WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity
wolfBoot/tools/keytools
History
Daniele Lacamera 1690522078 F-3970: serialise custom TLV integer values through header_store_u64_le 
The --custom-tlv TAG LEN VAL path in make_header_ex() passed
&CMD.custom_tlv[i].val (a raw uint64_t pointer) directly to
header_append_tag(), which does a memcpy.  On big-endian build hosts the
first LEN bytes of the uint64_t are the high bytes, producing the wrong
LE encoding (e.g. 4-byte value 0x12345678 encodes as 00 00 00 00).  The
fix serialises through header_store_u64_le() before calling
header_append_tag(), matching the pattern already used by
header_append_tag_u16/u32/u64 for all system TLVs.

Add unit-sign-custom-tlv-le.py to verify the LE byte encoding of 4-byte
and 8-byte custom TLV values in the signed image header.
 		2026-06-11 17:53:25 +02:00
..
otp Preparing release v2.8.0 + update copyright 2026-04-16 13:11:56 +02:00
Makefile Update wolfssl submodule to latest master 2026-05-18 23:02:54 -07:00
README.md Minor docs update, code review changes, script modifications. 2025-11-24 13:04:06 -08:00
keygen.c F-4419: zeroize LmsKey on all error paths in keygen_lms 2026-06-10 21:01:17 +02:00
keygen.py Preparing release v2.8.0 + update copyright 2026-04-16 13:11:56 +02:00
sign.c F-3970: serialise custom TLV integer values through header_store_u64_le 2026-06-11 17:53:25 +02:00
sign.py F-5352: emit 4-byte delta size TLVs from Python signer 2026-06-09 15:50:48 +02:00
user_settings.h Continue the ML-DSA renaming 2026-05-19 11:21:20 -07:00
wolfBootKeyTools.sln Added keygen C tool + vcproj for windows 2020-03-30 14:12:39 +02:00
wolfBootKeygenTool.vcxproj Update wolfssl submodule to latest master 2026-05-18 23:02:54 -07:00
wolfBootSignTool.vcxproj Update wolfssl submodule to latest master 2026-05-18 23:02:54 -07:00

README.md

Key Tools for signing and key generation

Sign

See code file ./tools/keytools/sign.c and documentation in docs/Signing.md.

KeyGen and KeyStore

See code file ./tools/keytools/keygen.c and documentation docs/keystore.md.

Flash OTP Keystore Generation, Primer, Startup

See documentation docs/flash-OTP.md.

Keystore Generation

Pack public keys into a single binary (otp.bin) formatted the way wolfBoot expects for provisioning the device’s OTP/NVM keystore. No signing, no encryption—just a correctly laid-out image with a header plus fixed-size "slots" for each key.

See code file ./tools/keytools/otp/otp-keystore-gen.c

Flash OTP Primer

See code file ./tools/keytools/otp/otp-keystore-primer.c

Flash OTP Startup

See code file ./tools/keytools/otp/startup.c

Quick Start (Linux)

make wolfboot_signing_private_key.der SIGN=ED25519

# or

./tools/keytools/keygen --ed25519 -g wolfboot_signing_private_key.der

Note the above example is a basic case where a single key is generated. The tool supports multiple keys both with [-g privkey] and [-i pubkey] parameters.

See the local docs docs/keystore.md and the wolfBoot Keystore section of the manual for additional details.

Debugging and Development

DEBUG_SIGNTOOL

Enables additional diagnostic messages that may be useful during development and initial bring-up.

WOLFBOOT_SHOW_INCLUDE

Enables compile-time verbosity to indicate which user_settings.h file is being used.