Skip to content

Commit 41c60f4

Browse files
danielinuxdanielinux
committed
Ecc256 signature verification with sp-math support, work in progress
1 parent f4f65ae commit 41c60f4

14 files changed

Lines changed: 881 additions & 111 deletions

File tree

‎.gitignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,13 @@
4949

5050
# automatically generated source files
5151
src/ed25519_pub_key.c
52+
src/ecc256_pub_key.c
53+
54+
# keygen binaries
55+
tools/ed25519/ed25519_sign
56+
tools/ed25519/ed25519_keygen
57+
tools/ecc256/ecc256_sign
58+
tools/ecc256/ecc256_keygen
5259

5360
# Vim swap files
5461
.*.swp

‎Makefile‎

Lines changed: 56 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
CROSS_COMPILE:=arm-none-eabi-
22
CC:=$(CROSS_COMPILE)gcc
33
LD:=$(CROSS_COMPILE)gcc
4+
AS:=$(CROSS_COMPILE)gcc
45

56

67
OBJCOPY:=$(CROSS_COMPILE)objcopy
78
SIZE:=$(CROSS_COMPILE)size
89
BOOT_IMG?=test-app/image.bin
9-
BOOT0_OFFSET?=0x20000
10+
BOOT0_OFFSET?=0x10000
1011
SIGN?=ED25519
1112
TARGET?=stm32f4
1213
DEBUG?=0
@@ -19,7 +20,7 @@ LSCRIPT:=hal/$(TARGET).ld
1920
OBJS:= \
2021
./hal/$(TARGET).o \
2122
./src/loader.o \
22-
./src/mem.o \
23+
./src/string.o \
2324
./src/crypto.o \
2425
./src/wolfboot.o \
2526
./src/image.o \
@@ -29,33 +30,63 @@ OBJS:= \
2930
./lib/wolfssl/wolfcrypt/src/wolfmath.o \
3031
./lib/wolfssl/wolfcrypt/src/fe_low_mem.o
3132

33+
3234
ifeq ($(TARGET),samr21)
3335
CORTEX_M0=1
3436
endif
3537

38+
ifeq ($(SIGN),ECC256)
39+
KEYGEN_TOOL=tools/ecc256/ecc256_keygen
40+
SIGN_TOOL=tools/ecc256/ecc256_sign
41+
PRIVATE_KEY=ecc256.der
42+
else
43+
KEYGEN_TOOL=tools/ed25519/ed25519_keygen
44+
SIGN_TOOL=tools/ed25519/ed25519_sign
45+
PRIVATE_KEY=ed25519.der
46+
endif
47+
48+
MATH_OBJS:=./lib/wolfssl/wolfcrypt/src/sp_int.o
49+
50+
51+
3652
ifeq ($(CORTEX_M0),1)
3753
CFLAGS:=-mcpu=cortex-m0
54+
MATH_OBJS += ./lib/wolfssl/wolfcrypt/src/sp_c32.o
3855
else
3956
CFLAGS:=-mcpu=cortex-m3
57+
MATH_OBJS += ./lib/wolfssl/wolfcrypt/src/sp_cortexm.o
58+
endif
59+
60+
ifeq ($(FASTMATH),1)
61+
MATH_OBJS:=./lib/wolfssl/wolfcrypt/src/integer.o
62+
CFLAGS+=-DUSE_FAST_MATH
4063
endif
4164

4265
CFLAGS+=-mthumb -Wall -Wextra -Wno-main -Wstack-usage=1024 -ffreestanding -Wno-unused \
4366
-Ilib/bootutil/include -Iinclude/ -Ilib/wolfssl -nostartfiles \
44-
-nostdlib \
4567
-DWOLFSSL_USER_SETTINGS \
68+
-mthumb -mlittle-endian -mthumb-interwork \
4669
-DPLATFORM_$(TARGET)
4770

