDARY_KEYGEN_OPTIONS) \
216216
-g $(SECONDARY_PRIVATE_KEY)) || true
217-
$(Q)mv primary.$(PRIVATE_KEY) $(PRIVATE_KEY)
218217
$(Q)(test "$(FLASH_OTP_KEYSTORE)" = "1") && (make -C tools/keytools/otp) || true
219218

220219
keytools: include/target.h

‎arch.mk‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,13 @@ SPI_TARGET=$(TARGET)
2525
# Default UART driver name
2626
UART_TARGET=$(TARGET)
2727

28-
# Include SHA256 module because it's implicitly needed by RSA
29-
WOLFCRYPT_OBJS+=./lib/wolfssl/wolfcrypt/src/sha256.o
28+
# Include some modules by default
29+
WOLFCRYPT_OBJS+=./lib/wolfssl/wolfcrypt/src/sha256.o \
30+
./lib/wolfssl/wolfcrypt/src/hash.o \
31+
./lib/wolfssl/wolfcrypt/src/memory.o \
32+
./lib/wolfssl/wolfcrypt/src/wc_port.o \
33+
./lib/wolfssl/wolfcrypt/src/wolfmath.o
34+
3035

3136
ifeq ($(ARCH),x86_64)
3237
CFLAGS+=-DARCH_x86_64

config/examples/sim-ml-dsa-ecc-hybrid.conf renamed to config/examples/sim-ml-dsa-ecc-hybrid.config

File renamed without changes.

‎hal/sim.c‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040

4141
#include "wolfboot/wolfboot.h"
4242
#include "target.h"
43+
#include "printf.h"
4344

4445
/* Global pointer to the internal and external flash base */
4546
uint8_t *sim_ram_base;
@@ -72,7 +73,7 @@ static int mmap_file(const char *path, uint8_t *address, uint8_t** ret_address)
7273

7374
fd = open(path, O_RDWR);
7475
if (fd == -1) {
75-
fprintf(stderr, "can't open %s\n", path);
76+
wolfBoot_printf( "can't open %s\n", path);
7677
return -1;
7778
}
7879

@@ -81,7 +82,7 @@ static int mmap_file(const char *path, uint8_t *address, uint8_t** ret_address)
8182
if (mmaped_addr == MAP_FAILED)
8283
return -1;
8384

84-
fprintf(stderr, "Simulator assigned %s to base %p\n", path, mmaped_addr);
85+
wolfBoot_printf( "Simulator assigned %s to base %p\n", path, mmaped_addr);
8586

8687
*ret_address = mmaped_addr;
8788

@@ -119,8 +120,8 @@ int hal_flash_write(uintptr_t address, const uint8_t *data, int len)
119120
uint8_t *addr = (uint8_t *)address;
120121
if (addr[i] != FLASH_BYTE_ERASED) {
121122
/* no writing to non-erased page in NVM_FLASH_WRITEONCE */
122-
printf("NVM_FLASH_WRITEONCE non-erased write detected at address %p!\n", addr);
123-
printf("Address[%d] = %02x\n", i, addr[i]);
123+
wolfBoot_printf("NVM_FLASH_WRITEONCE non-erased write detected at address %p!\n", addr);
124+
wolfBoot_printf("Address[%d] = %02x\n", i, addr[i]);
124125
return -1;
125126
}
126127
#endif
@@ -137,9 +138,9 @@ int hal_flash_write(uintptr_t address, const uint8_t *data, int len)
137138
int hal_flash_erase(uintptr_t address, int len)
138139
{
139140
/* implicit cast abide compiler warning */
140-
fprintf(stderr, "hal_flash_erase addr %p len %d\n", (void*)address, len);
141+
wolfBoot_printf( "hal_flash_erase addr %p len %d\n", (void*)address, len);
141142
if (address == erasefail_address + WOLFBOOT_PARTITION_BOOT_ADDRESS) {
142-
fprintf(stderr, "POWER FAILURE\n");
143+
wolfBoot_printf( "POWER FAILURE\n");
143144
/* Corrupt page */
144145
memset((void*)address, 0xEE, len);
145146
exit(0);
@@ -156,23 +157,23 @@ void hal_init(void)
156157
ret = mmap_file(INTERNAL_FLASH_FILE,
157158
(uint8_t*)ARCH_FLASH_OFFSET, &sim_ram_base);
158159
if (ret != 0) {
159-
fprintf(stderr, "failed to load internal flash file\n");
160+
wolfBoot_printf( "failed to load internal flash file\n");
160161
exit(-1);
161162
}
162163

