Fixes for test cases using keystore

pull/212/head
Daniele Lacamera 2022-07-12 17:18:44 +02:00
parent 513163a77b
commit 9605dd283f
7 changed files with 145 additions and 55 deletions

View File

@ -152,7 +152,7 @@ The API consists of a few functions described below.
Returns the number of slots in the keystore. At least one slot
should be populated if you want to authenticate your firmware today.
The interface assumes that the slots are numbered sequencially, from zero to
The interface assumes that the slots are numbered sequentially, from zero to
`keystore_num_pubkeys() - 1`. Accessing those slots through this API should always
return a valid public key.

View File

@ -106,6 +106,7 @@
#define KEYSTORE_PUBKEY_SIZE_ED448 57
#define KEYSTORE_PUBKEY_SIZE_ECC256 64
#define KEYSTORE_PUBKEY_SIZE_ECC384 96
#define KEYSTORE_PUBKEY_SIZE_ECC521 132
#define KEYSTORE_PUBKEY_SIZE_RSA2048 320
#define KEYSTORE_PUBKEY_SIZE_RSA3072 448
#define KEYSTORE_PUBKEY_SIZE_RSA4096 576

View File

@ -109,7 +109,11 @@ ifeq ($(SIGN),ED25519)
./lib/wolfssl/wolfcrypt/src/wc_port.o \
./lib/wolfssl/wolfcrypt/src/fe_low_mem.o
CFLAGS+=-D"WOLFBOOT_SIGN_ED25519"
STACK_USAGE?=1180
ifeq ($(WOLFTPM),1)
STACK_USAGE=6680
else
STACK_USAGE?=1180
endif
ifeq ($(shell test $(IMAGE_HEADER_SIZE) -lt 256; echo $$?),0)
IMAGE_HEADER_SIZE=256
endif
@ -126,12 +130,15 @@ ifeq ($(SIGN),ED448)
./lib/wolfssl/wolfcrypt/src/wolfmath.o \
./lib/wolfssl/wolfcrypt/src/wc_port.o \
./lib/wolfssl/wolfcrypt/src/fe_low_mem.o
ifeq ($(WOLFBOOT_SMALL_STACK),1)
ifeq ($(WOLFTPM),1)
STACK_USAGE=6680
else ifeq ($(WOLFBOOT_SMALL_STACK),1)
STACK_USAGE?=1024
else
STACK_USAGE?=4376
endif
ifneq ($(HASH),SHA3)
WOLFCRYPT_OBJS+=./lib/wolfssl/wolfcrypt/src/sha3.o
endif

View File

@ -98,18 +98,17 @@ static void wolfBoot_verify_signature(uint8_t key_slot,
#include <wolfssl/wolfcrypt/ecc.h>
#ifdef WOLFBOOT_SIGN_ECC256
#define ECC_KEYSTORE_PUBKEY_SIZE 32
#define ECC_KEY_TYPE ECC_SECP256R1
#endif
#ifdef WOLFBOOT_SIGN_ECC384
#define ECC_KEYSTORE_PUBKEY_SIZE 48
#define ECC_KEY_TYPE ECC_SECP384R1
#endif
#ifdef WOLFBOOT_SIGN_ECC521
#define ECC_KEYSTORE_PUBKEY_SIZE 66
#define ECC_KEY_TYPE ECC_SECP521R1
#endif
#define KEYSTORE_ECC_POINT_SIZE (KEYSTORE_PUBKEY_SIZE / 2)
static void wolfBoot_verify_signature(uint8_t key_slot,
struct wolfBoot_image *img, uint8_t *sig)
{
@ -126,8 +125,8 @@ static void wolfBoot_verify_signature(uint8_t key_slot,
/* Load public key into TPM */
memset(&tpmKey, 0, sizeof(tpmKey));
ret = wolfTPM2_LoadEccPublicKey(&wolftpm_dev, &tpmKey, TPM_ECC_NIST_P256,
pubkey, ECC_KEYSTORE_PUBKEY_SIZE, pubkey + ECC_KEYSTORE_PUBKEY_SIZE,
ECC_KEYSTORE_PUBKEY_SIZE);
pubkey, KEYSTORE_ECC_POINT_SIZE, pubkey + KEYSTORE_ECC_POINT_SIZE,
KEYSTORE_ECC_POINT_SIZE);
if (ret < 0)
return;
ret = wolfTPM2_VerifyHashScheme(&wolftpm_dev, &tpmKey, sig,
@ -161,7 +160,7 @@ static void wolfBoot_verify_signature(uint8_t key_slot,
/* Import public key */
ret = wc_ecc_import_unsigned(&ecc, pubkey,
(byte*)(pubkey + ECC_KEYSTORE_PUBKEY_SIZE), NULL, ECC_KEY_TYPE);
(byte*)(pubkey + KEYSTORE_ECC_POINT_SIZE), NULL, ECC_KEY_TYPE);
if ((ret < 0) || ecc.type != ECC_PUBLICKEY) {
/* Failed to import ecc key */
return;
@ -170,9 +169,9 @@ static void wolfBoot_verify_signature(uint8_t key_slot,
/* Import signature into r,s */
mp_init(&r);
mp_init(&s);
mp_read_unsigned_bin(&r, sig, ECC_KEYSTORE_PUBKEY_SIZE);
mp_read_unsigned_bin(&s, sig + ECC_KEYSTORE_PUBKEY_SIZE,
ECC_KEYSTORE_PUBKEY_SIZE);
mp_read_unsigned_bin(&r, sig, KEYSTORE_ECC_POINT_SIZE);
mp_read_unsigned_bin(&s, sig + KEYSTORE_ECC_POINT_SIZE,
KEYSTORE_ECC_POINT_SIZE);
VERIFY_FN(img, &verify_res, wc_ecc_verify_hash_ex, &r, &s, img->sha_hash,
WOLFBOOT_SHA_DIGEST_SIZE, &verify_res, &ecc);
#endif /* WOLFBOOT_TPM */

