Fixes bug where SIGN=RSA4096ENC is overridden for TPM/Der encoded RSA certs.

Also removes dead WOLFBOOT_SIGN_RSA4096ENC macro from codebase

Author: bigbrett

include/image.h

@@ -62,10 +62,7 @@ extern "C" {
 #endif
 #if defined (WOLFBOOT_SIGN_RSA2048) || \
     defined (WOLFBOOT_SIGN_RSA3072) || \
-    defined (WOLFBOOT_SIGN_RSA4096) || \
-    defined (WOLFBOOT_SIGN_RSA2048ENC) || \
-    defined (WOLFBOOT_SIGN_RSA3072ENC) || \
-    defined (WOLFBOOT_SIGN_RSA4096ENC)
+    defined (WOLFBOOT_SIGN_RSA4096)
 #define wolfBoot_verify_signature_primary wolfBoot_verify_signature_rsa
 #endif
 #if defined (WOLFBOOT_SIGN_RSAPSS2048) || \
@@ -96,10 +93,7 @@ extern "C" {
 #endif
 #if defined (WOLFBOOT_SIGN_SECONDARY_RSA2048) || \
     defined (WOLFBOOT_SIGN_SECONDARY_RSA3072) || \
-    defined (WOLFBOOT_SIGN_SECONDARY_RSA4096) || \
-    defined (WOLFBOOT_SIGN_SECONDARY_RSA2048ENC) || \
-    defined (WOLFBOOT_SIGN_SECONDARY_RSA3072ENC) || \
-    defined (WOLFBOOT_SIGN_SECONDARY_RSA4096ENC)
+    defined (WOLFBOOT_SIGN_SECONDARY_RSA4096)
 #define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_rsa
 #endif
 #if defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS2048) || \

include/wolfboot/wolfboot.h

@@ -434,17 +434,17 @@ extern "C" {
  #   ifndef WOLFBOOT_UNIVERSAL_KEYSTORE
  #     define KEYSTORE_PUBKEY_SIZE KEYSTORE_PUBKEY_SIZE_ECC521
  #   endif
- #elif defined(WOLFBOOT_SIGN_RSA2048) || defined(WOLFBOOT_SIGN_RSA2048ENC)
+ #elif defined(WOLFBOOT_SIGN_RSA2048)
  #   define HDR_IMG_TYPE_AUTH HDR_IMG_TYPE_AUTH_RSA2048
  #   ifndef WOLFBOOT_UNIVERSAL_KEYSTORE
  #     define KEYSTORE_PUBKEY_SIZE KEYSTORE_PUBKEY_SIZE_RSA2048
  #   endif
- #elif defined(WOLFBOOT_SIGN_RSA3072) || defined(WOLFBOOT_SIGN_RSA3072ENC)
+ #elif defined(WOLFBOOT_SIGN_RSA3072)
  #   define HDR_IMG_TYPE_AUTH HDR_IMG_TYPE_AUTH_RSA3072
  #   ifndef WOLFBOOT_UNIVERSAL_KEYSTORE
  #     define KEYSTORE_PUBKEY_SIZE KEYSTORE_PUBKEY_SIZE_RSA3072
  #   endif
- #elif defined(WOLFBOOT_SIGN_RSA4096) || defined(WOLFBOOT_SIGN_RSA4096ENC)
+ #elif defined(WOLFBOOT_SIGN_RSA4096)
  #   define HDR_IMG_TYPE_AUTH HDR_IMG_TYPE_AUTH_RSA4096
  #   ifndef WOLFBOOT_UNIVERSAL_KEYSTORE
  #     define KEYSTORE_PUBKEY_SIZE KEYSTORE_PUBKEY_SIZE_RSA4096

options.mk

@@ -450,7 +450,6 @@ ifneq ($(findstring RSA3072,$(SIGN)),)
 endif
 
 ifneq ($(findstring RSA4096,$(SIGN)),)
-  SIGN:=RSA4096
   KEYGEN_OPTIONS+=--rsa4096
   ifeq ($(SIGN),RSA4096ENC)
     SIGN_OPTIONS+=--rsa4096enc