163164
#ifdef EXT_FLASH
164165
ret = mmap_file(EXTERNAL_FLASH_FILE,
165166
(uint8_t*)ARCH_FLASH_OFFSET + 0x10000000, &flash_base);
166167
if (ret != 0) {
167-
fprintf(stderr, "failed to load external flash file\n");
168+
wolfBoot_printf( "failed to load external flash file\n");
168169
exit(-1);
169170
}
170171
#endif /* EXT_FLASH */
171172

172173
for (i = 1; i < main_argc; i++) {
173174
if (strcmp(main_argv[i], "powerfail") == 0) {
174175
erasefail_address = strtol(main_argv[++i], NULL, 16);
175-
fprintf(stderr, "Set power fail to erase at address %x\n",
176+
wolfBoot_printf( "Set power fail to erase at address %x\n",
176177
erasefail_address);
177178
}
178179
/* force a bad write of the boot partition to trigger and test the
@@ -262,15 +263,15 @@ void do_boot(const uint32_t *app_offset)
262263

263264
ret = NSCreateObjectFileImageFromMemory(app_buf, app_size, &fileImage);
264265
if (ret != 1 || fileImage == NULL) {
265-
fprintf(stderr, "Error loading object memory!\n");
266+
wolfBoot_printf( "Error loading object memory!\n");
266267
exit(-1);
267268
}
268269
module = NSLinkModule(fileImage, "module",
269270
(NSLINKMODULE_OPTION_PRIVATE | NSLINKMODULE_OPTION_BINDNOW));
270271
symbol = NSLookupSymbolInModule(module, "__mh_execute_header");
271272
pSymbolAddress = NSAddressOfSymbol(symbol);
272273
if (!find_epc(pSymbolAddress, &epc)) {
273-
fprintf(stderr, "Error finding entry point!\n");
274+
wolfBoot_printf( "Error finding entry point!\n");
274275
exit(-1);
275276
}
276277

@@ -283,17 +284,17 @@ void do_boot(const uint32_t *app_offset)
283284
char *envp[1] = {NULL};
284285
int fd = memfd_create("test_app", 0);
285286
if (fd == -1) {
286-
fprintf(stderr, "memfd error\n");
287+
wolfBoot_printf( "memfd error\n");
287288
exit(-1);
288289
}
289290

290291
if ((size_t)write(fd, app_offset, app_size) != app_size) {
291-
fprintf(stderr, "can't write test-app to memfd\n");
292+
wolfBoot_printf( "can't write test-app to memfd\n");
292293
exit(-1);
293294
}
294295

295296
ret = fexecve(fd, main_argv, envp);
296-
fprintf(stderr, "fexecve error\n");
297+
wolfBoot_printf( "fexecve error\n");
297298
#endif
298299
exit(1);
299300
}

‎include/image.h‎

Lines changed: 33 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -80,29 +80,55 @@ int wolfBot_get_dts_size(void *dts_addr);
8080
#endif
8181

