fix(espsecure): Allow verifying multiple appended ECDSA signatures

Harshal5 · Harshal5 · commit 9a207b1fd9ee · 2025-09-16T11:08:14.000+05:30
- Also extend espsecure's test coverage Closes #1120
diff --git a/espsecure/__init__.py b/espsecure/__init__.py
@@ -961,10 +961,7 @@ def verify_signature_v2(hsm: bool, hsm_config: IO | None, keyfile: IO, datafile:
 
     vk = _get_sbv2_pub_key(keyfile)
 
-    if isinstance(vk, rsa.RSAPublicKey):
-        SIG_BLOCK_MAX_COUNT = 3
-    elif isinstance(vk, ec.EllipticCurvePublicKey):
-        SIG_BLOCK_MAX_COUNT = 1
+    SIG_BLOCK_MAX_COUNT = 3
 
     image_content = datafile.read()
     if len(image_content) < SECTOR_SIZE or len(image_content) % SECTOR_SIZE != 0:
diff --git a/test/secure_images/bootloader_multi_signed_v2_ecdsa192.bin b/test/secure_images/bootloader_multi_signed_v2_ecdsa192.bin
diff --git a/test/secure_images/bootloader_multi_signed_v2_ecdsa256.bin b/test/secure_images/bootloader_multi_signed_v2_ecdsa256.bin
diff --git a/test/secure_images/bootloader_multi_signed_v2_ecdsa384.bin b/test/secure_images/bootloader_multi_signed_v2_ecdsa384.bin
diff --git a/test/secure_images/bootloader_multi_signed_v2_rsa.bin b/test/secure_images/bootloader_multi_signed_v2_rsa.bin
diff --git a/test/secure_images/ecdsa192_secure_boot_signing_key3.pem b/test/secure_images/ecdsa192_secure_boot_signing_key3.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MF8CAQEEGMNCl8ezjmYsLgClrXr11O4zcAJPOD5s46AKBggqhkjOPQMBAaE0AzIA
+BJ0AKQaLfGs+4KXlAWkzmKj6e5S5LC4Vso1Nci6kserCSI3E7aMVZFBFVq+DDmpq
+NA==
+-----END EC PRIVATE KEY-----
diff --git a/test/secure_images/ecdsa192_secure_boot_signing_key4.pem b/test/secure_images/ecdsa192_secure_boot_signing_key4.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MF8CAQEEGGn2EFibrTQ6K5txb+qsxnmxY1+yfpMzj6AKBggqhkjOPQMBAaE0AzIA
+BK+3nF0EbI8U0HBwuuWMTyGDmJbZEeFA4RKhZS1ilj9QsNrJpOHamUeLBfA4aUoQ
+iA==
+-----END EC PRIVATE KEY-----
diff --git a/test/secure_images/ecdsa192_secure_boot_signing_pubkey4.pem b/test/secure_images/ecdsa192_secure_boot_signing_pubkey4.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQEDMgAEr7ecXQRsjxTQcHC65YxPIYOYltkR
+4UDhEqFlLWKWP1Cw2smk4dqZR4sF8DhpShCI
+-----END PUBLIC KEY-----
diff --git a/test/secure_images/ecdsa256_secure_boot_signing_key3.pem b/test/secure_images/ecdsa256_secure_boot_signing_key3.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIFHb2ZMfsoHXdQ82DH7QGrSh4wAum3AIag7Djz6AnRIpoAoGCCqGSM49
+AwEHoUQDQgAERNsudNrhGfWCohrfa5G+nAMBQKsOzxGSBBEqt+134cLjAJ1ForgZ
+hHS8Q+cYsPclzWLnEX+nhQUwR0S8/j5Z7g==
+-----END EC PRIVATE KEY-----
diff --git a/test/secure_images/ecdsa256_secure_boot_signing_key4.pem b/test/secure_images/ecdsa256_secure_boot_signing_key4.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMxQzaSw+tTrzqKp6y4uKVaZ1HMifC7JzbOgbi7vyLqaoAoGCCqGSM49
+AwEHoUQDQgAEUqcYbO3Ag8ab8JDLCsmVVHTedB+KB+/Q8Q4frS7pvBjslHwWmumD
+Ca0enIGhfWRaQ1VePe6NP0ZKFB+n0DLyjQ==
+-----END EC PRIVATE KEY-----
diff --git a/test/secure_images/ecdsa256_secure_boot_signing_pubkey4.pem b/test/secure_images/ecdsa256_secure_boot_signing_pubkey4.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUqcYbO3Ag8ab8JDLCsmVVHTedB+K
+B+/Q8Q4frS7pvBjslHwWmumDCa0enIGhfWRaQ1VePe6NP0ZKFB+n0DLyjQ==
+-----END PUBLIC KEY-----
diff --git a/test/secure_images/ecdsa384_secure_boot_signing_key3.pem b/test/secure_images/ecdsa384_secure_boot_signing_key3.pem
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDBWixO+S3CRDiISIi9ogPqU4PdR4W1QHONz1zeLjHZ3UPWkw7T3Biiz
+iXgCCOaCvNegBwYFK4EEACKhZANiAAQr1cH6V7ljT3WtlZx95jOyVS2eeRCDI034
+J+avVnJwMjQvM+Y47xgHAMU1XyW04LJ2AEmgdq9o9819t14Q6GRvlZsWDNjaoeOb
+IJqc3gp5KRA+fCz2zyIDxRCzQRwp/DY=
+-----END EC PRIVATE KEY-----
diff --git a/test/secure_images/ecdsa384_secure_boot_signing_key4.pem b/test/secure_images/ecdsa384_secure_boot_signing_key4.pem
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDDc5Cwr4LxNWSwyuBFAOMUy8pq0IxslHwWDqb3mN8/O6mHxQxrdNkvb
+YXMY5rv5P9GgBwYFK4EEACKhZANiAAQEnTOqnLIHgA3vGopv0gOmn1CUH3DHPmqX
+2u1R5ri2oi2bvvk5RLlhrd6WeL36WBkw7WVsYZO1M7Hub2sCMHvuolHo6vVsK9/7
+qJzIcy4osu3b1tfGZ058xuPVt9epP9Y=
+-----END EC PRIVATE KEY-----
diff --git a/test/secure_images/ecdsa384_secure_boot_signing_pubkey4.pem b/test/secure_images/ecdsa384_secure_boot_signing_pubkey4.pem
@@ -0,0 +1,5 @@
+-----BEGIN PUBLIC KEY-----
+MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEBJ0zqpyyB4AN7xqKb9IDpp9QlB9wxz5q
+l9rtUea4tqItm775OUS5Ya3elni9+lgZMO1lbGGTtTOx7m9rAjB77qJR6Or1bCvf
++6icyHMuKLLt29bXxmdOfMbj1bfXqT/W
+-----END PUBLIC KEY-----
diff --git a/test/test_espsecure.py b/test/test_espsecure.py
@@ -178,12 +178,15 @@ def test_key_generation_v1(self):
             keyfile_name = os.path.join(keydir, "key.pem")
             self.run_espsecure(f"generate-signing-key --version 1 {keyfile_name}")
 
