WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Remove external ext_lms, ext_xmss pq integrations.

pull/546/head
jordan 2025-01-15 16:59:37 -08:00 committed by Daniele Lacamera
parent 5fc2a5057e
commit e2db8d58c4
7 changed files with 12 additions and 182 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
.github/workflows/test-renode-nrf52.yml vendored
View File

@ -58,28 +58,14 @@ jobs:
- name: Renode Tests RSA4096
run: ./tools/renode/docker-test.sh "SIGN=RSA4096"
#
# LMS and ext_LMS tests
#
# LMS TEST
- name: Renode Tests LMS-8-5-5
run: ./tools/renode/docker-test.sh "SIGN=LMS LMS_LEVELS=2 LMS_HEIGHT=5 LMS_WINTERNITZ=8 WOLFBOOT_SMALL_STACK=0 IMAGE_SIGNATURE_SIZE=2644 IMAGE_HEADER_SIZE=5288"
# ext_LMS TEST
- name: Renode Tests ext_LMS-8-5-5
run: ./tools/renode/docker-test.sh "SIGN=ext_LMS LMS_LEVELS=2 LMS_HEIGHT=5 LMS_WINTERNITZ=8 WOLFBOOT_SMALL_STACK=0 IMAGE_SIGNATURE_SIZE=2644 IMAGE_HEADER_SIZE=5288"
#
# XMSS and ext_XMSS tests
#
# XMSS TEST
- name: Renode Tests XMSS-SHA2_10_256
run: ./tools/renode/docker-test.sh "SIGN=XMSS XMSS_PARAMS='XMSS-SHA2_10_256' WOLFBOOT_SMALL_STACK=0 IMAGE_SIGNATURE_SIZE=2500 IMAGE_HEADER_SIZE=5000"
# ext_XMSS TEST
- name: Renode Tests ext_XMSS-SHA2_10_256
run: ./tools/renode/docker-test.sh "SIGN=ext_XMSS XMSS_PARAMS='XMSS-SHA2_10_256' WOLFBOOT_SMALL_STACK=0 IMAGE_SIGNATURE_SIZE=2500 IMAGE_HEADER_SIZE=5000"
# ML-DSA TEST
- name: Renode Tests ML-DSA-44
run: ./tools/renode/docker-test.sh "SIGN=ML_DSA ML_DSA_LEVEL=2 WOLFBOOT_SMALL_STACK=0 IMAGE_SIGNATURE_SIZE=2420 IMAGE_HEADER_SIZE=4840"

59
docs/PQ.md
View File

@ -103,11 +103,9 @@ See these links for more info on stateful HBS support and wolfSSL/wolfCrypt:
### Supported PQ HBS Options
These four PQ signature options are supported:
These two hash-based PQ signature options are supported:
- LMS: uses wolfcrypt implementation from `wc_lms.c`, and `wc_lms_impl.c`.
- XMSS: uses wolfcrypt implementation from `wc_xmss.c`, and `wc_xmss_impl.c`.
- ext_LMS: uses external integration from `ext_lms.c`.
- ext_XMSS: uses external integration from `ext_xmss.c`.
The wolfcrypt implementations are more performant and are recommended.
The external integrations are experimental and for testing interoperability.
@ -281,58 +279,3 @@ Creating hybrid signature
The resulting image `image_v1_signed.bin` contains both signatures, and can be verified using a wolfBoot with hybrid signature support.
## Building the external PQ Integrations
### ext_LMS Support
The external LMS/HSS support in wolfCrypt requires the hash-sigs library ( https://github.com/cisco/hash-sigs ).
Use the following procedure to prepare hash-sigs for building with wolfBoot:
```
$ cd lib
$ mkdir hash-sigs
$ls
CMakeLists.txt hash-sigs wolfssl wolfTPM
$ cd hash-sigs
$ mkdir lib
$ git clone https://github.com/cisco/hash-sigs.git src
$ cd src
$ git checkout b0631b8891295bf2929e68761205337b7c031726
$ git apply ../../../tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch
```
Nothing more is needed, as wolfBoot will automatically produce the required
hash-sigs build artifacts.
Note: the hash-sigs project only builds static libraries:
- hss_verify.a: a single-threaded verify-only static lib.
- hss_lib.a: a single-threaded static lib.
- hss_lib_thread.a: a multi-threaded static lib.
The keytools utility links against `hss_lib.a`, as it needs full
keygen, signing, and verifying functionality. However wolfBoot
links directly with the subset of objects in the `hss_verify.a`
build rule, as it only requires verify functionality.
### ext_XMSS Support
The external XMSS/XMSS^MT support in wolfCrypt requires a patched version of the
xmss-reference library ( https://github.com/XMSS/xmss-reference.git ).
Use the following procedure to prepare xmss-reference for building with
wolfBoot:
```
$ cd lib
$ git clone https://github.com/XMSS/xmss-reference.git xmss
$ ls
CMakeLists.txt wolfPKCS11 wolfTPM wolfssl xmss
$ cd xmss
$ git checkout 171ccbd26f098542a67eb5d2b128281c80bd71a6
$ git apply ../../tools/xmss/0001-Patch-to-support-wolfSSL-xmss-reference-integration.patch
```
The patch creates an addendum readme, `patch_readme.md`, with further comments.
Nothing more is needed beyond the patch step, as wolfBoot will handle building
the xmss build artifacts it requires.

