diff --git a/docs/keystore.md b/docs/keystore.md index b27761b0..347bbd6d 100644 --- a/docs/keystore.md +++ b/docs/keystore.md @@ -152,7 +152,7 @@ The API consists of a few functions described below. Returns the number of slots in the keystore. At least one slot should be populated if you want to authenticate your firmware today. -The interface assumes that the slots are numbered sequencially, from zero to +The interface assumes that the slots are numbered sequentially, from zero to `keystore_num_pubkeys() - 1`. Accessing those slots through this API should always return a valid public key. diff --git a/include/wolfboot/wolfboot.h b/include/wolfboot/wolfboot.h index 48d364c1..1ee17628 100644 --- a/include/wolfboot/wolfboot.h +++ b/include/wolfboot/wolfboot.h @@ -106,6 +106,7 @@ #define KEYSTORE_PUBKEY_SIZE_ED448 57 #define KEYSTORE_PUBKEY_SIZE_ECC256 64 #define KEYSTORE_PUBKEY_SIZE_ECC384 96 + #define KEYSTORE_PUBKEY_SIZE_ECC521 132 #define KEYSTORE_PUBKEY_SIZE_RSA2048 320 #define KEYSTORE_PUBKEY_SIZE_RSA3072 448 #define KEYSTORE_PUBKEY_SIZE_RSA4096 576 diff --git a/options.mk b/options.mk index ced93d86..aae9a12e 100644 --- a/options.mk +++ b/options.mk @@ -109,7 +109,11 @@ ifeq ($(SIGN),ED25519) ./lib/wolfssl/wolfcrypt/src/wc_port.o \ ./lib/wolfssl/wolfcrypt/src/fe_low_mem.o CFLAGS+=-D"WOLFBOOT_SIGN_ED25519" - STACK_USAGE?=1180 + ifeq ($(WOLFTPM),1) + STACK_USAGE=6680 + else + STACK_USAGE?=1180 + endif ifeq ($(shell test $(IMAGE_HEADER_SIZE) -lt 256; echo $$?),0) IMAGE_HEADER_SIZE=256 endif @@ -126,12 +130,15 @@ ifeq ($(SIGN),ED448) ./lib/wolfssl/wolfcrypt/src/wolfmath.o \ ./lib/wolfssl/wolfcrypt/src/wc_port.o \ ./lib/wolfssl/wolfcrypt/src/fe_low_mem.o - ifeq ($(WOLFBOOT_SMALL_STACK),1) + ifeq ($(WOLFTPM),1) + STACK_USAGE=6680 + else ifeq ($(WOLFBOOT_SMALL_STACK),1) STACK_USAGE?=1024 else STACK_USAGE?=4376 endif + ifneq ($(HASH),SHA3) WOLFCRYPT_OBJS+=./lib/wolfssl/wolfcrypt/src/sha3.o endif diff --git a/src/image.c b/src/image.c index 6f64acd3..0b48c2e6 100644 --- a/src/image.c +++ b/src/image.c @@ -98,18 +98,17 @@ static void wolfBoot_verify_signature(uint8_t key_slot, #include #ifdef WOLFBOOT_SIGN_ECC256 - #define ECC_KEYSTORE_PUBKEY_SIZE 32 #define ECC_KEY_TYPE ECC_SECP256R1 #endif #ifdef WOLFBOOT_SIGN_ECC384 - #define ECC_KEYSTORE_PUBKEY_SIZE 48 #define ECC_KEY_TYPE ECC_SECP384R1 #endif #ifdef WOLFBOOT_SIGN_ECC521 - #define ECC_KEYSTORE_PUBKEY_SIZE 66 #define ECC_KEY_TYPE ECC_SECP521R1 #endif +#define KEYSTORE_ECC_POINT_SIZE (KEYSTORE_PUBKEY_SIZE / 2) + static void wolfBoot_verify_signature(uint8_t key_slot, struct wolfBoot_image *img, uint8_t *sig) { @@ -126,8 +125,8 @@ static void wolfBoot_verify_signature(uint8_t key_slot, /* Load public key into TPM */ memset(&tpmKey, 0, sizeof(tpmKey)); ret = wolfTPM2_LoadEccPublicKey(&wolftpm_dev, &tpmKey, TPM_ECC_NIST_P256, - pubkey, ECC_KEYSTORE_PUBKEY_SIZE, pubkey + ECC_KEYSTORE_PUBKEY_SIZE, - ECC_KEYSTORE_PUBKEY_SIZE); + pubkey, KEYSTORE_ECC_POINT_SIZE, pubkey + KEYSTORE_ECC_POINT_SIZE, + KEYSTORE_ECC_POINT_SIZE); if (ret < 0) return; ret = wolfTPM2_VerifyHashScheme(&wolftpm_dev, &tpmKey, sig, @@ -161,7 +160,7 @@ static void wolfBoot_verify_signature(uint8_t key_slot, /* Import public key */ ret = wc_ecc_import_unsigned(&ecc, pubkey, - (byte*)(pubkey + ECC_KEYSTORE_PUBKEY_SIZE), NULL, ECC_KEY_TYPE); + (byte*)(pubkey + KEYSTORE_ECC_POINT_SIZE), NULL, ECC_KEY_TYPE); if ((ret < 0) || ecc.type != ECC_PUBLICKEY) { /* Failed to import ecc key */ return; @@ -170,9 +169,9 @@ static void wolfBoot_verify_signature(uint8_t key_slot, /* Import signature into r,s */ mp_init(&r); mp_init(&s); - mp_read_unsigned_bin(&r, sig, ECC_KEYSTORE_PUBKEY_SIZE); - mp_read_unsigned_bin(&s, sig + ECC_KEYSTORE_PUBKEY_SIZE, - ECC_KEYSTORE_PUBKEY_SIZE); + mp_read_unsigned_bin(&r, sig, KEYSTORE_ECC_POINT_SIZE); + mp_read_unsigned_bin(&s, sig + KEYSTORE_ECC_POINT_SIZE, + KEYSTORE_ECC_POINT_SIZE); VERIFY_FN(img, &verify_res, wc_ecc_verify_hash_ex, &r, &s, img->sha_hash, WOLFBOOT_SHA_DIGEST_SIZE, &verify_res, &ecc); #endif /* WOLFBOOT_TPM */ diff --git a/tools/keytools/keygen.c b/tools/keytools/keygen.c index ceacba6b..76c76266 100644 --- a/tools/keytools/keygen.c +++ b/tools/keytools/keygen.c @@ -82,14 +82,18 @@ static FILE *fpub, *fpub_image; static int force = 0; static WC_RNG rng; - + +#ifndef KEYSLOT_MAX_PUBKEY_SIZE + #define KEYSLOT_MAX_PUBKEY_SIZE 2048 +#endif + struct keystore_slot { uint32_t slot_id; uint32_t key_type; uint32_t part_id_mask; uint32_t pubkey_size; - uint8_t pubkey[2048]; - }; + uint8_t pubkey[KEYSLOT_MAX_PUBKEY_SIZE]; +}; const char pubkeyfile[]= "src/keystore.c"; const char pubkeyimg[] = "keystore.der"; @@ -171,7 +175,7 @@ static void fwritekey(uint8_t *key, int len, FILE *f) } } -const char KType[9][20] = { +const char KType[][17] = { "AUTH_KEY_NONE", "AUTH_KEY_ED25519", "AUTH_KEY_ECC256", @@ -183,7 +187,7 @@ const char KType[9][20] = { "AUTH_KEY_RSA3072" }; -const char KSize[9][32] = { +const char KSize[][29] = { "KEYSTORE_PUBKEY_SIZE_NONE", "KEYSTORE_PUBKEY_SIZE_ED25519", "KEYSTORE_PUBKEY_SIZE_ECC256", @@ -195,7 +199,7 @@ const char KSize[9][32] = { "KEYSTORE_PUBKEY_SIZE_RSA3072" }; -const char KName[9][8] = { +const char KName[][8] = { "NONE", "ED25519", "ECC256", @@ -482,7 +486,7 @@ static void key_generate(uint32_t ktype, const char *kfilename) static void key_import(uint32_t ktype, const char *fname) { - uint8_t buf[4096]; + uint8_t buf[KEYSLOT_MAX_PUBKEY_SIZE]; FILE *f; int r; f = fopen(fname, "rb"); @@ -490,7 +494,7 @@ static void key_import(uint32_t ktype, const char *fname) fprintf(stderr, "Fatal error: could not open file %s to import public key\n", fname); exit(6); } - r = fread(buf, 4096, 1, f); + r = fread(buf, sizeof(buf), 1, f); keystore_add(ktype, buf, r, fname); } @@ -541,7 +545,8 @@ int main(int argc, char** argv) i++; n_pubkeys++; continue; - } else if (strcmp(argv[i], "-i") == 0) { + } + else if (strcmp(argv[i], "-i") == 0) { i++; n_pubkeys++; continue; @@ -572,7 +577,8 @@ int main(int argc, char** argv) printf("Imp %s\n", argv[i + 1]); key_import(keytype, argv[i + 1]); i++; - } else if (strcmp(argv[i], "-g") == 0) { + } + else if (strcmp(argv[i], "-g") == 0) { printf("Gen %s\n", argv[i + 1]); key_generate(keytype, argv[i + 1]); i++; diff --git a/tools/test-renode.mk b/tools/test-renode.mk index 270868c6..cb06a0d2 100644 --- a/tools/test-renode.mk +++ b/tools/test-renode.mk @@ -251,26 +251,26 @@ renode-factory-rsa4096: FORCE make renode-factory SIGN=RSA4096 renode-factory-all: FORCE - ${Q}make clean + ${Q}make keysclean ${Q}make renode-factory-ed25519 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-factory-ed448 RENODE_PORT=55156 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-factory-ecc256 RENODE_PORT=55157 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-factory-ecc384 RENODE_PORT=55158 