Skip to content

Commit 9debc4c

Browse files
bigbrettdanielinux
bigbrett
authored and
danielinux
committed
Fix XMSS and ML_DSA keygen type mismatch between image headers and keystore by unifying AUTH_KEY_*/KEYGEN_* constants
1 parent 409901b commit 9debc4c

File tree

2 files changed

+57
-64
lines changed

2 files changed

+57
-64
lines changed

‎include/wolfboot/wolfboot.h‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,7 @@ extern "C" {
215215
#define HDR_PADDING 0xFF
216216

217217
/* Auth Key types */
218+
#define AUTH_KEY_NONE 0x00
218219
#define AUTH_KEY_ED25519 0x01
219220
#define AUTH_KEY_ECC256 0x02
220221
#define AUTH_KEY_RSA2048 0x03
@@ -224,9 +225,9 @@ extern "C" {
224225
#define AUTH_KEY_ECC521 0x07
225226
#define AUTH_KEY_RSA3072 0x08
226227
#define AUTH_KEY_LMS 0x09
227-
/* 0x0A...0x0F reserved */
228-
#define AUTH_KEY_XMSS 0x10
229-
#define AUTH_KEY_ML_DSA 0x11
228+
#define AUTH_KEY_XMSS 0x0A
229+
#define AUTH_KEY_ML_DSA 0x0B
230+
#define AUTH_KEY_NUM 0x0C
230231

231232
/*
232233
* 8 bits: auth type

‎tools/keytools/keygen.c‎

Lines changed: 53 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -96,19 +96,6 @@
9696
#include "wolfboot/wolfboot.h"
9797

9898

99-
#define KEYGEN_NONE 0
100-
#define KEYGEN_ED25519 1
101-
#define KEYGEN_ECC256 2
102-
#define KEYGEN_RSA2048 3
103-
#define KEYGEN_RSA4096 4
104-
#define KEYGEN_ED448 5
105-
#define KEYGEN_ECC384 6
106-
#define KEYGEN_ECC521 7
107-
#define KEYGEN_RSA3072 8
108-
#define KEYGEN_LMS 9
109-
#define KEYGEN_XMSS 10
110-
#define KEYGEN_ML_DSA 11
111-
11299
/* Globals */
113100
static FILE *fpub, *fpub_image;
114101
static int force = 0;
@@ -425,34 +412,34 @@ static uint32_t get_pubkey_size(uint32_t keyType)
425412
uint32_t size = 0;
426413

427414
switch (keyType) {
428-
case KEYGEN_ED25519:
415+
case AUTH_KEY_ED25519:
429416
size = KEYSTORE_PUBKEY_SIZE_ED25519;
430417
break;
431-
case KEYGEN_ED448:
418+
case AUTH_KEY_ED448:
432419
size = KEYSTORE_PUBKEY_SIZE_ED448;
433420
break;
434-
case KEYGEN_ECC256:
421+
case AUTH_KEY_ECC256:
435422
size = KEYSTORE_PUBKEY_SIZE_ECC256;
436423
break;
437-
case KEYGEN_ECC384:
424+
case AUTH_KEY_ECC384:
438425
size = KEYSTORE_PUBKEY_SIZE_ECC384;
439426
break;
440-
case KEYGEN_RSA2048:
427+
case AUTH_KEY_RSA2048:
441428
size = KEYSTORE_PUBKEY_SIZE_RSA2048;
442429
break;
443-
case KEYGEN_RSA3072:
430+
case AUTH_KEY_RSA3072:
444431
size = KEYSTORE_PUBKEY_SIZE_RSA3072;
445432
break;
446-
case KEYGEN_RSA4096:
433+
case AUTH_KEY_RSA4096:
447434
size = KEYSTORE_PUBKEY_SIZE_RSA4096;
448435
break;
449-
case KEYGEN_LMS:
436+
case AUTH_KEY_LMS:
450437
size = KEYSTORE_PUBKEY_SIZE_LMS;
451438
break;
452-
case KEYGEN_XMSS:
439+
case AUTH_KEY_XMSS:
453440
size = KEYSTORE_PUBKEY_SIZE_XMSS;
454441
break;
455-
case KEYGEN_ML_DSA:
442+
case AUTH_KEY_ML_DSA:
456443
{
457444
char *env_ml_dsa_level = getenv("ML_DSA_LEVEL");
458445
if (env_ml_dsa_level == NULL) {
@@ -491,6 +478,11 @@ void keystore_add(uint32_t ktype, uint8_t *key, uint32_t sz, const char *keyfile
491478
struct keystore_slot sl;
492479
size_t slot_size;
493480

