The pre-load entry type currently only supports signing with a key file on disk. This series lets it sign through a Hardware Security Module (HSM) using PKCS#11, so that the private key never has to leave the token.
The pkcs11_tool bintool gains a sign() method which drives pkcs11-tool (RSA with PKCS#1 v1.5 or PSS, and ECDSA). The pre-load entry selects the HSM with a single hsm-key property holding a PKCS#11 URI (RFC 7512), as is done for FIT signing, e.g.: hsm-key = "pkcs11:token=uboot-hsm;object=uboot-key"; The PKCS#11 library and the PIN are not stored in the devicetree. They are passed with -a pre-load-hsm-library and -a pre-load-hsm-pin (the PIN may also come from PKCS11_SIGN_PIN). The library can also be given by the module-path attribute of the URI. The functional tests use SoftHSM. Changes in v2: - Merge the unit tests into the pkcs11_tool patch and the functional tests into a single patch (5 patches become 4) - Replace the eight hsm-* devicetree properties with one hsm-key PKCS#11 URI - Keep the PIN and library path out of the devicetree - Pass the PIN to pkcs11-tool through the environment, not argv - Read the signature from an output file instead of stdout - Add ECDSA support, with a host-hash fallback for tokens such as SoftHSM - Split the integer division and key-name fixes into their own patch - Check the length of the returned signature - Extend the tests: PSS, ECDSA and many error paths yan wang (4): binman: bintool: Add PKCS#11 HSM signing support binman: pre_load: Validate file signing key binman: pre_load: Add HSM signing support to pre-load entry type binman: Add functional test for pre-load HSM signing tools/binman/bintool.py | 8 +- tools/binman/bintool_test.py | 497 ++++++++++++++++++ tools/binman/btool/pkcs11_tool.py | 339 +++++++++++- tools/binman/etype/pre_load.py | 238 ++++++++- tools/binman/ftest.py | 241 +++++++++ tools/binman/test/security/pre_load_hsm.dts | 21 + .../test/security/pre_load_hsm_ecdsa.dts | 21 + .../security/pre_load_hsm_invalid_algo.dts | 21 + .../security/pre_load_hsm_invalid_padding.dts | 22 + .../security/pre_load_hsm_invalid_sha.dts | 21 + .../security/pre_load_hsm_invalid_uri.dts | 21 + .../security/pre_load_hsm_module_path.dts | 21 + .../test/security/pre_load_hsm_sign.dts | 21 + .../test/security/pre_load_hsm_sign_pss.dts | 22 + .../security/pre_load_missing_key_name.dts | 20 + 15 files changed, 1520 insertions(+), 14 deletions(-) create mode 100644 tools/binman/test/security/pre_load_hsm.dts create mode 100644 tools/binman/test/security/pre_load_hsm_ecdsa.dts create mode 100644 tools/binman/test/security/pre_load_hsm_invalid_algo.dts create mode 100644 tools/binman/test/security/pre_load_hsm_invalid_padding.dts create mode 100644 tools/binman/test/security/pre_load_hsm_invalid_sha.dts create mode 100644 tools/binman/test/security/pre_load_hsm_invalid_uri.dts create mode 100644 tools/binman/test/security/pre_load_hsm_module_path.dts create mode 100644 tools/binman/test/security/pre_load_hsm_sign.dts create mode 100644 tools/binman/test/security/pre_load_hsm_sign_pss.dts create mode 100644 tools/binman/test/security/pre_load_missing_key_name.dts -- 2.43.0