View File

@ -82,14 +82,18 @@
static FILE *fpub, *fpub_image;
static int force = 0;
static WC_RNG rng;
#ifndef KEYSLOT_MAX_PUBKEY_SIZE
#define KEYSLOT_MAX_PUBKEY_SIZE 2048
#endif
struct keystore_slot {
uint32_t slot_id;
uint32_t key_type;
uint32_t part_id_mask;
uint32_t pubkey_size;
uint8_t pubkey[2048];
};
uint8_t pubkey[KEYSLOT_MAX_PUBKEY_SIZE];
};
const char pubkeyfile[]= "src/keystore.c";
const char pubkeyimg[] = "keystore.der";
@ -171,7 +175,7 @@ static void fwritekey(uint8_t *key, int len, FILE *f)
}
}
const char KType[9][20] = {
const char KType[][17] = {
"AUTH_KEY_NONE",
"AUTH_KEY_ED25519",
"AUTH_KEY_ECC256",
@ -183,7 +187,7 @@ const char KType[9][20] = {
"AUTH_KEY_RSA3072"
};
const char KSize[9][32] = {
const char KSize[][29] = {
"KEYSTORE_PUBKEY_SIZE_NONE",
"KEYSTORE_PUBKEY_SIZE_ED25519",
"KEYSTORE_PUBKEY_SIZE_ECC256",
@ -195,7 +199,7 @@ const char KSize[9][32] = {
"KEYSTORE_PUBKEY_SIZE_RSA3072"
};
const char KName[9][8] = {
const char KName[][8] = {
"NONE",
"ED25519",
"ECC256",
@ -482,7 +486,7 @@ static void key_generate(uint32_t ktype, const char *kfilename)
static void key_import(uint32_t ktype, const char *fname)
{
uint8_t buf[4096];
uint8_t buf[KEYSLOT_MAX_PUBKEY_SIZE];
FILE *f;
int r;
f = fopen(fname, "rb");
@ -490,7 +494,7 @@ static void key_import(uint32_t ktype, const char *fname)
fprintf(stderr, "Fatal error: could not open file %s to import public key\n", fname);
exit(6);
}
r = fread(buf, 4096, 1, f);
r = fread(buf, sizeof(buf), 1, f);
keystore_add(ktype, buf, r, fname);
}
@ -541,7 +545,8 @@ int main(int argc, char** argv)
i++;
n_pubkeys++;
continue;
} else if (strcmp(argv[i], "-i") == 0) {
}
else if (strcmp(argv[i], "-i") == 0) {
i++;
n_pubkeys++;
continue;
@ -572,7 +577,8 @@ int main(int argc, char** argv)
printf("Imp %s\n", argv[i + 1]);
key_import(keytype, argv[i + 1]);
i++;
} else if (strcmp(argv[i], "-g") == 0) {
}
else if (strcmp(argv[i], "-g") == 0) {
printf("Gen %s\n", argv[i + 1]);
key_generate(keytype, argv[i + 1]);
i++;