481+
if (ktype >= AUTH_KEY_NUM) {
482+
fprintf(stderr, "error: unknown key type %u\n", ktype);
483+
exit(1);
484+
}
485+
494486
fprintf(fpub, Slot_hdr, keyfile, id_slot, KType[ktype], id_mask, sz);
495487
if (noLocalKeys) {
496488
/* If noLocalKeys is set by caller, we should write a zero key to the
@@ -584,11 +576,11 @@ static void keygen_rsa(const char *keyfile, int kbits, uint32_t id_mask)
584576
}
585577

586578
if (kbits == 2048)
587-
keystore_add(KEYGEN_RSA2048, pub_der, publen, keyfile, id_mask);
579+
keystore_add(AUTH_KEY_RSA2048, pub_der, publen, keyfile, id_mask);
588580
else if (kbits == 3072)
589-
keystore_add(KEYGEN_RSA3072, pub_der, publen, keyfile, id_mask);
581+
keystore_add(AUTH_KEY_RSA3072, pub_der, publen, keyfile, id_mask);
590582
else if (kbits == 4096)
591-
keystore_add(KEYGEN_RSA4096, pub_der, publen, keyfile, id_mask);
583+
keystore_add(AUTH_KEY_RSA4096, pub_der, publen, keyfile, id_mask);
592584
}
593585

594586
#define MAX_ECC_KEY_SIZE 66
@@ -688,11 +680,11 @@ static void keygen_ecc(const char *priv_fname, uint16_t ecc_key_size,
688680
memcpy(k_buffer + ecc_key_size, Qy, ecc_key_size);
689681

690682
if (ecc_key_size == 32)
691-
keystore_add(KEYGEN_ECC256, k_buffer, 2 * ecc_key_size, priv_fname, id_mask);
683+
keystore_add(AUTH_KEY_ECC256, k_buffer, 2 * ecc_key_size, priv_fname, id_mask);
692684
else if (ecc_key_size == 48)
693-
keystore_add(KEYGEN_ECC384, k_buffer, 2 * ecc_key_size, priv_fname, id_mask);
685+
keystore_add(AUTH_KEY_ECC384, k_buffer, 2 * ecc_key_size, priv_fname, id_mask);
694686
else if (ecc_key_size == 66)
695-
keystore_add(KEYGEN_ECC521, k_buffer, 2 * ecc_key_size, priv_fname, id_mask);
687+
keystore_add(AUTH_KEY_ECC521, k_buffer, 2 * ecc_key_size, priv_fname, id_mask);
696688
}
697689

698690

@@ -730,7 +722,7 @@ static void keygen_ed25519(const char *privkey, uint32_t id_mask)
730722
}
731723
}
732724

733-
keystore_add(KEYGEN_ED25519, pub, ED25519_PUB_KEY_SIZE, privkey, id_mask);
725+
keystore_add(AUTH_KEY_ED25519, pub, ED25519_PUB_KEY_SIZE, privkey, id_mask);
734726
}
735727

736728
static void keygen_ed448(const char *privkey, uint32_t id_mask)
@@ -767,7 +759,7 @@ static void keygen_ed448(const char *privkey, uint32_t id_mask)
767759
}
768760
}
769761

770-
keystore_add(KEYGEN_ED448, pub, ED448_PUB_KEY_SIZE, privkey, id_mask);
762+
keystore_add(AUTH_KEY_ED448, pub, ED448_PUB_KEY_SIZE, privkey, id_mask);
771763
}
772764

773765
#include "../lms/lms_common.h"
@@ -868,7 +860,7 @@ static void keygen_lms(const char *priv_fname, uint32_t id_mask)
868860
}
869861
}
870862

871-
keystore_add(KEYGEN_LMS, lms_pub, KEYSTORE_PUBKEY_SIZE_LMS, priv_fname, id_mask);
863+
keystore_add(AUTH_KEY_LMS, lms_pub, KEYSTORE_PUBKEY_SIZE_LMS, priv_fname, id_mask);
872864

