With upcoming ECDSA support RSA won't be the only option for FIT image verification anymore. Make CONFIG_CRYPTO_RSA visible so that the user can choose. CONFIG_CRYPTO_RSA defaults to yes when FITIMAGE_SIGNATURE is selected so that existing configs continue to work.
Signed-off-by: Sascha Hauer <[email protected]> --- common/Kconfig | 1 - common/image-fit.c | 5 +++++ crypto/Kconfig | 3 ++- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/common/Kconfig b/common/Kconfig index 31360892ae..65850f68bd 100644 --- a/common/Kconfig +++ b/common/Kconfig @@ -59,7 +59,6 @@ config FITIMAGE select DIGEST config FITIMAGE_SIGNATURE - select CRYPTO_RSA bool config LOGBUF diff --git a/common/image-fit.c b/common/image-fit.c index 4a69049abc..6002440e7e 100644 --- a/common/image-fit.c +++ b/common/image-fit.c @@ -262,6 +262,11 @@ static int fit_check_rsa_signature(struct device_node *sig_node, const char *sig_value; int ret; + if (!IS_ENABLED(CONFIG_CRYPTO_RSA)) { + pr_err("RSA support is disabled, Cannot verify image\n"); + return -EOPNOTSUPP; + } + sig_value = of_get_property(sig_node, "value", &sig_len); if (!sig_value) { pr_err("signature value not found in %pOF\n", sig_node); diff --git a/crypto/Kconfig b/crypto/Kconfig index 32051d8d2b..b6214b229f 100644 --- a/crypto/Kconfig +++ b/crypto/Kconfig @@ -116,7 +116,8 @@ config CRYPTO_PBKDF2 bool config CRYPTO_RSA - bool + bool "RSA support" + default y if FITIMAGE_SIGNATURE config CRYPTO_RSA_BUILTIN_KEYS bool -- 2.39.2