View File

@ -251,26 +251,26 @@ renode-factory-rsa4096: FORCE
make renode-factory SIGN=RSA4096
renode-factory-all: FORCE
${Q}make clean
${Q}make keysclean
${Q}make renode-factory-ed25519
${Q}make clean
${Q}make keysclean
${Q}make renode-factory-ed448 RENODE_PORT=55156
${Q}make clean
${Q}make keysclean
${Q}make renode-factory-ecc256 RENODE_PORT=55157
${Q}make clean
${Q}make keysclean
${Q}make renode-factory-ecc384 RENODE_PORT=55158
${Q}make clean
${Q}make keysclean
${Q}make renode-factory-rsa2048 RENODE_PORT=55160
${Q}make clean
${Q}make keysclean
${Q}make renode-factory-rsa3072 RENODE_PORT=55161
${Q}make clean
${Q}make keysclean
${Q}make renode-factory-rsa4096 RENODE_PORT=55162
${Q}make clean
${Q}make keysclean
${Q}make renode-factory SIGN=NONE RENODE_PORT=55163
${Q}echo All tests in $@ OK!
renode-update-ed25519: FORCE
make renode-update SIGN=ED448
make renode-update SIGN=ED25519
renode-update-ed448: FORCE
make renode-update SIGN=ED448
@ -330,59 +330,59 @@ renode-boot-time-all: FORCE
tools/scripts/renode-test-all.sh 2>/dev/null |grep "BOOT TIME"
renode-update-all: FORCE
${Q}make clean
${Q}make keysclean
${Q}make renode-update-ed25519 RENODE_PORT=55155
${Q}make clean
${Q}make keysclean
${Q}make renode-update-ed448 RENODE_PORT=55156
${Q}make clean
${Q}make keysclean
${Q}make renode-update-ecc256 RENODE_PORT=55157
${Q}make clean
${Q}make keysclean
${Q}make renode-update-ecc384 RENODE_PORT=55158
${Q}make clean
${Q}make keysclean
${Q}make renode-update-rsa2048 RENODE_PORT=55160
${Q}make clean
${Q}make keysclean
${Q}make renode-update-rsa3072 RENODE_PORT=55161
${Q}make clean
${Q}make keysclean
${Q}make renode-update-rsa4096 RENODE_PORT=55162
${Q}make clean
${Q}make keysclean
${Q}make renode-update SIGN=NONE RENODE_PORT=55163
${Q}echo All tests in $@ OK!
renode-no-downgrade-all: FORCE
${Q}make clean
${Q}make keysclean
${Q}make renode-no-downgrade-ed25519 RENODE_PORT=55155
${Q}make clean
${Q}make keysclean
${Q}make renode-no-downgrade-ed448 RENODE_PORT=55156
${Q}make clean
${Q}make keysclean
${Q}make renode-no-downgrade-ecc256 RENODE_PORT=55157
${Q}make clean
${Q}make keysclean
${Q}make renode-no-downgrade-ecc384 RENODE_PORT=55158
${Q}make clean
${Q}make keysclean
${Q}make renode-no-downgrade-rsa2048 RENODE_PORT=55160
${Q}make clean
${Q}make keysclean
${Q}make renode-no-downgrade-rsa3072 RENODE_PORT=55161
${Q}make clean
${Q}make keysclean
${Q}make renode-no-downgrade-rsa4096 RENODE_PORT=55162
${Q}make clean
${Q}make keysclean
${Q}make renode-no-downgrade SIGN=NONE RENODE_PORT=55163
${Q}echo All tests in $@ OK!
renode-corrupted-all: FORCE
${Q}make clean
${Q}make keysclean
${Q}make renode-corrupted-ed25519 RENODE_PORT=55155
${Q}make clean
${Q}make keysclean
${Q}make renode-corrupted-ed448 RENODE_PORT=55156
${Q}make clean
${Q}make keysclean
${Q}make renode-corrupted-ecc256 RENODE_PORT=55157
${Q}make clean
${Q}make keysclean
${Q}make renode-corrupted-ecc384 RENODE_PORT=55158
${Q}make clean
${Q}make keysclean
${Q}make renode-corrupted-rsa2048 RENODE_PORT=55160
${Q}make clean
${Q}make keysclean
${Q}make renode-corrupted-rsa3072 RENODE_PORT=55161
${Q}make clean
${Q}make keysclean
${Q}make renode-corrupted-rsa4096 RENODE_PORT=55162
${Q}make clean
${Q}make keysclean
${Q}make renode-corrupted SIGN=NONE RENODE_PORT=55163
${Q}echo All tests in $@ OK!