873865
wc_LmsKey_Free(&key);
874866
}
@@ -968,7 +960,7 @@ static void keygen_xmss(const char *priv_fname, uint32_t id_mask)
968960
}
969961

970962

971-
keystore_add(KEYGEN_XMSS, xmss_pub, KEYSTORE_PUBKEY_SIZE_XMSS, priv_fname, id_mask);
963+
keystore_add(AUTH_KEY_XMSS, xmss_pub, KEYSTORE_PUBKEY_SIZE_XMSS, priv_fname, id_mask);
972964

973965
wc_XmssKey_Free(&key);
974966
}
@@ -1144,7 +1136,7 @@ static void keygen_ml_dsa(const char *priv_fname, uint32_t id_mask)
11441136
}
11451137
}
11461138

1147-
keystore_add(KEYGEN_ML_DSA, pub, pub_len, priv_fname, id_mask);
1139+
keystore_add(AUTH_KEY_ML_DSA, pub, pub_len, priv_fname, id_mask);
11481140

11491141
wc_MlDsaKey_Free(&key);
11501142
free(priv);
@@ -1185,55 +1177,55 @@ static void key_generate(uint32_t ktype, const char *kfilename, uint32_t id_mask
11851177

11861178
switch (ktype) {
11871179
#ifdef HAVE_ED25519
1188-
case KEYGEN_ED25519:
1180+
case AUTH_KEY_ED25519:
11891181
keygen_ed25519(kfilename, id_mask);
11901182
break;
11911183
#endif
11921184

11931185
#ifdef HAVE_ED448
1194-
case KEYGEN_ED448:
1186+
case AUTH_KEY_ED448:
11951187
keygen_ed448(kfilename, id_mask);
11961188
break;
11971189
#endif
11981190

11991191
#ifdef HAVE_ECC
1200-
case KEYGEN_ECC256:
1192+
case AUTH_KEY_ECC256:
12011193
keygen_ecc(kfilename, 32, id_mask);
12021194
break;
1203-
case KEYGEN_ECC384:
1195+
case AUTH_KEY_ECC384:
12041196
keygen_ecc(kfilename, 48, id_mask);
12051197
break;
1206-
case KEYGEN_ECC521:
1198+
case AUTH_KEY_ECC521:
12071199
keygen_ecc(kfilename, 66, id_mask);
12081200
break;
12091201
#endif
12101202

12111203
#ifndef NO_RSA
1212-
case KEYGEN_RSA2048:
1204+
case AUTH_KEY_RSA2048:
12131205
keygen_rsa(kfilename, 2048, id_mask);
12141206
break;
1215-
case KEYGEN_RSA3072:
1207+
case AUTH_KEY_RSA3072:
12161208
keygen_rsa(kfilename, 3072, id_mask);
12171209
break;
1218-
case KEYGEN_RSA4096:
1210+
case AUTH_KEY_RSA4096:
12191211
keygen_rsa(kfilename, 4096, id_mask);
12201212
break;
12211213
#endif
12221214

12231215
#ifdef WOLFSSL_HAVE_LMS
1224-
case KEYGEN_LMS:
1216+
case AUTH_KEY_LMS:
12251217
keygen_lms(kfilename, id_mask);
12261218
break;
12271219
#endif
12281220

12291221
#ifdef WOLFSSL_HAVE_XMSS
1230-
case KEYGEN_XMSS:
1222+
case AUTH_KEY_XMSS:
12311223
keygen_xmss(kfilename, id_mask);
12321224
break;
12331225
#endif
12341226

12351227
#ifdef WOLFSSL_WC_DILITHIUM
1236-
case KEYGEN_ML_DSA:
1228+
case AUTH_KEY_ML_DSA:
12371229
keygen_ml_dsa(kfilename, id_mask);
12381230
break;
12391231
#endif
@@ -1276,8 +1268,8 @@ static void key_import(uint32_t ktype, const char *fname, uint32_t id_mask)
12761268
keySz = get_pubkey_size(ktype);
12771269

12781270
if (readLen > (int)keySz) {
1279-
if (ktype == KEYGEN_ECC256 || ktype == KEYGEN_ECC384 ||
1280-
ktype == KEYGEN_ECC521) {
1271+
if (ktype == AUTH_KEY_ECC256 || ktype == AUTH_KEY_ECC384 ||
1272+
ktype == AUTH_KEY_ECC521) {
12811273
initKey = ret = wc_EccPublicKeyDecode(buf, &keySzOut, eccKey, readLen);
12821274