4
include/image.h
View File

@ -122,10 +122,10 @@ int wolfBot_get_dts_size(void *dts_addr);
defined (WOLFBOOT_SIGN_ECC521)
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_ecc
#endif
#if defined(WOLFBOOT_SIGN_LMS) || defined(WOLFBOOT_SIGN_ext_LMS)
#if defined(WOLFBOOT_SIGN_LMS)
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_lms
#endif
#if defined(WOLFBOOT_SIGN_XMSS ) || defined(WOLFBOOT_SIGN_ext_XMSS)
#if defined(WOLFBOOT_SIGN_XMSS )
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_xmss
#endif
#ifdef WOLFBOOT_SIGN_ML_DSA

76
options.mk
View File

@ -338,7 +338,7 @@ ifneq ($(findstring RSA4096,$(SIGN)),)
endif
endif
ifneq (,$(filter $(SIGN), LMS ext_LMS))
ifeq ($(SIGN),LMS)
# For LMS the signature size is a function of the LMS parameters.
# All five of these parms must be set in the LMS .config file:
# LMS_LEVELS, LMS_HEIGHT, LMS_WINTERNITZ, IMAGE_SIGNATURE_SIZE,
@ -377,38 +377,7 @@ ifeq ($(SIGN),LMS)
endif
endif
ifeq ($(SIGN),ext_LMS)
LMSDIR = lib/hash-sigs
KEYGEN_OPTIONS+=--lms
SIGN_OPTIONS+=--lms
CFLAGS+=-D"LMS_IMAGE_SIGNATURE_SIZE"=$(IMAGE_SIGNATURE_SIZE)
WOLFCRYPT_OBJS+= \
./$(LMSDIR)/src/hss_verify.o \
./$(LMSDIR)/src/hss_verify_inc.o \
./$(LMSDIR)/src/hss_common.o \
./$(LMSDIR)/src/hss_thread_single.o \
./$(LMSDIR)/src/hss_zeroize.o \
./$(LMSDIR)/src/lm_common.o \
./$(LMSDIR)/src/lm_ots_common.o \
./$(LMSDIR)/src/lm_ots_verify.o \
./$(LMSDIR)/src/lm_verify.o \
./$(LMSDIR)/src/endian.o \
./$(LMSDIR)/src/hash.o \
./$(LMSDIR)/src/sha256.o \
./lib/wolfssl/wolfcrypt/src/ext_lms.o
CFLAGS+=-D"WOLFBOOT_SIGN_LMS" -D"WOLFSSL_HAVE_LMS" -D"HAVE_LIBLMS" \
-D"LMS_LEVELS=$(LMS_LEVELS)" -D"LMS_HEIGHT=$(LMS_HEIGHT)" \
-D"LMS_WINTERNITZ=$(LMS_WINTERNITZ)" -I$(LMSDIR)/src \
-D"IMAGE_SIGNATURE_SIZE"=$(IMAGE_SIGNATURE_SIZE) \
-D"WOLFSSL_LMS_VERIFY_ONLY"
ifeq ($(WOLFBOOT_SMALL_STACK),1)
$(error WOLFBOOT_SMALL_STACK with LMS not supported)
else
STACK_USAGE=1024
endif
endif
ifneq (,$(filter $(SIGN), XMSS ext_XMSS))
ifeq ($(SIGN),XMSS)
ifndef XMSS_PARAMS
$(error XMSS_PARAMS not set)
endif
@ -436,39 +405,6 @@ ifeq ($(SIGN),XMSS)
endif
endif
ifeq ($(SIGN),ext_XMSS)
# Use ext_xmss implementation.
XMSSDIR = lib/xmss
KEYGEN_OPTIONS+=--xmss
SIGN_OPTIONS+=--xmss
CFLAGS+=-D"XMSS_IMAGE_SIGNATURE_SIZE"=$(IMAGE_SIGNATURE_SIZE)
WOLFCRYPT_OBJS+= \
./$(XMSSDIR)/params.o \
./$(XMSSDIR)/thash.o \
./$(XMSSDIR)/hash_address.o \
./$(XMSSDIR)/wots.o \
./$(XMSSDIR)/xmss.o \
./$(XMSSDIR)/xmss_core_fast.o \
./$(XMSSDIR)/xmss_commons.o \
./$(XMSSDIR)/utils.o \
./lib/wolfssl/wolfcrypt/src/ext_xmss.o
CFLAGS+=-D"WOLFBOOT_SIGN_XMSS" -D"WOLFSSL_HAVE_XMSS" -D"HAVE_LIBXMSS" \
-DWOLFBOOT_XMSS_PARAMS=\"$(XMSS_PARAMS)\" -I$(XMSSDIR) \
-D"IMAGE_SIGNATURE_SIZE"=$(IMAGE_SIGNATURE_SIZE) \
-D"WOLFSSL_XMSS_VERIFY_ONLY" -D"XMSS_VERIFY_ONLY"
ifeq ($(WOLFBOOT_SMALL_STACK),1)
$(error WOLFBOOT_SMALL_STACK with XMSS not supported)
else
STACK_USAGE=2712
endif
endif
# Only needed if using 3rd party integration. This can be
# removed if ext_lms and ext_xmss are deprecated.
ifneq (,$(filter $(SIGN), ext_LMS ext_XMSS))
CFLAGS +=-DWOLFSSL_EXPERIMENTAL_SETTINGS
endif
ifeq ($(SIGN),ML_DSA)
# Use wolfcrypt ML-DSA dilithium implementation.
KEYGEN_OPTIONS+=--ml_dsa
@ -901,14 +837,6 @@ ifeq ($(SIGN_ALG),)
SIGN_ALG=$(SIGN)
endif
ifeq ($(SIGN_ALG),ext_XMSS)
SIGN_ALG=XMSS
endif
ifeq ($(SIGN_ALG),ext_LMS)
SIGN_ALG=LMS
endif
ifneq ($(KEYVAULT_OBJ_SIZE),)
CFLAGS+=-DKEYVAULT_OBJ_SIZE=$(KEYVAULT_OBJ_SIZE)
endif

