b896caeea0
The keytools read and write private keys through fully buffered stdio streams: for key files smaller than the stdio buffer, libc copies the raw key bytes into its internal FILE buffer, and fclose() frees that buffer without scrubbing it, so a copy of every key survives the explicit zero_and_free()/wc_ForceZero() wipes. Open every secret-material stream unbuffered with setvbuf(f, NULL, _IONBF, 0) right after fopen(): - sign.c load_key(): the private key file. Also close the stream on the short-read failure path, which previously leaked it. - sign.c make_header_ex(): the firmware encryption key/IV file. - keygen.c: the five private-key write sites (RSA, ECC, Ed25519, Ed448, ML-DSA). - lms_common.h / xmss_common.h: the LMS/XMSS private-state write, verify-read and read callbacks. Public-key export streams are left buffered: not secret. Host-side hardening only: whoever can read the tool heap can read the key file too. |
||
|---|---|---|
| .. | ||
| otp | ||
| Makefile | ||
| README.md | ||
| keygen.c | ||
| sign.c | ||
| user_settings.h | ||
| wolfBootKeyTools.sln | ||
| wolfBootKeygenTool.vcxproj | ||
| wolfBootSignTool.vcxproj | ||
README.md
Key Tools for signing and key generation
Sign
See code file ./tools/keytools/sign.c and documentation in docs/Signing.md.
KeyGen and KeyStore
See code file ./tools/keytools/keygen.c and documentation docs/keystore.md.
Flash OTP Keystore Generation, Primer, Startup
See documentation docs/flash-OTP.md.
Keystore Generation
Pack public keys into a single binary (otp.bin) formatted the way wolfBoot expects for
provisioning the device’s OTP/NVM keystore. No signing, no encryption—just a correctly laid-out image
with a header plus fixed-size "slots" for each key.
See code file ./tools/keytools/otp/otp-keystore-gen.c
Flash OTP Primer
See code file ./tools/keytools/otp/otp-keystore-primer.c
Flash OTP Startup
See code file ./tools/keytools/otp/startup.c
Quick Start (Linux)
make wolfboot_signing_private_key.der SIGN=ED25519
# or
./tools/keytools/keygen --ed25519 -g wolfboot_signing_private_key.der
Note the above example is a basic case where a single key is generated.
The tool supports multiple keys both with [-g privkey] and [-i pubkey] parameters.
See the local docs docs/keystore.md and the wolfBoot Keystore section of the manual for additional details.
Debugging and Development
DEBUG_SIGNTOOL
Enables additional diagnostic messages that may be useful during development and initial bring-up.
WOLFBOOT_SHOW_INCLUDE
Enables compile-time verbosity to indicate which user_settings.h file is being used.