Hi Raymond,
Do you think that this serie may by merged please ?
Regards,
Philippe
Le 04/09/2026 à 10:37, Philippe Reynes a écrit :
This series adds the support of ecdsa with software
using mbedtls. So boards without ecdsa hardware may
also use signature with ecdsa.
To achieve this goal, several changes are done:
- fix the support of secp521r1
- enable support of ecdsa in mbedtls
- add software ecdsa signature check using mbedtls
- add support of ecdsa for internal fit signature
- add test for ecdsa for internal fit signature in vboot
- add support of ecdsa for pre-load signature
- add test for ecdsa for pre-load signature in vboot
- enable software ecdsa signature check in sandbox
To test this new feature, just follow those steps:
0) build u-boot using sandbox_defconfig and adding those options:
CONFIG_ECDSA_MBEDTLS=y
CONFIG_ECDSA_VERIFY_MBEDTLS=y
CONFIG_ECDSA=y
CONFIG_ECDSA_VERIFY=y
1) add a signature node to an its file
signature-256 {
algo = "sha256,ecdsa256";
key-name-hint = "private-key-256";
};
2) generate an ecdsa key
openssl ecparam -name prime256v1 -genkey -noout -out private-key-256.pem
3) create the itb file
./tools/mkimage -f <file.its> -k . -K arch/sandbox/dts/test.dtb <file.itb>
4) launch sandbox u-boot
./u-boot -d arch/sandbox/dts/test.dtb
5) on sandbox u-boot prompt, load the itb and launch bootm on it
=> host load hostfs - 1000000 uboot-ecdsa.itb
4628674 bytes read in 1 ms (4.3 GiB/s)
=> bootm 1000000
...
...
Verifying Hash Integrity ... sha256,ecdsa256:private-key-256+ OK
Changes in v2:
- move ECDSA_MBEDTLS to MBEDTLS_LIB_X509
- rename lib/mbedtls/sw_ecdsa.c to lib/mbedtls/ecdsa.c
- enhance dependencies for ECDSA_MBEDTLS
- fix support of ecdsa521/secp521r1
- add vboot test using ecdsa
Changes in v3:
- do not use _MBEDTLS in mbedtls_def_config.h
- check returns and remove mem leak in lib/mbedtls/ecdsa.c
- remove useless field *k in struct ecdsa_test_vector_s
- check returns in test/lib/ecdsa.c
- fix third parameter when calling sha*_csum_wd()
- add support of ecdsa in pre-load header
Changes in v4:
- change some dependencies to enable ecc
- use ECDSA_MBEDTLS to build the ecdsa driver
- support ecdsa521 and secp521r1
- add a test calling ecdsa_verify for the ecdsa class
- merge patch 10 and 11 (support ecdsa pre-load for binman and tests)
- several code cleanup
Change in v5:
- fix ecdsa 521 in the first patch (instead of the 5th patch)
- mbedtls: ecdsa is only compiled when ECDSA_MBEDTLS is enabled
- fit_image_setup_sig: required_keynode is initiazed to -1 instead of 0
- avoid hardcoded value for ecdsa sig and point size
- check pointer before using them
- free ecdsa keys when key are not found/used
Change in v6:
- fix dependencies for ecdsa
- ecdsa is no more mandatory for tls
- remove include u-boot/ecdsa.h in ecdsa-sw.c
- do not use fdt_stderror with -1
-
Change in v7:
- change uint8_t to u8 in test/dm/ecdsa.c
- change info->required_keynode >= 0 in lib/ecdsa/ecdsa-verify.c
- set required_keynode to -1 in test/dm/ecdsa.c
Change in v8:
- check exact size of data read in dtb in function fdt_get_key
- enhance commit message to explain patch 2 (enable ecc)
- no longer use macro CHECK with goto inside macro
- some code cleanup
Change in v9:
- rebase on next
- update cover letter
Change in v10:
- remove empty line at the end of ecdsa-sw.c
Philippe Reynes (15):
ecdsa: fix support of secp521r1
mbedtls: enable support of ecc
ecdsa: initial support of ecdsa using mbedtls
test: lib: ecdsa: add initial test
drivers: crypto: add software ecdsa support
test: dm: ecdsa.c: clean this test as software ecdsa is now
implemented
test: py: vboot: prepare integration test for ecdsa
test: vboot: add test for ecdsa
tools: fit_image_setup_sig: set required_keynode to -1
tools: mkimage: pre-load: add support of ecdsa
tools: binman: pre-load: add support of ecdsa
boot: pre-load: add support of ecdsa
tools: preload_check_sign: add support of ecdsa
test: py: vboot: prepare test for global signature with ecdsa
test: py: vboot: add test for global signature with ecdsa