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-factory-rsa2048 RENODE_PORT=55160 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-factory-rsa3072 RENODE_PORT=55161 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-factory-rsa4096 RENODE_PORT=55162 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-factory SIGN=NONE RENODE_PORT=55163 ${Q}echo All tests in $@ OK! renode-update-ed25519: FORCE - make renode-update SIGN=ED448 + make renode-update SIGN=ED25519 renode-update-ed448: FORCE make renode-update SIGN=ED448 @@ -330,59 +330,59 @@ renode-boot-time-all: FORCE tools/scripts/renode-test-all.sh 2>/dev/null |grep "BOOT TIME" renode-update-all: FORCE - ${Q}make clean + ${Q}make keysclean ${Q}make renode-update-ed25519 RENODE_PORT=55155 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-update-ed448 RENODE_PORT=55156 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-update-ecc256 RENODE_PORT=55157 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-update-ecc384 RENODE_PORT=55158 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-update-rsa2048 RENODE_PORT=55160 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-update-rsa3072 RENODE_PORT=55161 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-update-rsa4096 RENODE_PORT=55162 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-update SIGN=NONE RENODE_PORT=55163 ${Q}echo All tests in $@ OK! renode-no-downgrade-all: FORCE - ${Q}make clean + ${Q}make keysclean ${Q}make renode-no-downgrade-ed25519 RENODE_PORT=55155 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-no-downgrade-ed448 RENODE_PORT=55156 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-no-downgrade-ecc256 RENODE_PORT=55157 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-no-downgrade-ecc384 RENODE_PORT=55158 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-no-downgrade-rsa2048 RENODE_PORT=55160 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-no-downgrade-rsa3072 RENODE_PORT=55161 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-no-downgrade-rsa4096 RENODE_PORT=55162 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-no-downgrade SIGN=NONE RENODE_PORT=55163 ${Q}echo All tests in $@ OK! renode-corrupted-all: FORCE - ${Q}make clean + ${Q}make keysclean ${Q}make renode-corrupted-ed25519 RENODE_PORT=55155 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-corrupted-ed448 RENODE_PORT=55156 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-corrupted-ecc256 RENODE_PORT=55157 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-corrupted-ecc384 RENODE_PORT=55158 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-corrupted-rsa2048 RENODE_PORT=55160 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-corrupted-rsa3072 RENODE_PORT=55161 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-corrupted-rsa4096 RENODE_PORT=55162 - ${Q}make clean + ${Q}make keysclean ${Q}make renode-corrupted SIGN=NONE RENODE_PORT=55163 ${Q}echo All tests in $@ OK! diff --git a/tools/test.mk b/tools/test.mk index 184bb1ea..41fffdc9 100644 --- a/tools/test.mk +++ b/tools/test.mk @@ -654,20 +654,29 @@ test-base: clean @echo ========== @echo @echo + @make keysclean make test-01-forward-update-no-downgrade make test-02-forward-update-allow-downgrade test-03-rollback + @make keysclean make test-11-forward-update-no-downgrade-ECC test-13-rollback-ECC + @make keysclean make test-21-forward-update-no-downgrade-SPI