-    def test_key_generation_v2(self):
+    @pytest.mark.parametrize("scheme", ["rsa3072", "ecdsa192", "ecdsa256", "ecdsa384"])
+    def test_key_generation_v2(self, scheme):
         with tempfile.TemporaryDirectory() as keydir:
             # keyfile cannot exist before generation -> tempfile.NamedTemporaryFile()
             # cannot be used for keyfile
             keyfile_name = os.path.join(keydir, "key.pem")
-            self.run_espsecure(f"generate-signing-key --version 2 {keyfile_name}")
+            self.run_espsecure(
+                f"generate-signing-key --version 2 --scheme {scheme} {keyfile_name}"
+            )
 
     def _test_sign_v1_data(self, key_name):
         try:
@@ -265,43 +268,45 @@ def test_sign_v2_data(self, scheme):
             output_file.close()
             os.unlink(output_file.name)
 
-    def test_sign_v2_multiple_keys_cli(self):
+    @pytest.mark.parametrize("scheme", ["rsa", "ecdsa192", "ecdsa256", "ecdsa384"])
+    def test_sign_v2_multiple_keys_cli(self, scheme):
         keydir = os.path.join(TEST_DIR, "secure_images")
         with tempfile.NamedTemporaryFile(delete=False) as output_file:
             self.run_espsecure(
                 "sign-data --version 2 --keyfile "
-                f"{keydir}/rsa_secure_boot_signing_key.pem "
-                f"{keydir}/rsa_secure_boot_signing_key2.pem "
-                f"{keydir}/rsa_secure_boot_signing_key3.pem "
+                f"{keydir}/{scheme}_secure_boot_signing_key.pem "
+                f"{keydir}/{scheme}_secure_boot_signing_key2.pem "
+                f"{keydir}/{scheme}_secure_boot_signing_key3.pem "
                 f"--output {output_file.name} "
                 f"{keydir}/bootloader_unsigned_v2.bin"
             )
             self.run_espsecure(
                 "verify-signature --version 2 --keyfile "
-                f"{keydir}/rsa_secure_boot_signing_key.pem "
+                f"{keydir}/{scheme}_secure_boot_signing_key.pem "
                 f"{output_file.name}"
             )
             self.run_espsecure(
                 "verify-signature --version 2 --keyfile "
-                f"{keydir}/rsa_secure_boot_signing_key2.pem "
+                f"{keydir}/{scheme}_secure_boot_signing_key2.pem "
                 f"{output_file.name}"
             )
             self.run_espsecure(
                 "verify-signature --version 2 --keyfile "
-                f"{keydir}/rsa_secure_boot_signing_key3.pem "
+                f"{keydir}/{scheme}_secure_boot_signing_key3.pem "
                 f"{output_file.name}"
             )
 