8282
#ifdef WOLFBOOT_SIGN_PRIMARY_ED25519
83-
#define wolfBoot_verify_signature wolfBoot_verify_signature_ed25519
83+
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_ed25519
8484
#endif
8585
#ifdef WOLFBOOT_SIGN_PRIMARY_ED448
86-
#define wolfBoot_verify_signature wolfBoot_verify_signature_ed448
86+
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_ed448
8787
#endif
8888
#if defined (WOLFBOOT_SIGN_PRIMARY_RSA2048) || \
8989
defined (WOLFBOOT_SIGN_PRIMARY_RSA3072) || \
9090
defined (WOLFBOOT_SIGN_PRIMARY_RSA4096)
91-
#define wolfBoot_verify_signature wolfBoot_verify_signature_rsa
91+
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_rsa
9292
#endif
9393
#if defined (WOLFBOOT_SIGN_PRIMARY_ECC256) || \
9494
defined (WOLFBOOT_SIGN_PRIMARY_ECC384) || \
9595
defined (WOLFBOOT_SIGN_PRIMARY_ECC521)
96-
#define wolfBoot_verify_signature wolfBoot_verify_signature_ecc
96+
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_ecc
9797
#endif
9898
#ifdef WOLFBOOT_SIGN_PRIMARY_LMS
99-
#define wolfBoot_verify_signature wolfBoot_verify_signature_lms
99+
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_lms
100100
#endif
101101
#ifdef WOLFBOOT_SIGN_PRIMARY_XMSS
102-
#define wolfBoot_verify_signature wolfBoot_verify_signature_xmss
102+
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_xmss
103103
#endif
104104
#ifdef WOLFBOOT_SIGN_PRIMARY_ML_DSA
105-
#define wolfBoot_verify_signature wolfBoot_verify_signature_ml_dsa
105+
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_ml_dsa
106+
#endif
107+
108+
#ifdef WOLFBOOT_SIGN_SECONDARY_ED25519
109+
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_ed25519
110+
#endif
111+
#ifdef WOLFBOOT_SIGN_SECONDARY_ED448
112+
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_ed448
113+
#endif
114+
#if defined (WOLFBOOT_SIGN_SECONDARY_RSA2048) || \
115+
defined (WOLFBOOT_SIGN_SECONDARY_RSA3072) || \
116+
defined (WOLFBOOT_SIGN_SECONDARY_RSA4096)
117+
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_rsa
118+
#endif
119+
#if defined (WOLFBOOT_SIGN_SECONDARY_ECC256) || \
120+
defined (WOLFBOOT_SIGN_SECONDARY_ECC384) || \
121+
defined (WOLFBOOT_SIGN_SECONDARY_ECC521)
122+
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_ecc
123+
#endif
124+
#ifdef WOLFBOOT_SIGN_SECONDARY_LMS
125+
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_lms
126+
#endif
127+
#ifdef WOLFBOOT_SIGN_SECONDARY_XMSS
128+
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_xmss
129+
#endif
130+
#ifdef WOLFBOOT_SIGN_SECONDARY_ML_DSA
131+
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_ml_dsa
106132
#endif
107133

108134

‎include/loader.h‎

Lines changed: 26 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -29,74 +29,57 @@
2929
extern "C" {
3030
#endif
3131

