Hi Raymond,
Do you think that this serie may by merged please ?
Regards,
Philippe
Le 04/09/2026 à 10:37, Philippe Reynes a écrit :
This series adds the support of ecdsa with software
using mbedtls. So boards without ecdsa hardware may
also use signature with ecdsa.
To achieve this goal, several changes are done:
- fix the support of secp521r1
- enable support of ecdsa in mbedtls
- add software ecdsa signature check using mbedtls
- add support of ecdsa for internal fit signature
- add test for ecdsa for internal fit signature in vboot
- add support of ecdsa for pre-load signature
- add test for ecdsa for pre-load signature in vboot
- enable software ecdsa signature check in sandbox
To test this new feature, just follow those steps:
0) build u-boot using sandbox_defconfig and adding those options:
CONFIG_ECDSA_MBEDTLS=y
CONFIG_ECDSA_VERIFY_MBEDTLS=y
CONFIG_ECDSA=y
CONFIG_ECDSA_VERIFY=y
1) add a signature node to an its file
signature-256 {
algo = "sha256,ecdsa256";
key-name-hint = "private-key-256";
};
2) generate an ecdsa key
openssl ecparam -name prime256v1 -genkey -noout -out private-key-256.pem
3) create the itb file
./tools/mkimage -f <file.its> -k . -K arch/sandbox/dts/test.dtb <file.itb>
4) launch sandbox u-boot
./u-boot -d arch/sandbox/dts/test.dtb
5) on sandbox u-boot prompt, load the itb and launch bootm on it
=> host load hostfs - 1000000 uboot-ecdsa.itb
4628674 bytes read in 1 ms (4.3 GiB/s)
=> bootm 1000000
...
...
Verifying Hash Integrity ... sha256,ecdsa256:private-key-256+ OK
Changes in v2:
- move ECDSA_MBEDTLS to MBEDTLS_LIB_X509
- rename lib/mbedtls/sw_ecdsa.c to lib/mbedtls/ecdsa.c
- enhance dependencies for ECDSA_MBEDTLS
- fix support of ecdsa521/secp521r1
- add vboot test using ecdsa
Changes in v3:
- do not use _MBEDTLS in mbedtls_def_config.h
- check returns and remove mem leak in lib/mbedtls/ecdsa.c
- remove useless field *k in struct ecdsa_test_vector_s
- check returns in test/lib/ecdsa.c
- fix third parameter when calling sha*_csum_wd()
- add support of ecdsa in pre-load header
Changes in v4:
- change some dependencies to enable ecc
- use ECDSA_MBEDTLS to build the ecdsa driver
- support ecdsa521 and secp521r1
- add a test calling ecdsa_verify for the ecdsa class
- merge patch 10 and 11 (support ecdsa pre-load for binman and tests)
- several code cleanup
Change in v5:
- fix ecdsa 521 in the first patch (instead of the 5th patch)
- mbedtls: ecdsa is only compiled when ECDSA_MBEDTLS is enabled
- fit_image_setup_sig: required_keynode is initiazed to -1 instead of 0
- avoid hardcoded value for ecdsa sig and point size
- check pointer before using them
- free ecdsa keys when key are not found/used
Change in v6:
- fix dependencies for ecdsa
- ecdsa is no more mandatory for tls
- remove include u-boot/ecdsa.h in ecdsa-sw.c
- do not use fdt_stderror with -1
-
Change in v7:
- change uint8_t to u8 in test/dm/ecdsa.c
- change info->required_keynode >= 0 in lib/ecdsa/ecdsa-verify.c
- set required_keynode to -1 in test/dm/ecdsa.c
Change in v8:
- check exact size of data read in dtb in function fdt_get_key
- enhance commit message to explain patch 2 (enable ecc)