4871
ifeq ($(SIGN),ED25519)
4972
OBJS+= ./lib/wolfssl/wolfcrypt/src/sha512.o \
5073
./lib/wolfssl/wolfcrypt/src/ed25519.o \
5174
./lib/wolfssl/wolfcrypt/src/ge_low_mem.o \
5275
./src/ed25519_pub_key.o
53-
CFLAGS+=-DWOLFBOOT_SIGN_ED25519
76+
CFLAGS+=-DWOLFBOOT_SIGN_ED25519 -nostdlib -DWOLFSSL_STATIC_MEMORY
77+
LDFLAGS+=-nostdlib
5478
endif
5579

56-
ifeq ($(SIGN),EC256)
57-
OBJS+= ./ext/wolfssl/wolfcrypt/src/ecc.o
58-
CFLAGS+=-DWOLFBOOT_SIGN_EC256
80+
ifeq ($(SIGN),ECC256)
81+
OBJS+= \
82+
$(MATH_OBJS) \
83+
./lib/wolfssl/wolfcrypt/src/ecc.o \
84+
./lib/wolfssl/wolfcrypt/src/ge_low_mem.o \
85+
./lib/wolfssl/wolfcrypt/src/memory.o \
86+
./lib/wolfssl/wolfcrypt/src/wc_port.o \
87+
./src/ecc256_pub_key.o \
88+
./src/xmalloc.o
89+
CFLAGS+=-DWOLFBOOT_SIGN_ECC256 -DXMALLOC_USER
5990
endif
6091

6192
ifeq ($(DEBUG),1)
@@ -68,7 +99,9 @@ ifeq ($(VTOR),0)
6899
CFLAGS+=-DNO_VTOR
69100
endif
70101

71-
LDFLAGS:=-T $(LSCRIPT) -Wl,-gc-sections -Wl,-Map=wolfboot.map -ffreestanding -nostartfiles -mcpu=cortex-m3 -mthumb -nostdlib
102+
LDFLAGS:=-T $(LSCRIPT) -Wl,-gc-sections -Wl,-Map=wolfboot.map -ffreestanding -nostartfiles -mcpu=cortex-m3 -mthumb
103+
104+
ASFLAGS:=$(CFLAGS)
72105

73106
all: factory.bin
74107

@@ -92,16 +125,22 @@ test-app/image.bin:
92125
tools/ed25519/ed25519_sign:
93126
make -C tools/ed25519
94127

128+
tools/ecc256/ecc256_sign:
129+
make -C tools/ecc256
130+
95131
ed25519.der: tools/ed25519/ed25519_sign
96132
tools/ed25519/ed25519_keygen src/ed25519_pub_key.c
97133

98-
factory.bin: $(BOOT_IMG) wolfboot-align.bin tools/ed25519/ed25519_sign ed25519.der
99-
tools/ed25519/ed25519_sign $(BOOT_IMG) ed25519.der 1
134+
ecc256.der: tools/ecc256/ecc256_sign
135+
tools/ecc256/ecc256_keygen src/ecc256_pub_key.c
136+
137+
factory.bin: $(BOOT_IMG) wolfboot-align.bin $(SIGN_TOOL) $(PRIVATE_KEY)
138+
$(SIGN_TOOL) $(BOOT_IMG) $(PRIVATE_KEY) 1
100139
cat wolfboot-align.bin $(BOOT_IMG).v1.signed > $@
101140

102-
second.img: $(BOOT_IMG) wolfboot-align.bin tools/ed25519/ed25519_sign ed25519.der
103-
tools/ed25519/ed25519_sign $(BOOT_IMG) ed25519.der 1 65536
104-
tools/ed25519/ed25519_sign $(BOOT_IMG) ed25519.der 2
141+
second.img: $(BOOT_IMG) wolfboot-align.bin $(SIGN_TOOL) $(PRIVATE_KEY)
142+
$(SIGN_TOOL) $(BOOT_IMG) $(PRIVATE_KEY) 1 65536
143+
$(SIGN_TOOL) $(BOOT_IMG) $(PRIVATE_KEY) 2
105144
cat wolfboot-align.bin $(BOOT_IMG).v1.signed $(BOOT_IMG).v2.signed > $@
106145