12831275
if (ret == 0) {
@@ -1288,7 +1280,7 @@ static void key_import(uint32_t ktype, const char *fname, uint32_t id_mask)
12881280
if (initKey == 0)
12891281
wc_ecc_free(eccKey);
12901282
}
1291-
else if (ktype == KEYGEN_ED25519) {
1283+
else if (ktype == AUTH_KEY_ED25519) {
12921284
initKey = ret = wc_Ed25519PublicKeyDecode(buf, &keySzOut,
12931285
ed25519Key, readLen);
12941286
if (ret < 0)
@@ -1302,7 +1294,7 @@ static void key_import(uint32_t ktype, const char *fname, uint32_t id_mask)
13021294
if (initKey == 0)
13031295
wc_ed25519_free(ed25519Key);
13041296
}
1305-
else if (ktype == KEYGEN_ED448) {
1297+
else if (ktype == AUTH_KEY_ED448) {
13061298
initKey = ret = wc_Ed448PublicKeyDecode(buf, &keySzOut,
13071299
ed448Key, readLen);
13081300

@@ -1368,42 +1360,42 @@ int main(int argc, char** argv)
13681360
for (i = 1; i < argc; i++) {
13691361
/* Parse Arguments */
13701362
if (strcmp(argv[i], "--ed25519") == 0) {
1371-
keytype = KEYGEN_ED25519;
1363+
keytype = AUTH_KEY_ED25519;
13721364
}
13731365
else if (strcmp(argv[i], "--ed448") == 0) {
1374-
keytype = KEYGEN_ED448;
1366+
keytype = AUTH_KEY_ED448;
13751367
}
13761368
else if (strcmp(argv[i], "--ecc256") == 0) {
1377-
keytype = KEYGEN_ECC256;
1369+
keytype = AUTH_KEY_ECC256;
13781370
}
13791371
else if (strcmp(argv[i], "--ecc384") == 0) {
1380-
keytype = KEYGEN_ECC384;
1372+
keytype = AUTH_KEY_ECC384;
13811373
}
13821374
else if (strcmp(argv[i], "--ecc521") == 0) {
1383-
keytype = KEYGEN_ECC521;
1375+
keytype = AUTH_KEY_ECC521;
13841376
}
13851377
else if (strcmp(argv[i], "--rsa2048") == 0) {
1386-
keytype = KEYGEN_RSA2048;
1378+
keytype = AUTH_KEY_RSA2048;
13871379
}
13881380
else if (strcmp(argv[i], "--rsa3072") == 0) {
1389-
keytype = KEYGEN_RSA3072;
1381+
keytype = AUTH_KEY_RSA3072;
13901382
}
13911383
else if (strcmp(argv[i], "--rsa4096") == 0) {
1392-
keytype = KEYGEN_RSA4096;
1384+
keytype = AUTH_KEY_RSA4096;
13931385
}
13941386
#if defined(WOLFSSL_HAVE_LMS)
13951387
else if (strcmp(argv[i], "--lms") == 0) {
1396-
keytype = KEYGEN_LMS;
1388+
keytype = AUTH_KEY_LMS;
13971389
}
13981390
#endif
13991391
#if defined(WOLFSSL_HAVE_XMSS)
14001392
else if (strcmp(argv[i], "--xmss") == 0) {
1401-
keytype = KEYGEN_XMSS;
1393+
keytype = AUTH_KEY_XMSS;
14021394
}
14031395
#endif
14041396
#if defined(WOLFSSL_WC_DILITHIUM)
14051397
else if (strcmp(argv[i], "--ml_dsa") == 0) {
1406-
keytype = KEYGEN_ML_DSA;
1398+
keytype = AUTH_KEY_ML_DSA;
14071399
}
14081400
#endif
14091401
else if (strcmp(argv[i], "--force") == 0) {
@@ -1465,7 +1457,7 @@ int main(int argc, char** argv)
14651457
}
14661458
}
14671459
printf("Keytype: %s\n", KName[keytype]);
1468-
if (keytype == 0)
1460+
if (keytype == AUTH_KEY_NONE)
14691461
exit(0);
14701462
fpub = fopen(pubkeyfile, "rb");
14711463
if (!force && (fpub != NULL)) {

0 commit comments

Comments
 (0)