Skip to content

Commit e306cc0

Browse files
bigbrettbigbrett
committed
expand tests, add additional macro protection, fix keygen type bug
1 parent 67360da commit e306cc0

File tree

5 files changed

+297
-3
lines changed

5 files changed

+297
-3
lines changed

‎.github/workflows/test-sunnyday-simulator.yml‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,66 @@ jobs:
171171
run: |
172172
tools/scripts/sim-sunnyday-update.sh
173173
174+
- name: Cleanup to change key type
175+
run: |
176+
make keysclean
177+
178+
- name: Build wolfboot.elf (RSAPSS2048)
179+
run: |
180+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1
181+
182+
- name: Run sunny day update test
183+
run: |
184+
tools/scripts/sim-sunnyday-update.sh
185+
186+
- name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
187+
run: |
188+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1
189+
190+
- name: Run sunny day update test
191+
run: |
192+
tools/scripts/sim-sunnyday-update.sh
193+
194+
- name: Cleanup to change key type
195+
run: |
196+
make keysclean
197+
198+
- name: Build wolfboot.elf (RSAPSS3072)
199+
run: |
200+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1
201+
202+
- name: Run sunny day update test
203+
run: |
204+
tools/scripts/sim-sunnyday-update.sh
205+
206+
- name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
207+
run: |
208+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1
209+
210+
- name: Run sunny day update test
211+
run: |
212+
tools/scripts/sim-sunnyday-update.sh
213+
214+
- name: Cleanup to change key type
215+
run: |
216+
make keysclean
217+
218+
- name: Build wolfboot.elf (RSAPSS4096)
219+
run: |
220+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1
221+
222+
- name: Run sunny day update test
223+
run: |
224+
tools/scripts/sim-sunnyday-update.sh
225+
226+
- name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
227+
run: |
228+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1
229+
230+
- name: Run sunny day update test
231+
run: |
232+
tools/scripts/sim-sunnyday-update.sh
233+
174234
# 32 Bit simulator, FASTMATH
175235
#
176236
- name: make clean
@@ -301,6 +361,66 @@ jobs:
301361
run: |
302362
tools/scripts/sim-sunnyday-update.sh
303363
364+
- name: Cleanup to change key type
365+
run: |
366+
make keysclean
367+
368+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
369+
run: |
370+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0
371+
372+
- name: Run sunny day update test
373+
run: |
374+
tools/scripts/sim-sunnyday-update.sh
375+
376+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
377+
run: |
378+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0
379+
380+
- name: Run sunny day update test
381+
run: |
382+
tools/scripts/sim-sunnyday-update.sh
383+
384+
- name: Cleanup to change key type
385+
run: |
386+
make keysclean
387+
388+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
389+
run: |
390+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0
391+
392+
- name: Run sunny day update test
393+
run: |
394+
tools/scripts/sim-sunnyday-update.sh
395+
396+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
397+
run: |
398+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0
399+
400+
- name: Run sunny day update test
401+
run: |
402+
tools/scripts/sim-sunnyday-update.sh
403+
404+
- name: Cleanup to change key type
405+
run: |
406+
make keysclean
407+
408+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
409+
run: |
410+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1
411+
412+
- name: Run sunny day update test
413+
run: |
414+
tools/scripts/sim-sunnyday-update.sh
415+
416+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
417+
run: |
418+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0
419+
420+