28
tools/scripts/renode-test-update.sh
View File

@ -20,34 +20,6 @@ quit_renode() {
rm -f $RENODE_UART
# external LMS test
if (echo $TEST_OPTIONS | grep "ext_LMS" &>/dev/null); then
# Need git.
apt install -y git
# Extra steps needed for external LMS support.
# Need to clone the hash-sigs repo, and patch it for wolfBoot build.
mkdir -p lib/hash-sigs/lib || exit 2
git clone https://github.com/cisco/hash-sigs.git lib/hash-sigs/src || exit 2
cd lib/hash-sigs/src && git checkout b0631b8891295bf2929e68761205337b7c031726 && \
git apply ../../../tools/lms/0001-Patch-to-support-wolfBoot-LMS-build.patch &&\
cd ../../.. || exit 2
fi
# external XMSS test
if (echo $TEST_OPTIONS | grep "ext_XMSS" &>/dev/null); then
# Need git.
apt install -y git
# Extra steps needed for external XMSS support.
# Need to clone the xmss-reference repo, and patch it for wolfBoot build.
cd lib || exit 2
git clone https://github.com/XMSS/xmss-reference.git xmss || exit 2
cd xmss && git checkout 171ccbd26f098542a67eb5d2b128281c80bd71a6 && \
git apply ../../tools/xmss/0001-Patch-to-support-wolfSSL-xmss-reference-integration.patch &&\
cd ../../ || exit 2
fi
make keysclean
make keytools
make -C tools/test-expect-version

9
tools/test-renode.mk
View File

@ -86,11 +86,12 @@ ifeq ($(SIGN),RSA4096)
SIGN_ARGS+= --rsa4096
endif
ifneq (,$(filter $(SIGN), LMS ext_LMS))
SIGN_ARGS+= --lms
ifeq ($(SIGN),LMS)
SIGN_ARGS+= --lms
endif
ifneq (,$(filter $(SIGN), XMSS ext_XMSS))
SIGN_ARGS+= --xmss
ifeq ($(SIGN),XMSS)
SIGN_ARGS+= --xmss
endif
ifeq ($(SIGN),ML_DSA)

4
tools/test.mk
View File

@ -43,10 +43,10 @@ endif
ifeq ($(SIGN),RSA4096)
SIGN_ARGS+= --rsa4096
endif
ifneq (,$(filter $(SIGN), LMS ext_LMS))
ifeq ($(SIGN),LMS)
SIGN_ARGS+= --lms
endif
ifneq (,$(filter $(SIGN), XMSS ext_XMSS))
ifeq ($(SIGN),XMSS)
SIGN_ARGS+= --xmss
endif
ifeq ($(SIGN),ML_DSA)