boot/image-pre-load.c | 53 +-
configs/sandbox_defconfig | 2 +
drivers/crypto/Makefile | 1 +
drivers/crypto/ecdsa/Makefile | 6 +
drivers/crypto/ecdsa/ecdsa-sw.c | 31 ++
include/crypto/ecdsa-uclass.h | 15 +-
include/crypto/internal/ecdsa.h | 39 ++
lib/ecdsa/Kconfig | 1 +
lib/ecdsa/ecdsa-libcrypto.c | 104 +++-
lib/ecdsa/ecdsa-verify.c | 73 ++-
lib/fdt-libcrypto.c | 2 +-
lib/mbedtls/Kconfig | 24 +
lib/mbedtls/Makefile | 20 +-
lib/mbedtls/ecdsa.c | 152 ++++++
lib/mbedtls/mbedtls_def_config.h | 41 +-
test/dm/ecdsa.c | 107 +++-
test/lib/Makefile | 1 +
test/lib/ecdsa.c | 456 ++++++++++++++++++
test/py/tests/test_fit_ecdsa.py | 2 +-
test/py/tests/test_vboot.py | 148 +++---
.../tests/vboot/sandbox-binman-ecdsa256.dts | 24 +
.../tests/vboot/sandbox-binman-ecdsa384.dts | 24 +
.../tests/vboot/sandbox-binman-ecdsa521.dts | 24 +
...pss.dts => sandbox-binman-rsa2048-pss.dts} | 0
...-binman.dts => sandbox-binman-rsa2048.dts} | 0
.../vboot/sandbox-u-boot-global-ecdsa256.dts | 27 ++
.../vboot/sandbox-u-boot-global-ecdsa384.dts | 27 ++
.../vboot/sandbox-u-boot-global-ecdsa521.dts | 27 ++
... => sandbox-u-boot-global-rsa2048-pss.dts} | 0
....dts => sandbox-u-boot-global-rsa2048.dts} | 0
....its => sign-configs-sha1-rsa2048-pss.its} | 0
...sha1.its => sign-configs-sha1-rsa2048.its} | 0
.../vboot/sign-configs-sha256-ecdsa256.its | 44 ++
.../vboot/sign-configs-sha256-ecdsa384.its | 44 ++
.../vboot/sign-configs-sha256-ecdsa521.its | 44 ++
... sign-configs-sha256-rsa2048-pss-prod.its} | 0
...ts => sign-configs-sha256-rsa2048-pss.its} | 0
...56.its => sign-configs-sha256-rsa2048.its} | 0
...84.its => sign-configs-sha384-rsa3072.its} | 0
...s.its => sign-images-sha1-rsa2048-pss.its} | 0
...-sha1.its => sign-images-sha1-rsa2048.its} | 0
.../vboot/sign-images-sha256-ecdsa256.its | 42 ++
.../vboot/sign-images-sha256-ecdsa384.its | 42 ++
.../vboot/sign-images-sha256-ecdsa521.its | 42 ++
...its => sign-images-sha256-rsa2048-pss.its} | 0
...256.its => sign-images-sha256-rsa2048.its} | 0
...384.its => sign-images-sha384-rsa3072.its} | 0
tools/binman/etype/pre_load.py | 78 ++-
tools/binman/ftest.py | 50 ++
tools/binman/test/ecdsa521.pem | 7 +
tools/binman/test/security/pre_load_ecdsa.dts | 22 +
.../security/pre_load_ecdsa_invalid_algo.dts | 22 +
.../security/pre_load_ecdsa_invalid_key.dts | 22 +
.../security/pre_load_ecdsa_invalid_sha.dts | 22 +
tools/image-host.c | 93 +++-
tools/image-sig-host.c | 7 +
tools/preload_check_sign.c | 30 ++
57 files changed, 1892 insertions(+), 150 deletions(-)
create mode 100644 drivers/crypto/ecdsa/Makefile
create mode 100644 drivers/crypto/ecdsa/ecdsa-sw.c
create mode 100644 include/crypto/internal/ecdsa.h
create mode 100644 lib/mbedtls/ecdsa.c
create mode 100644 test/lib/ecdsa.c
create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa256.dts
create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa384.dts
create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa521.dts
rename test/py/tests/vboot/{sandbox-binman-pss.dts =>
sandbox-binman-rsa2048-pss.dts} (100%)
rename test/py/tests/vboot/{sandbox-binman.dts => sandbox-binman-rsa2048.dts}
(100%)
create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa256.dts
create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa384.dts
create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa521.dts
rename test/py/tests/vboot/{sandbox-u-boot-global-pss.dts =>
sandbox-u-boot-global-rsa2048-pss.dts} (100%)
rename test/py/tests/vboot/{sandbox-u-boot-global.dts =>
sandbox-u-boot-global-rsa2048.dts} (100%)
rename test/py/tests/vboot/{sign-configs-sha1-pss.its =>
sign-configs-sha1-rsa2048-pss.its} (100%)
rename test/py/tests/vboot/{sign-configs-sha1.its =>
sign-configs-sha1-rsa2048.its} (100%)
create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa256.its
create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa384.its
create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa521.its
rename test/py/tests/vboot/{sign-configs-sha256-pss-prod.its =>
sign-configs-sha256-rsa2048-pss-prod.its} (100%)