View File

@ -654,20 +654,29 @@ test-base: clean
@echo ==========
@echo
@echo
@make keysclean
make test-01-forward-update-no-downgrade
make test-02-forward-update-allow-downgrade test-03-rollback
@make keysclean
make test-11-forward-update-no-downgrade-ECC test-13-rollback-ECC
@make keysclean
make test-21-forward-update-no-downgrade-SPI test-23-rollback-SPI
make test-34-forward-self-update
@make keysclean
make test-44-forward-self-update-ECC
@make keysclean
make test-51-forward-update-no-downgrade-RSA
make test-53-rollback-RSA
@make keysclean
make test-61-forward-update-no-downgrade-TPM
make test-63-rollback-TPM
@make keysclean
make test-71-forward-update-no-downgrade-RSA-4096
make test-73-rollback-RSA-4096
@make keysclean
make test-74-forward-update-no-downgrade-ED448
make test-75-rollback-ED448
@make keysclean
make test-76-forward-update-no-downgrade-RSA3072
make test-77-rollback-RSA3072
@ -676,11 +685,17 @@ test-sha3: clean
@echo ==========
@echo
@echo
@make keysclean
make test-81-forward-update-no-downgrade-ED25519-SHA3
@make keysclean
make test-91-forward-update-no-downgrade-ECC256-SHA3
@make keysclean
make test-101-forward-update-no-downgrade-RSA2048-SHA3
@make keysclean
make test-111-forward-update-no-downgrade-RSA4096-SHA3
@make keysclean
make test-112-forward-update-no-downgrade-ED448-SHA3
@make keysclean
make test-113-forward-update-no-downgrade-RSA3072-SHA3
test-tpm: clean
@ -688,6 +703,7 @@ test-tpm: clean
@echo ==========
@echo
@echo
@make keysclean
make test-161-forward-update-no-downgrade-TPM-RSA
make test-163-rollback-TPM-RSA
@ -696,6 +712,7 @@ test-nosign: clean
@echo ==========
@echo
@echo
@make keysclean
make test-171-forward-update-no-downgrade-NOSIGN
make test-173-rollback-NOSIGN
@ -704,17 +721,29 @@ test-smallstack: clean
@echo ==========
@echo
@echo
@make keysclean
make test-201-smallstack-forward-update-no-downgrade
@make keysclean
make test-211-smallstack-forward-update-no-downgrade-ECC
@make keysclean
make test-221-smallstack-forward-update-no-downgrade-SPI
@make keysclean
make test-251-smallstack-forward-update-no-downgrade-RSA
@make keysclean
make test-271-smallstack-forward-update-no-downgrade-RSA4096
@make keysclean
make test-274-smallstack-forward-update-no-downgrade-ED448
@make keysclean
make test-281-smallstack-forward-update-no-downgrade-ED25519-SHA3
@make keysclean
make test-291-smallstack-forward-update-no-downgrade-ECC256-SHA3
@make keysclean
make test-301-smallstack-forward-update-no-downgrade-RSA2048-SHA3
@make keysclean
make test-311-smallstack-forward-update-no-downgrade-RSA4096-SHA3
@make keysclean
make test-312-smallstack-forward-update-no-downgrade-ED448-SHA3
@make keysclean
make test-371-smallstack-forward-update-no-downgrade-NOSIGN
test-fastmath: clean
@ -722,17 +751,29 @@ test-fastmath: clean
@echo ==========
@echo
@echo
@make keysclean
make test-401-fastmath-forward-update-no-downgrade
@make keysclean
make test-411-fastmath-forward-update-no-downgrade-ECC
@make keysclean
make test-421-fastmath-forward-update-no-downgrade-SPI
@make keysclean
make test-451-fastmath-forward-update-no-downgrade-RSA
@make keysclean
true || make test-471-fastmath-forward-update-no-downgrade-RSA4096 #Not enough RAM
@make keysclean
make test-474-fastmath-forward-update-no-downgrade-ED448
@make keysclean
make test-481-fastmath-forward-update-no-downgrade-ED25519-SHA3
@make keysclean
make test-491-fastmath-forward-update-no-downgrade-ECC256-SHA3
@make keysclean
make test-501-fastmath-forward-update-no-downgrade-RSA2048-SHA3