107146
wolfboot.elf: $(OBJS) $(LSCRIPT)
@@ -110,14 +149,16 @@ wolfboot.elf: $(OBJS) $(LSCRIPT)
110149

111150
src/ed25519_pub_key.c: ed25519.der
112151

113-
keys: ed25519.der
152+
src/ecc256_pub_key.c: ecc256.der
114153

154+
keys: $(PRIVATE_KEY)
115155

116156
clean:
117157
rm -f *.bin *.elf $(OBJS) wolfboot.map *.bin *.hex
118158
make -C test-app clean
119159

120160
distclean: clean
121161
make -C tools/ed25519 clean
122-
rm -f *.pem *.der tags ./src/ed25519_pub_key.c
162+
make -C tools/ecc256 clean
163+
rm -f *.pem *.der tags ./src/ed25519_pub_key.c ./src/ecc256_pub_key.c
123164

‎include/loader.h‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
#ifndef LOADER_H
22
#define LOADER_H
33

4-
#if defined(WOLFBOOT_SIGN_EC256)
5-
extern const unsigned char ecdsa_pub_key[];
6-
extern unsigned int ecdsa_pub_key_len;
7-
# define KEY_BUFFER ecdsa_pub_key
8-
# define KEY_LEN ecdsa_pub_key_len
9-
# define IMAGE_SIGNATURE_SIZE (72)
10-
#elif defined(WOLFBOOT_SIGN_ED25519)
4+
#if defined(WOLFBOOT_SIGN_ED25519)
115
extern const unsigned char ed25519_pub_key[];
126
extern unsigned int ed25519_pub_key_len;
137
# define KEY_BUFFER ed25519_pub_key
148
# define KEY_LEN ed25519_pub_key_len
159
# define IMAGE_SIGNATURE_SIZE (64)
10+
#elif defined(WOLFBOOT_SIGN_ECC256)
11+
extern const unsigned char ecc256_pub_key[];
12+
extern unsigned int ecc256_pub_key_len;
13+
# define KEY_BUFFER ecc256_pub_key
14+
# define KEY_LEN ecc256_pub_key_len
15+
# define IMAGE_SIGNATURE_SIZE (64)
1616
#else
1717
# error "No public key available for given signing algorithm."
1818
#endif /* Algorithm selection */

‎include/target.h‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@
66
* Ensure that your firmware entry point is
77
* at FLASH_AREA_IMAGE_0_OFFSET + 0x100
88
*/
9-
#define WOLFBOOT_SECTOR_SIZE 0x20000
10-
#define WOLFBOOT_PARTITION_SIZE 0x20000
9+
#define WOLFBOOT_SECTOR_SIZE 0x1000
10+
#define WOLFBOOT_PARTITION_SIZE 0x10000
1111

12-
#define WOLFBOOT_PARTITION_BOOT_ADDRESS 0x20000
13-
#define WOLFBOOT_PARTITION_UPDATE_ADDRESS 0x40000
14-
#define WOLFBOOT_PARTITION_SWAP_ADDRESS 0x60000
12+
#define WOLFBOOT_PARTITION_BOOT_ADDRESS 0x10000
13+
#define WOLFBOOT_PARTITION_UPDATE_ADDRESS 0x20000
14+
#define WOLFBOOT_PARTITION_SWAP_ADDRESS 0x30000
1515

1616
#endif

‎include/user_settings.h‎

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,8 @@
55
#define NO_DEV_RANDOM
66
#define NO_FILESYSTEM
77
#define NO_MAIN_DRIVER
8-
#define NO_SIG_WRAPPER
98
#define NO_OLD_RNGNAME
10-
#define WOLFSSL_STATIC_MEMORY
9+
1110
//#define WOLFSSL_SMALL_STACK
1211
#define USE_SLOW_SHA512
1312

@@ -21,7 +20,6 @@
2120
# define NO_CERT
2221
# define NO_SESSION_CACHE
2322
# define NO_HC128
24-
# define NO_ASN
2523
# define NO_DES3
2624
# define NO_WOLFSSL_DIR
2725
# define NO_PWDBASED
@@ -32,24 +30,44 @@
3230