rename test/py/tests/vboot/{sign-configs-sha256-pss.its =>
sign-configs-sha256-rsa2048-pss.its} (100%)
rename test/py/tests/vboot/{sign-configs-sha256.its =>
sign-configs-sha256-rsa2048.its} (100%)
rename test/py/tests/vboot/{sign-configs-sha384.its =>
sign-configs-sha384-rsa3072.its} (100%)
rename test/py/tests/vboot/{sign-images-sha1-pss.its =>
sign-images-sha1-rsa2048-pss.its} (100%)
rename test/py/tests/vboot/{sign-images-sha1.its =>
sign-images-sha1-rsa2048.its} (100%)
create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa256.its
create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa384.its
create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa521.its
rename test/py/tests/vboot/{sign-images-sha256-pss.its =>
sign-images-sha256-rsa2048-pss.its} (100%)
rename test/py/tests/vboot/{sign-images-sha256.its =>
sign-images-sha256-rsa2048.its} (100%)
rename test/py/tests/vboot/{sign-images-sha384.its =>
sign-images-sha384-rsa3072.its} (100%)
create mode 100644 tools/binman/test/ecdsa521.pem
create mode 100644 tools/binman/test/security/pre_load_ecdsa.dts
create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_algo.dts
create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_key.dts
create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_sha.dts
-- This message and any attachments herein are, unless otherwise stated,
confidential, intended solely for the addressees and are SoftAtHome’s
ownership. Any unauthorized use, reproduction or dissemination is prohibited
unless formaly agreed beforehand by the sender. If you are not the intended
addressee of this message, please immediately delete it and all its attachments
from your computer system and notify the sender. SoftAtHome reserves the right
to monitor all email communications through its networks. Any views or opinions
presented are solely those of its author and do not necessarily represent those
of SoftAtHome. The internet cannot guarantee the integrity of this message.
SoftAtHome not shall be liable for the message if altered, changed or
falsified. While we take all reasonable precautions to ensure that viruses are
not transmitted via emails, we recommend that you take your own measures to
prevent viruses from entering your computer system. SoftAtHome is a French
Société Anonyme with a Board of Directors, having a capital of 6 450 699 Euros
having its registered office located at 9-11 rue du débarcadère – 92700 –
Colombes – France – Tel + 33 (0)1 57 66 88 88 – Fax + 33 (0)1 57 66 88 89 - RCS
Nanterre B 500 440 813 – Intra-Community VAT: FR 04500440813 -- Ce message et
toutes les pièces jointes qui y sont incluses sont, sauf indication contraire,
confidentiels, destinés uniquement aux destinataires et sont la propriété de
SoftAtHome. Toute utilisation non autorisée, reproduction ou diffusion est
interdite, sauf accord formel préalable de l'expéditeur. Si vous n'êtes pas le
destinataire prévu de ce message, veuillez le supprimer immédiatement ainsi que
toutes ses pièces jointes de votre système informatique et en informer
l'expéditeur. SoftAtHome se réserve le droit de surveiller toutes les
communications par e-mail via ses réseaux. Les opinions exprimées dans ce
message sont celles de leur auteur et ne représentent pas nécessairement celles
de SoftAtHome. L’Internet ne permettant pas d’assurer l’intégrité de ce
message, SoftAtHome décline toute responsabilité à ce titre, dans l’hypothèse
où il aurait été altéré, déformé ou falsifié. Par ailleurs et malgré toutes les
précautions prises pour éviter la présence de virus dans nos envois, nous vous
recommandons de prendre, de votre côté, les mesures permettant d'assurer la
non-introduction de virus dans votre système informatique. SoftAtHome est une
Société Anonyme française à Conseil d’Administration ayant un capital de 6 450
699 euros, dont le siège social est situé au 9-11 rue du débarcadère - 92700 -
Colombes - France - Tel + 33 (0)1 57 66 88 88 - Fax + 33 (0)1 57 66 88 89 RCS
Nanterre B 500 440 813 - TVA intracommunautaire : FR 04500440813
