WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity
wolfBoot/tools/keytools
History
Daniele Lacamera f9957da523 F-8003: separate decoded key objects for hybrid signers 
The sign tool kept a single file-static struct for the decoded private
key, so a hybrid run that picks two algorithms sharing one member (e.g.
ECC521 primary + ECC256 secondary, or RSA2048 + RSAPSS2048) had the
secondary load_key() re-init and overwrite the still-live primary key
before either signature was produced. The primary signature was then
made with the secondary key, and the final cleanup in main() dispatched
only on CMD.sign, so the secondary key never reached its algorithm
specific zeroizing free.

Give the primary and the secondary signer their own storage, select it
with key_obj(secondary) in load_key()/load_key_ecc()/load_key_rsa()/
sign_digest()/set_signature_sizes(), and free both keys at exit through
the new free_key() helper.
 		2026-08-11 09:25:54 +02:00
..
otp F-6408: zeroize UDS from OTP keystore generator's heap and stack buffers 2026-07-02 14:56:48 +02:00
Makefile Clean up build flag usage, use trng healthtest in test-app 2026-07-31 14:33:56 +02:00
README.md
…
keygen.c Add aarch64_efi target: wolfBoot as an AArch64 UEFI application 2026-08-10 21:03:50 +02:00
keygen.py
…
sign.c F-8003: separate decoded key objects for hybrid signers 2026-08-11 09:25:54 +02:00
sign.py F-5352: emit 4-byte delta size TLVs from Python signer 2026-06-09 15:50:48 +02:00
user_settings.h Continue the ML-DSA renaming 2026-05-19 11:21:20 -07:00
wolfBootKeyTools.sln
…
wolfBootKeygenTool.vcxproj Update wolfssl submodule to latest master 2026-05-18 23:02:54 -07:00
wolfBootSignTool.vcxproj Update wolfssl submodule to latest master 2026-05-18 23:02:54 -07:00

README.md

Key Tools for signing and key generation

Sign

See code file ./tools/keytools/sign.c and documentation in docs/Signing.md.

KeyGen and KeyStore

See code file ./tools/keytools/keygen.c and documentation docs/keystore.md.

Flash OTP Keystore Generation, Primer, Startup

See documentation docs/flash-OTP.md.

Keystore Generation

Pack public keys into a single binary (otp.bin) formatted the way wolfBoot expects for provisioning the device’s OTP/NVM keystore. No signing, no encryption—just a correctly laid-out image with a header plus fixed-size "slots" for each key.

See code file ./tools/keytools/otp/otp-keystore-gen.c

Flash OTP Primer

See code file ./tools/keytools/otp/otp-keystore-primer.c

Flash OTP Startup

See code file ./tools/keytools/otp/startup.c

Quick Start (Linux)

make wolfboot_signing_private_key.der SIGN=ED25519

# or

./tools/keytools/keygen --ed25519 -g wolfboot_signing_private_key.der

Note the above example is a basic case where a single key is generated. The tool supports multiple keys both with [-g privkey] and [-i pubkey] parameters.

See the local docs docs/keystore.md and the wolfBoot Keystore section of the manual for additional details.

Debugging and Development

DEBUG_SIGNTOOL

Enables additional diagnostic messages that may be useful during development and initial bring-up.

WOLFBOOT_SHOW_INCLUDE

Enables compile-time verbosity to indicate which user_settings.h file is being used.