3331
#define SMALL_SESSION_CACHE
3432
#define WOLFSSL_DH_CONST
35-
#define WORD64_AVAILABLE
3633
#define TFM_TIMING_RESISTANT
37-
//#define USE_CERT_BUFFERS_2048
3834
#define NO_RC4
3935
#define WOLFCRYPT_ONLY
4036
#define WOLFSSL_NO_SOCK
41-
4237
# define WC_NO_RNG
38+
39+
#ifdef WOLFBOOT_SIGN_ED25519
4340
# define HAVE_ED25519
4441
# define ED25519_SMALL
4542
# define NO_ED25519_SIGN
4643
# define NO_ED25519_EXPORT
4744
# define USE_FAST_MATH
45+
# define WOLFSSL_SHA512
46+
# define NO_ASN
47+
#endif
48+
49+
#ifdef WOLFBOOT_SIGN_ECC256
50+
# define HAVE_ECC
51+
# define FP_ECC
52+
# define HAVE_ECC_VERIFY
53+
# define ECC_ALT_SIZE
54+
# define NO_ECC_SIGN
55+
# define NO_ECC_EXPORT
56+
# define USE_FAST_MATH
57+
# define WOLFSSL_SHA512
58+
# define WOLFSSL_SP_SMALL
59+
# define SP_WORD_SIZE 32
60+
# define WOLFSSL_HAVE_SP_ECC
61+
# define WOLFSSL_SP_MATH
62+
# define NO_ASN
63+
//# define NO_ECC_SIGN
64+
# define NO_ECC_DHE
65+
# define NO_ECC_KEY_EXPORT
66+
#endif
4867

4968
/* AES */
5069
# define NO_AES
5170
# define NO_CMAC
5271
# define NO_CODING
53-
# define WOLFSSL_SHA512
5472
# define NO_BIG_INT
5573
# define NO_RSA

‎lib/wolfssl‎

Submodule wolfssl updated 153 files

‎src/image.c‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,40 @@ static int wolfBoot_verify_signature(uint8_t *hash, uint8_t *sig)
4848
}
4949
#endif
5050

51+
#ifdef WOLFBOOT_SIGN_ECC256
52+
#include <wolfssl/wolfcrypt/ecc.h>
53+
#define ECC_KEY_SIZE 32
54+
#define ECC_SIG_SIZE 64
55+
static int wolfBoot_verify_signature(uint8_t *hash, uint8_t *sig)
56+
{
57+
int ret, res;
58+
mp_int r, s;
59+
ecc_key ecc;
60+
ret = wc_ecc_init(&ecc);
61+
if (ret < 0) {
62+
/* Failed to initialize key */
63+
return -1;
64+
}
65+
/* Import public key */
66+
ret = wc_ecc_import_unsigned(&ecc, KEY_BUFFER, KEY_BUFFER + 32, NULL, ECC_SECP256R1);
67+
if ((ret < 0) || ecc.type != ECC_PUBLICKEY) {
68+
/* Failed to import ecc key */
69+
return -1;
70+
}
71+
72+
/* Import signature into r,s */
73+
mp_init(&r);
74+
mp_init(&s);
75+
mp_read_unsigned_bin(&r, sig, ECC_KEY_SIZE);
76+
mp_read_unsigned_bin(&s, sig + ECC_KEY_SIZE, ECC_KEY_SIZE);
77+
ret = wc_ecc_verify_hash_ex(&r, &s, hash, SHA256_DIGEST_SIZE, &res, &ecc);
78+
if ((ret < 0) || (res == 0)) {
79+
return -1;
80+
}
81+
return 0;
82+
}
83+
#endif
84+
5185

5286
static uint8_t get_header(struct wolfBoot_image *img, uint8_t type, uint8_t **ptr)
5387
{

‎src/mem.c‎

Lines changed: 0 additions & 76 deletions
This file was deleted.

0 commit comments

Comments
 (0)