- no longer use macro CHECK with goto inside macro
- some code cleanup
Change in v9:
- rebase on next
- update cover letter
Change in v10:
- remove empty line at the end of ecdsa-sw.c
Philippe Reynes (15):
ecdsa: fix support of secp521r1
mbedtls: enable support of ecc
ecdsa: initial support of ecdsa using mbedtls
test: lib: ecdsa: add initial test
drivers: crypto: add software ecdsa support
test: dm: ecdsa.c: clean this test as software ecdsa is now
implemented
test: py: vboot: prepare integration test for ecdsa
test: vboot: add test for ecdsa
tools: fit_image_setup_sig: set required_keynode to -1
tools: mkimage: pre-load: add support of ecdsa
tools: binman: pre-load: add support of ecdsa
boot: pre-load: add support of ecdsa
tools: preload_check_sign: add support of ecdsa
test: py: vboot: prepare test for global signature with ecdsa
test: py: vboot: add test for global signature with ecdsa
boot/image-pre-load.c | 53 +-
configs/sandbox_defconfig | 2 +
drivers/crypto/Makefile | 1 +
drivers/crypto/ecdsa/Makefile | 6 +
drivers/crypto/ecdsa/ecdsa-sw.c | 31 ++
include/crypto/ecdsa-uclass.h | 15 +-
include/crypto/internal/ecdsa.h | 39 ++
lib/ecdsa/Kconfig | 1 +
lib/ecdsa/ecdsa-libcrypto.c | 104 +++-
lib/ecdsa/ecdsa-verify.c | 73 ++-
lib/fdt-libcrypto.c | 2 +-
lib/mbedtls/Kconfig | 24 +
lib/mbedtls/Makefile | 20 +-
lib/mbedtls/ecdsa.c | 152 ++++++
lib/mbedtls/mbedtls_def_config.h | 41 +-
test/dm/ecdsa.c | 107 +++-
test/lib/Makefile | 1 +
test/lib/ecdsa.c | 456 ++++++++++++++++++
test/py/tests/test_fit_ecdsa.py | 2 +-
test/py/tests/test_vboot.py | 148 +++---
.../tests/vboot/sandbox-binman-ecdsa256.dts | 24 +
.../tests/vboot/sandbox-binman-ecdsa384.dts | 24 +
.../tests/vboot/sandbox-binman-ecdsa521.dts | 24 +
...pss.dts => sandbox-binman-rsa2048-pss.dts} | 0
...-binman.dts => sandbox-binman-rsa2048.dts} | 0
.../vboot/sandbox-u-boot-global-ecdsa256.dts | 27 ++
.../vboot/sandbox-u-boot-global-ecdsa384.dts | 27 ++
.../vboot/sandbox-u-boot-global-ecdsa521.dts | 27 ++
... => sandbox-u-boot-global-rsa2048-pss.dts} | 0
....dts => sandbox-u-boot-global-rsa2048.dts} | 0
....its => sign-configs-sha1-rsa2048-pss.its} | 0
...sha1.its => sign-configs-sha1-rsa2048.its} | 0
.../vboot/sign-configs-sha256-ecdsa256.its | 44 ++
.../vboot/sign-configs-sha256-ecdsa384.its | 44 ++
.../vboot/sign-configs-sha256-ecdsa521.its | 44 ++
... sign-configs-sha256-rsa2048-pss-prod.its} | 0
...ts => sign-configs-sha256-rsa2048-pss.its} | 0
...56.its => sign-configs-sha256-rsa2048.its} | 0
...84.its => sign-configs-sha384-rsa3072.its} | 0
...s.its => sign-images-sha1-rsa2048-pss.its} | 0
...-sha1.its => sign-images-sha1-rsa2048.its} | 0
.../vboot/sign-images-sha256-ecdsa256.its | 42 ++
.../vboot/sign-images-sha256-ecdsa384.its | 42 ++
.../vboot/sign-images-sha256-ecdsa521.its | 42 ++
...its => sign-images-sha256-rsa2048-pss.its} | 0
...256.its => sign-images-sha256-rsa2048.its} | 0
...384.its => sign-images-sha384-rsa3072.its} | 0
tools/binman/etype/pre_load.py | 78 ++-
tools/binman/ftest.py | 50 ++
tools/binman/test/ecdsa521.pem | 7 +
tools/binman/test/security/pre_load_ecdsa.dts | 22 +