- name: Run sunny day update test
421+
run: |
422+
tools/scripts/sim-sunnyday-update.sh
423+
304424
305425
# 64 Bit simulator, SP_MATH
306426
#
@@ -432,6 +552,66 @@ jobs:
432552
run: |
433553
tools/scripts/sim-sunnyday-update.sh
434554
555+
- name: Cleanup to change key type
556+
run: |
557+
make keysclean
558+
559+
- name: Build wolfboot.elf (RSAPSS2048)
560+
run: |
561+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1
562+
563+
- name: Run sunny day update test
564+
run: |
565+
tools/scripts/sim-sunnyday-update.sh
566+
567+
- name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
568+
run: |
569+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1
570+
571+
- name: Run sunny day update test
572+
run: |
573+
tools/scripts/sim-sunnyday-update.sh
574+
575+
- name: Cleanup to change key type
576+
run: |
577+
make keysclean
578+
579+
- name: Build wolfboot.elf (RSAPSS3072)
580+
run: |
581+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1
582+
583+
- name: Run sunny day update test
584+
run: |
585+
tools/scripts/sim-sunnyday-update.sh
586+
587+
- name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
588+
run: |
589+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1
590+
591+
- name: Run sunny day update test
592+
run: |
593+
tools/scripts/sim-sunnyday-update.sh
594+
595+
- name: Cleanup to change key type
596+
run: |
597+
make keysclean
598+
599+
- name: Build wolfboot.elf (RSAPSS4096)
600+
run: |
601+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1
602+
603+
- name: Run sunny day update test
604+
run: |
605+
tools/scripts/sim-sunnyday-update.sh
606+
607+
- name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
608+
run: |
609+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1
610+
611+
- name: Run sunny day update test
612+
run: |
613+
tools/scripts/sim-sunnyday-update.sh
614+
435615
# 64 Bit simulator, FASTMATH
436616
#
437617
- name: make clean
@@ -562,6 +742,66 @@ jobs:
562742
run: |
563743
tools/scripts/sim-sunnyday-update.sh
564744
745+
- name: Cleanup to change key type
746+
run: |
747+
make keysclean
748+
749+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
750+
run: |
751+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0
752+
753+
- name: Run sunny day update test
754+
run: |
755+
tools/scripts/sim-sunnyday-update.sh
756+
757+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
758+
run: |
759+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0
760+
761+
- name: Run sunny day update test
762+
run: |
763+
tools/scripts/sim-sunnyday-update.sh
764+
765+
- name: Cleanup to change key type
766+
run: |
767+
make keysclean
768+
769+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
770+
run: |
771+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0
772+
773+
- name: Run sunny day update test
774+
run: |
775+
tools/scripts/sim-sunnyday-update.sh
776+
777+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
778+
run: |
779+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0
780+
781+
- name: Run sunny day update test
782+
run: |
783+
tools/scripts/sim-sunnyday-update.sh
784+
785+
- name: Cleanup to change key type
786+
run: |
787+
make keysclean
788+
789+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
790+
run: |
791+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1
792+
793+
- name: Run sunny day update test
794+
run: |
795+
tools/scripts/sim-sunnyday-update.sh
796+
797+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
798+
run: |
799+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0
800+
801+
- name: Run sunny day update test
802+
run: |
803+
tools/scripts/sim-sunnyday-update.sh
804+
565805
- name: Run sunny day LMS update test
566806
run: |
567807
tools/scripts/sim-pq-sunnyday-update.sh config/examples/sim-lms.config