@make keysclean
true || make test-511-fastmath-forward-update-no-downgrade-RSA4096-SHA3 #Not enough RAM
@make keysclean
make test-512-fastmath-forward-update-no-downgrade-ED448-SHA3
@make keysclean
make test-571-fastmath-forward-update-no-downgrade-NOSIGN
test-no-asm: clean
@ -740,17 +781,29 @@ test-no-asm: clean
@echo ==========
@echo
@echo
@make keysclean
make test-601-no-asm-forward-update-no-downgrade
@make keysclean
make test-611-no-asm-forward-update-no-downgrade-ECC
@make keysclean
make test-621-no-asm-forward-update-no-downgrade-SPI
@make keysclean
make test-651-no-asm-forward-update-no-downgrade-RSA
@make keysclean
make test-671-no-asm-forward-update-no-downgrade-RSA4096
@make keysclean
make test-674-no-asm-forward-update-no-downgrade-ED448
@make keysclean
make test-681-no-asm-forward-update-no-downgrade-ED25519-SHA3
@make keysclean
make test-691-no-asm-forward-update-no-downgrade-ECC256-SHA3
@make keysclean
make test-701-no-asm-forward-update-no-downgrade-RSA2048-SHA3
@make keysclean
make test-711-no-asm-forward-update-no-downgrade-RSA4096-SHA3
@make keysclean
make test-712-no-asm-forward-update-no-downgrade-ED448-SHA3
@make keysclean
make test-771-no-asm-forward-update-no-downgrade-NOSIGN
test-no-asm-smallstack: clean
@ -758,17 +811,29 @@ test-no-asm-smallstack: clean
@echo ==========
@echo
@echo
@make keysclean
make test-801-no-asm-smallstack-forward-update-no-downgrade
@make keysclean
make test-811-no-asm-smallstack-forward-update-no-downgrade-ECC
@make keysclean
make test-821-no-asm-smallstack-forward-update-no-downgrade-SPI
@make keysclean
make test-851-no-asm-smallstack-forward-update-no-downgrade-RSA
@make keysclean
make test-871-no-asm-smallstack-forward-update-no-downgrade-RSA4096
@make keysclean
make test-874-no-asm-smallstack-forward-update-no-downgrade-ED448
@make keysclean
make test-881-no-asm-smallstack-forward-update-no-downgrade-ED25519-SHA3
@make keysclean
make test-891-no-asm-smallstack-forward-update-no-downgrade-ECC256-SHA3
@make keysclean
make test-901-no-asm-smallstack-forward-update-no-downgrade-RSA2048-SHA3
@make keysclean
make test-911-no-asm-smallstack-forward-update-no-downgrade-RSA4096-SHA3
@make keysclean
make test-912-no-asm-smallstack-forward-update-no-downgrade-ED448-SHA3
@make keysclean
make test-971-no-asm-smallstack-forward-update-no-downgrade-NOSIGN
test-fastmath-smallstack: clean
@ -776,17 +841,29 @@ test-fastmath-smallstack: clean
@echo ==========
@echo
@echo
@make keysclean
make test-1001-fastmath-smallstack-forward-update-no-downgrade
@make keysclean
make test-1011-fastmath-smallstack-forward-update-no-downgrade-ECC
@make keysclean
make test-1021-fastmath-smallstack-forward-update-no-downgrade-SPI
@make keysclean
make test-1051-fastmath-smallstack-forward-update-no-downgrade-RSA
@make keysclean
make test-1071-fastmath-smallstack-forward-update-no-downgrade-RSA4096
@make keysclean
make test-1074-fastmath-smallstack-forward-update-no-downgrade-ED448
@make keysclean
make test-1081-fastmath-smallstack-forward-update-no-downgrade-ED25519-SHA3
@make keysclean
make test-1091-fastmath-smallstack-forward-update-no-downgrade-ECC256-SHA3
@make keysclean
make test-1101-fastmath-smallstack-forward-update-no-downgrade-RSA2048-SHA3
@make keysclean
make test-1111-fastmath-smallstack-forward-update-no-downgrade-RSA4096-SHA3
@make keysclean
make test-1112-fastmath-smallstack-forward-update-no-downgrade-ED448-SHA3
@make keysclean
make test-1171-fastmath-smallstack-forward-update-no-downgrade-NOSIGN