.../security/pre_load_ecdsa_invalid_algo.dts | 22 +
.../security/pre_load_ecdsa_invalid_key.dts | 22 +
.../security/pre_load_ecdsa_invalid_sha.dts | 22 +
tools/image-host.c | 93 +++-
tools/image-sig-host.c | 7 +
tools/preload_check_sign.c | 30 ++
57 files changed, 1892 insertions(+), 150 deletions(-)
create mode 100644 drivers/crypto/ecdsa/Makefile
create mode 100644 drivers/crypto/ecdsa/ecdsa-sw.c
create mode 100644 include/crypto/internal/ecdsa.h
create mode 100644 lib/mbedtls/ecdsa.c
create mode 100644 test/lib/ecdsa.c
create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa256.dts
create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa384.dts
create mode 100644 test/py/tests/vboot/sandbox-binman-ecdsa521.dts
rename test/py/tests/vboot/{sandbox-binman-pss.dts =>
sandbox-binman-rsa2048-pss.dts} (100%)
rename test/py/tests/vboot/{sandbox-binman.dts => sandbox-binman-rsa2048.dts}
(100%)
create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa256.dts
create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa384.dts
create mode 100644 test/py/tests/vboot/sandbox-u-boot-global-ecdsa521.dts
rename test/py/tests/vboot/{sandbox-u-boot-global-pss.dts =>
sandbox-u-boot-global-rsa2048-pss.dts} (100%)
rename test/py/tests/vboot/{sandbox-u-boot-global.dts =>
sandbox-u-boot-global-rsa2048.dts} (100%)
rename test/py/tests/vboot/{sign-configs-sha1-pss.its =>
sign-configs-sha1-rsa2048-pss.its} (100%)
rename test/py/tests/vboot/{sign-configs-sha1.its =>
sign-configs-sha1-rsa2048.its} (100%)
create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa256.its
create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa384.its
create mode 100644 test/py/tests/vboot/sign-configs-sha256-ecdsa521.its
rename test/py/tests/vboot/{sign-configs-sha256-pss-prod.its =>
sign-configs-sha256-rsa2048-pss-prod.its} (100%)
rename test/py/tests/vboot/{sign-configs-sha256-pss.its =>
sign-configs-sha256-rsa2048-pss.its} (100%)
rename test/py/tests/vboot/{sign-configs-sha256.its =>
sign-configs-sha256-rsa2048.its} (100%)
rename test/py/tests/vboot/{sign-configs-sha384.its =>
sign-configs-sha384-rsa3072.its} (100%)
rename test/py/tests/vboot/{sign-images-sha1-pss.its =>
sign-images-sha1-rsa2048-pss.its} (100%)
rename test/py/tests/vboot/{sign-images-sha1.its =>
sign-images-sha1-rsa2048.its} (100%)
create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa256.its
create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa384.its
create mode 100644 test/py/tests/vboot/sign-images-sha256-ecdsa521.its
rename test/py/tests/vboot/{sign-images-sha256-pss.its =>
sign-images-sha256-rsa2048-pss.its} (100%)
rename test/py/tests/vboot/{sign-images-sha256.its =>
sign-images-sha256-rsa2048.its} (100%)
rename test/py/tests/vboot/{sign-images-sha384.its =>
sign-images-sha384-rsa3072.its} (100%)
create mode 100644 tools/binman/test/ecdsa521.pem
create mode 100644 tools/binman/test/security/pre_load_ecdsa.dts
create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_algo.dts
create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_key.dts
create mode 100644 tools/binman/test/security/pre_load_ecdsa_invalid_sha.dts