‎config/examples/sim-rsapss2048.config‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
ARCH=sim
2+
TARGET=sim
3+
SIGN?=RSAPSS2048
4+
HASH?=SHA256
5+
WOLFBOOT_SMALL_STACK?=0
6+
SPI_FLASH=0
7+
DEBUG=1
8+
9+
# sizes should be multiple of system page size
10+
WOLFBOOT_PARTITION_SIZE=0x40000
11+
WOLFBOOT_SECTOR_SIZE=0x1000
12+
WOLFBOOT_PARTITION_BOOT_ADDRESS=0x80000
13+
# if on external flash, it should be multiple of system page size
14+
WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x100000
15+
WOLFBOOT_PARTITION_SWAP_ADDRESS=0x180000
16+
17+
# required for keytools
18+
WOLFBOOT_FIXED_PARTITIONS=1
19+
20+
# For debugging XMALLOC/XFREE
21+
#CFLAGS_EXTRA+=-DWOLFBOOT_DEBUG_MALLOC

‎options.mk‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -581,6 +581,18 @@ ifneq ($(SIGN_SECONDARY),)
581581
WOLFCRYPT_OBJS+=$(RSA_OBJS)
582582
WOLFCRYPT_OBJS+=$(MATH_OBJS)
583583
endif
584+
ifeq ($(SIGN_SECONDARY),RSAPSS2048)
585+
WOLFCRYPT_OBJS+=$(RSA_OBJS)
586+
WOLFCRYPT_OBJS+=$(MATH_OBJS)
587+
endif
588+
ifeq ($(SIGN_SECONDARY),RSAPSS3072)
589+
WOLFCRYPT_OBJS+=$(RSA_OBJS)
590+
WOLFCRYPT_OBJS+=$(MATH_OBJS)
591+
endif
592+
ifeq ($(SIGN_SECONDARY),RSAPSS4096)
593+
WOLFCRYPT_OBJS+=$(RSA_OBJS)
594+
WOLFCRYPT_OBJS+=$(MATH_OBJS)
595+
endif
584596
ifeq ($(SIGN_SECONDARY),ECC256)
585597
WOLFCRYPT_OBJS+=$(ECC_OBJS)
586598
WOLFCRYPT_OBJS+=$(MATH_OBJS)

‎src/image.c‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -617,7 +617,16 @@ static void wolfBoot_verify_signature_rsa_pss(uint8_t key_slot,
617617
wc_FreeRsaKey(&rsa);
618618
/* wc_RsaPSS_VerifyCheckInline returns the PSS-verified data length on
619619
* success (>= digest size), or a negative error code on failure.
620-
* The hash comparison is performed internally by the function. */
620+
* The hash comparison is performed internally by the function.
621+
*
622+
* Note: uses '>=' rather than '==' because PSS verify returns the digest
623+
* size on success, unlike PKCS#1 v1.5 which returns exact decoded length.
624+
*
625+
* ARMORED limitation: the PKCS#1 v1.5 path uses both RSA_VERIFY_FN and
626+
* RSA_VERIFY_HASH armored macros (two hardened gates), but PSS only uses
627+
* RSA_VERIFY_FN because wc_RsaPSS_VerifyCheckInline performs the hash
628+
* comparison internally. The branch below is not armored. Full armored
629+
* hardening for PSS would require a new macro or restructuring. */
621630
if (ret >= WOLFBOOT_SHA_DIGEST_SIZE && img) {
622631
wolfBoot_image_confirm_signature_ok(img);
623632
}
@@ -2412,7 +2421,10 @@ int wolfBoot_verify_authenticity(struct wolfBoot_image *img)
24122421
defined (WOLFBOOT_SIGN_SECONDARY_RSA4096) || \
24132422
defined (WOLFBOOT_SIGN_SECONDARY_RSA2048ENC) || \
24142423
defined (WOLFBOOT_SIGN_SECONDARY_RSA3072ENC) || \
2415-
defined (WOLFBOOT_SIGN_SECONDARY_RSA4096ENC)
2424+
defined (WOLFBOOT_SIGN_SECONDARY_RSA4096ENC) || \
2425+
defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS2048) || \
2426+
defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS3072) || \
2427+
defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS4096)
24162428
expected_secondary_signature_size = RSA_IMAGE_SIGNATURE_SIZE;
24172429
#elif defined (WOLFBOOT_SIGN_SECONDARY_ECC256) || \
24182430
defined (WOLFBOOT_SIGN_SECONDARY_ECC384) || \

‎tools/keytools/keygen.c‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -535,7 +535,16 @@ void keystore_add(uint32_t ktype, uint8_t *key, uint32_t sz, const char *keyfile
535535

536536
memset(&sl, 0, sizeof(sl));
537537
sl.slot_id = id_slot;
538-
sl.key_type = ktype;
538+
/* Map keygen key type to AUTH_KEY_* value for binary keystore.
539+
* KEYGEN_RSAPSS* values (12-14) differ from AUTH_KEY_RSAPSS* (0x0A-0x0C). */
540+
if (ktype == KEYGEN_RSAPSS2048)
541+
sl.key_type = AUTH_KEY_RSAPSS2048;
542+
else if (ktype == KEYGEN_RSAPSS3072)
543+
sl.key_type = AUTH_KEY_RSAPSS3072;
544+
else if (ktype == KEYGEN_RSAPSS4096)
545+
sl.key_type = AUTH_KEY_RSAPSS4096;
546+
else
547+
sl.key_type = ktype;
539548
sl.part_id_mask = id_mask;
540549

541550
sl.pubkey_size = get_pubkey_size(ktype);

0 commit comments

Comments
 (0)