src/image.c

@@ -2309,9 +2309,6 @@ int wolfBoot_verify_authenticity(struct wolfBoot_image *img)
 #elif defined (WOLFBOOT_SIGN_RSA2048) || \
       defined (WOLFBOOT_SIGN_RSA3072) || \
       defined (WOLFBOOT_SIGN_RSA4096) || \
-      defined (WOLFBOOT_SIGN_RSA2048ENC) || \
-      defined (WOLFBOOT_SIGN_RSA3072ENC) || \
-      defined (WOLFBOOT_SIGN_RSA4096ENC) || \
       defined (WOLFBOOT_SIGN_RSAPSS2048) || \
       defined (WOLFBOOT_SIGN_RSAPSS3072) || \
       defined (WOLFBOOT_SIGN_RSAPSS4096)
@@ -2384,9 +2381,6 @@ int wolfBoot_verify_authenticity(struct wolfBoot_image *img)
 #elif defined (WOLFBOOT_SIGN_SECONDARY_RSA2048) || \
       defined (WOLFBOOT_SIGN_SECONDARY_RSA3072) || \
       defined (WOLFBOOT_SIGN_SECONDARY_RSA4096) || \
-      defined (WOLFBOOT_SIGN_SECONDARY_RSA2048ENC) || \
-      defined (WOLFBOOT_SIGN_SECONDARY_RSA3072ENC) || \
-      defined (WOLFBOOT_SIGN_SECONDARY_RSA4096ENC) || \
       defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS2048) || \
       defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS3072) || \
       defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS4096)

tools/unit-tests/unit-image.c

@@ -48,8 +48,7 @@
 #define ENCRYPT_KEY "123456789abcdef0123456789abcdef0123456789abcdef"
 #if !defined(WOLFBOOT_SIGN_ED25519) && !defined(WOLFBOOT_SIGN_ED448) && \
     !defined(WOLFBOOT_SIGN_RSA2048) && !defined(WOLFBOOT_SIGN_RSA3072) && \
-    !defined(WOLFBOOT_SIGN_RSA4096) && !defined(WOLFBOOT_SIGN_RSA2048ENC) && \
-    !defined(WOLFBOOT_SIGN_RSA3072ENC) && !defined(WOLFBOOT_SIGN_RSA4096ENC) && \
+    !defined(WOLFBOOT_SIGN_RSA4096) && \
     !defined(WOLFBOOT_SIGN_ECC256) && !defined(WOLFBOOT_SIGN_ECC384) && \
     !defined(WOLFBOOT_SIGN_ECC521) && !defined(WOLFBOOT_SIGN_LMS) && \
     !defined(WOLFBOOT_SIGN_XMSS) && !defined(WOLFBOOT_SIGN_ML_DSA)

tools/unit-tests/unit-keystore.c

@@ -42,15 +42,15 @@
 #define UNIT_KEY_TYPE AUTH_KEY_ED448
 #define UNIT_PUBKEY_SIZE KEYSTORE_PUBKEY_SIZE_ED448
 #define UNIT_PUBKEY_INIT { 0x00 }
-#elif defined(WOLFBOOT_SIGN_RSA2048) || defined(WOLFBOOT_SIGN_RSA2048ENC)
+#elif defined(WOLFBOOT_SIGN_RSA2048)
 #define UNIT_KEY_TYPE AUTH_KEY_RSA2048
 #define UNIT_PUBKEY_SIZE KEYSTORE_PUBKEY_SIZE_RSA2048
 #define UNIT_PUBKEY_INIT { 0x00 }
-#elif defined(WOLFBOOT_SIGN_RSA3072) || defined(WOLFBOOT_SIGN_RSA3072ENC)
+#elif defined(WOLFBOOT_SIGN_RSA3072)
 #define UNIT_KEY_TYPE AUTH_KEY_RSA3072
 #define UNIT_PUBKEY_SIZE KEYSTORE_PUBKEY_SIZE_RSA3072
 #define UNIT_PUBKEY_INIT { 0x00 }
-#elif defined(WOLFBOOT_SIGN_RSA4096) || defined(WOLFBOOT_SIGN_RSA4096ENC)
+#elif defined(WOLFBOOT_SIGN_RSA4096)
 #define UNIT_KEY_TYPE AUTH_KEY_RSA4096
 #define UNIT_PUBKEY_SIZE KEYSTORE_PUBKEY_SIZE_RSA4096
 #define UNIT_PUBKEY_INIT { 0x00 }