test-23-rollback-SPI make test-34-forward-self-update + @make keysclean make test-44-forward-self-update-ECC + @make keysclean make test-51-forward-update-no-downgrade-RSA make test-53-rollback-RSA + @make keysclean make test-61-forward-update-no-downgrade-TPM make test-63-rollback-TPM + @make keysclean make test-71-forward-update-no-downgrade-RSA-4096 make test-73-rollback-RSA-4096 + @make keysclean make test-74-forward-update-no-downgrade-ED448 make test-75-rollback-ED448 + @make keysclean make test-76-forward-update-no-downgrade-RSA3072 make test-77-rollback-RSA3072 @@ -676,11 +685,17 @@ test-sha3: clean @echo ========== @echo @echo + @make keysclean make test-81-forward-update-no-downgrade-ED25519-SHA3 + @make keysclean make test-91-forward-update-no-downgrade-ECC256-SHA3 + @make keysclean make test-101-forward-update-no-downgrade-RSA2048-SHA3 + @make keysclean make test-111-forward-update-no-downgrade-RSA4096-SHA3 + @make keysclean make test-112-forward-update-no-downgrade-ED448-SHA3 + @make keysclean make test-113-forward-update-no-downgrade-RSA3072-SHA3 test-tpm: clean @@ -688,6 +703,7 @@ test-tpm: clean @echo ========== @echo @echo + @make keysclean make test-161-forward-update-no-downgrade-TPM-RSA make test-163-rollback-TPM-RSA @@ -696,6 +712,7 @@ test-nosign: clean @echo ========== @echo @echo + @make keysclean make test-171-forward-update-no-downgrade-NOSIGN make test-173-rollback-NOSIGN @@ -704,17 +721,29 @@ test-smallstack: clean @echo ========== @echo @echo + @make keysclean make test-201-smallstack-forward-update-no-downgrade + @make keysclean make test-211-smallstack-forward-update-no-downgrade-ECC + @make keysclean make test-221-smallstack-forward-update-no-downgrade-SPI + @make keysclean make test-251-smallstack-forward-update-no-downgrade-RSA + @make keysclean make test-271-smallstack-forward-update-no-downgrade-RSA4096 + @make keysclean make test-274-smallstack-forward-update-no-downgrade-ED448 + @make keysclean make test-281-smallstack-forward-update-no-downgrade-ED25519-SHA3 + @make keysclean make test-291-smallstack-forward-update-no-downgrade-ECC256-SHA3 + @make keysclean make test-301-smallstack-forward-update-no-downgrade-RSA2048-SHA3 + @make keysclean make test-311-smallstack-forward-update-no-downgrade-RSA4096-SHA3 + @make keysclean make test-312-smallstack-forward-update-no-downgrade-ED448-SHA3 + @make keysclean make test-371-smallstack-forward-update-no-downgrade-NOSIGN test-fastmath: clean @@ -722,17 +751,29 @@ test-fastmath: clean @echo ========== @echo @echo + @make keysclean make test-401-fastmath-forward-update-no-downgrade + @make keysclean make test-411-fastmath-forward-update-no-downgrade-ECC + @make keysclean make test-421-fastmath-forward-update-no-downgrade-SPI + @make keysclean make test-451-fastmath-forward-update-no-downgrade-RSA + @make keysclean true || make test-471-fastmath-forward-update-no-downgrade-RSA4096 #Not enough RAM + @make keysclean make test-474-fastmath-forward-update-no-downgrade-ED448 + @make keysclean make test-481-fastmath-forward-update-no-downgrade-ED25519-SHA3 + @make keysclean make test-491-fastmath-forward-update-no-downgrade-ECC256-SHA3 + @make keysclean make test-501-fastmath-forward-update-no-downgrade-RSA2048-SHA3 + @make keysclean true || make test-511-fastmath-forward-update-no-downgrade-RSA4096-SHA3 #Not enough RAM + @make keysclean make test-512-fastmath-forward-update-no-downgrade-ED448-SHA3 + @make keysclean make test-571-fastmath-forward-update-no-downgrade-NOSIGN test-no-asm: clean @@ -740,17 +781,29 @@ test-no-asm: clean @echo ========== @echo @echo + @make keysclean make test-601-no-asm-forward-update-no-downgrade + @make keysclean make test-611-no-asm-forward-update-no-downgrade-ECC + @make keysclean make test-621-no-asm-forward-update-no-downgrade-SPI + @make keysclean make test-651-no-asm-forward-update-no-downgrade-RSA + @make keysclean make test-671-no-asm-forward-update-no-downgrade-RSA4096 + @make keysclean make test-674-no-asm-forward-update-no-downgrade-ED448 + @make keysclean make test-681-no-asm-forward-update-no-downgrade-ED25519-SHA3 + @make keysclean make test-691-no-asm-forward-update-no-downgrade-ECC256-SHA3 + @make keysclean make test-701-no-asm-forward-update-no-downgrade-RSA2048-SHA3 + @make keysclean make test-711-no-asm-forward-update-no-downgrade-RSA4096-SHA3 + @make keysclean make test-712-no-asm-forward-update-no-downgrade-ED448-SHA3 + @make keysclean make test-771-no-asm-forward-update-no-downgrade-NOSIGN test-no-asm-smallstack: clean @@ -758,17 +811,29 @@ test-no-asm-smallstack: clean @echo ========== @echo @echo + @make keysclean make test-801-no-asm-smallstack-forward-update-no-downgrade + @make keysclean make test-811-no-asm-smallstack-forward-update-no-downgrade-ECC + @make keysclean make test-821-no-asm-smallstack-forward-update-no-downgrade-SPI + @make keysclean make test-851-no-asm-smallstack-forward-update-no-downgrade-RSA + @make keysclean make test-871-no-asm-smallstack-forward-update-no-downgrade-RSA4096 + @make keysclean make test-874-no-asm-smallstack-forward-update-no-downgrade-ED448 + @make keysclean make test-881-no-asm-smallstack-forward-update-no-downgrade-ED25519-SHA3 + @make keysclean make test-891-no-asm-smallstack-forward-update-no-downgrade-ECC256-SHA3 + @make keysclean make test-901-no-asm-smallstack-forward-update-no-downgrade-RSA2048-SHA3 + @make keysclean make test-911-no-asm-smallstack-forward-update-no-downgrade-RSA4096-SHA3 + @make keysclean make test-912-no-asm-smallstack-forward-update-no-downgrade-ED448-SHA3 + @make keysclean make test-971-no-asm-smallstack-forward-update-no-downgrade-NOSIGN test-fastmath-smallstack: clean @@ -776,17 +841,29 @@ test-fastmath-smallstack: clean @echo ========== @echo @echo + @make keysclean make test-1001-fastmath-smallstack-forward-update-no-downgrade + @make keysclean make test-1011-fastmath-smallstack-forward-update-no-downgrade-ECC + @make keysclean make test-1021-fastmath-smallstack-forward-update-no-downgrade-SPI + @make keysclean make test-1051-fastmath-smallstack-forward-update-no-downgrade-RSA + @make keysclean make test-1071-fastmath-smallstack-forward-update-no-downgrade-RSA4096 + @make keysclean make test-1074-fastmath-smallstack-forward-update-no-downgrade-ED448 + @make keysclean make test-1081-fastmath-smallstack-forward-update-no-downgrade-ED25519-SHA3 + @make keysclean make test-1091-fastmath-smallstack-forward-update-no-downgrade-ECC256-SHA3 + @make keysclean make test-1101-fastmath-smallstack-forward-update-no-downgrade-RSA2048-SHA3 + @make keysclean make test-1111-fastmath-smallstack-forward-update-no-downgrade-RSA4096-SHA3 + @make keysclean make test-1112-fastmath-smallstack-forward-update-no-downgrade-ED448-SHA3 + @make keysclean make test-1171-fastmath-smallstack-forward-update-no-downgrade-NOSIGN