32+
#define ED25519_IMAGE_SIGNATURE_SIZE (64)
33+
#define ED448_IMAGE_SIGNATURE_SIZE (114)
34+
35+
#if defined(WOLFBOOT_SIGN_ECC256) || defined(WOLFBOOT_SECONDARY_SIGN_ECC256)
36+
#define ECC_IMAGE_SIGNATURE_SIZE (64)
37+
#elif defined(WOLFBOOT_SIGN_ECC384) || defined(WOLFBOOT_SECONDARY_SIGN_ECC384)
38+
#define ECC_IMAGE_SIGNATURE_SIZE (96)
39+
#elif defined(WOLFBOOT_SIGN_ECC521) || defined(WOLFBOOT_SECONDARY_SIGN_ECC521)
40+
#define ECC_IMAGE_SIGNATURE_SIZE (132)
41+
#endif
42+
43+
#if defined(WOLFBOOT_SIGN_RSA2048) || defined(WOLFBOOT_SECONDARY_SIGN_RSA2048)
44+
#define RSA_IMAGE_SIGNATURE_SIZE (256)
45+
#elif defined(WOLFBOOT_SIGN_RSA3072) || defined(WOLFBOOT_SECONDARY_SIGN_RSA3072)
46+
#define RSA_IMAGE_SIGNATURE_SIZE (384)
47+
#elif defined(WOLFBOOT_SIGN_RSA4096) || defined(WOLFBOOT_SECONDARY_SIGN_RSA4096)
48+
#define RSA_IMAGE_SIGNATURE_SIZE (512)
49+
#endif
50+
51+
#ifndef ML_DSA_IMAGE_SIGNATURE_SIZE
52+
#define ML_DSA_IMAGE_SIGNATURE_SIZE (3309)
53+
#endif
54+
55+
56+
57+
#if 0
3258
#if defined(WOLFBOOT_SIGN_ED25519)
33-
extern const unsigned char ed25519_pub_key[];
34-
extern unsigned int ed25519_pub_key_len;
3559
# define IMAGE_SIGNATURE_SIZE (64)
3660
#elif defined(WOLFBOOT_SIGN_ED448)
37-
extern const unsigned char ed448_pub_key[];
38-
extern unsigned int ed448_pub_key_len;
3961
# define IMAGE_SIGNATURE_SIZE (114)
4062
#elif defined(WOLFBOOT_SIGN_ECC256)
41-
extern const unsigned char ecc256_pub_key[];
42-
extern unsigned int ecc256_pub_key_len;
4363
# define IMAGE_SIGNATURE_SIZE (64)
4464
#elif defined(WOLFBOOT_SIGN_ECC384)
45-
extern const unsigned char ecc384_pub_key[];
46-
extern unsigned int ecc384_pub_key_len;
4765
# define IMAGE_SIGNATURE_SIZE (96)
4866
#elif defined(WOLFBOOT_SIGN_ECC521)
49-
extern const unsigned char ecc521_pub_key[];
50-
extern unsigned int ecc521_pub_key_len;
5167
# define IMAGE_SIGNATURE_SIZE (132)
5268
#elif defined(WOLFBOOT_SIGN_RSA2048)
53-
extern const unsigned char rsa2048_pub_key[];
54-
extern unsigned int rsa2048_pub_key_len;
5569
# define IMAGE_SIGNATURE_SIZE (256)
5670
#elif defined(WOLFBOOT_SIGN_RSA3072)
57-
extern const unsigned char rsa3072_pub_key[];
58-
extern unsigned int rsa3072_pub_key_len;
5971
# define IMAGE_SIGNATURE_SIZE (384)
6072
#elif defined(WOLFBOOT_SIGN_RSA4096)
61-
extern const unsigned char rsa4096_pub_key[];
62-
extern unsigned int rsa4096_pub_key_len;
6373
# define IMAGE_SIGNATURE_SIZE (512)
6474
/* In PQC methods the signature size is a function of
6575
* the parameters. Therefore IMAGE_SIGNATURE_SIZE is
6676
* set in options.mk from the .config file. */
6777
#elif defined(WOLFBOOT_SIGN_LMS)
68-
extern const unsigned char lms_pub_key[];
69-
extern unsigned int lms_pub_key_len;
7078
#elif defined(WOLFBOOT_SIGN_XMSS)
71-
extern const unsigned char xmss_pub_key[];
72-
extern unsigned int xmss_pub_key_len;
7379
#elif defined(WOLFBOOT_SIGN_ML_DSA)
74-
extern const unsigned char ml_dsa_pub_key[];
75-
extern unsigned int ml_dsa_pub_key_len;
7680
#elif !defined(WOLFBOOT_NO_SIGN)
7781
# error "No public key available for given signing algorithm."
7882
#endif /* Algorithm selection */
79-
80-
#ifdef WOLFBOOT_SIGN_PRIMARY_ED25519
81-
#define wolfBoot_verify_signature wolfBoot_verify_signature_ed25519
82-
#endif
83-
#ifdef WOLFBOOT_SIGN_PRIMARY_ED448
84-
#define wolfBoot_verify_signature wolfBoot_verify_signature_ed448
85-
#endif
86-
#ifdef WOLFBOOT_SIGN_PRIMARY_RSA
87-
#define wolfBoot_verify_signature wolfBoot_verify_signature_rsa
88-
#endif
89-
#ifdef WOLFBOOT_SIGN_PRIMARY_ECC
90-
#define wolfBoot_verify_signature wolfBoot_verify_signature_ecc
91-
#endif
92-
#ifdef WOLFBOOT_SIGN_PRIMARY_LMS
93-
#define wolfBoot_verify_signature wolfBoot_verify_signature_lms
94-
#endif
95-
#ifdef WOLFBOOT_SIGN_PRIMARY_XMSS
96-
#define wolfBoot_verify_signature wolfBoot_verify_signature_xmss
97-
#endif
98-
#ifdef WOLFBOOT_SIGN_PRIMARY_ML_DSA
99-
#define wolfBoot_verify_signature wolfBoot_verify_signature_ml_dsa
10083
#endif
10184

10285
void wolfBoot_start(void);

0 commit comments

Comments
 (0)