-    def test_sign_v2_multiple_keys(self):
+    @pytest.mark.parametrize("scheme", ["rsa", "ecdsa192", "ecdsa256", "ecdsa384"])
+    def test_sign_v2_multiple_keys(self, scheme):
         # 3 keys + Verify with 3rd key
         try:
             output_file = tempfile.NamedTemporaryFile(delete=False)
             espsecure.sign_data(
                 "2",
                 [
-                    self._open("rsa_secure_boot_signing_key.pem"),
-                    self._open("rsa_secure_boot_signing_key2.pem"),
-                    self._open("rsa_secure_boot_signing_key3.pem"),
+                    self._open(f"{scheme}_secure_boot_signing_key.pem"),
+                    self._open(f"{scheme}_secure_boot_signing_key2.pem"),
+                    self._open(f"{scheme}_secure_boot_signing_key3.pem"),
                 ],
                 output_file.name,
                 False,
@@ -316,7 +321,7 @@ def test_sign_v2_multiple_keys(self):
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key3.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key3.pem"),
                 output_file,
             )
 
@@ -325,7 +330,7 @@ def test_sign_v2_multiple_keys(self):
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key2.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key2.pem"),
                 output_file,
             )
 
@@ -334,14 +339,15 @@ def test_sign_v2_multiple_keys(self):
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key.pem"),
                 output_file,
             )
         finally:
             output_file.close()
             os.unlink(output_file.name)
 
-    def test_sign_v2_append_signatures(self):
+    @pytest.mark.parametrize("scheme", ["rsa", "ecdsa192", "ecdsa256", "ecdsa384"])
+    def test_sign_v2_append_signatures(self, scheme):
         # Append signatures + Verify with an appended key
         # (bootloader_signed_v2_rsa.bin already signed with
         # rsa_secure_boot_signing_key.pem)
@@ -350,23 +356,23 @@ def test_sign_v2_append_signatures(self):
             espsecure.sign_data(
                 "2",
                 [
-                    self._open("rsa_secure_boot_signing_key2.pem"),
-                    self._open("rsa_secure_boot_signing_key3.pem"),
+                    self._open(f"{scheme}_secure_boot_signing_key2.pem"),
+                    self._open(f"{scheme}_secure_boot_signing_key3.pem"),
                 ],
                 output_file.name,
                 True,
                 False,
                 None,
                 None,
                 None,
-                self._open("bootloader_signed_v2_rsa.bin"),
+                self._open(f"bootloader_signed_v2_{scheme}.bin"),
             )
 
             espsecure.verify_signature(
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key.pem"),
                 output_file,
             )
 
@@ -375,7 +381,7 @@ def test_sign_v2_append_signatures(self):
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key2.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key2.pem"),
                 output_file,
             )
 
@@ -384,33 +390,34 @@ def test_sign_v2_append_signatures(self):
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key3.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key3.pem"),
                 output_file,
             )
         finally:
             output_file.close()
             os.unlink(output_file.name)
 
-    def test_sign_v2_append_signatures_multiple_steps(self):
+    @pytest.mark.parametrize("scheme", ["rsa", "ecdsa192", "ecdsa256", "ecdsa384"])
+    def test_sign_v2_append_signatures_multiple_steps(self, scheme):
         # similar to previous test, but sign in two invocations
         try:
             output_file1 = tempfile.NamedTemporaryFile(delete=False)
             output_file2 = tempfile.NamedTemporaryFile(delete=False)
             espsecure.sign_data(
                 "2",
-                [self._open("rsa_secure_boot_signing_key2.pem")],
+                [self._open(f"{scheme}_secure_boot_signing_key2.pem")],
                 output_file1.name,
                 True,
                 False,
                 None,
                 None,
                 None,
-                self._open("bootloader_signed_v2_rsa.bin"),
+                self._open(f"bootloader_signed_v2_{scheme}.bin"),
             )
 
             espsecure.sign_data(
                 "2",
-                [self._open("rsa_secure_boot_signing_key3.pem")],
+                [self._open(f"{scheme}_secure_boot_signing_key3.pem")],
                 output_file2.name,
                 True,
                 False,
@@ -424,7 +431,7 @@ def test_sign_v2_append_signatures_multiple_steps(self):
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key.pem"),
                 output_file2,
             )
 
@@ -433,7 +440,7 @@ def test_sign_v2_append_signatures_multiple_steps(self):
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key2.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key2.pem"),
                 output_file2,
             )
 
@@ -442,7 +449,7 @@ def test_sign_v2_append_signatures_multiple_steps(self):
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key3.pem"),
+                self._open(f"{scheme}_secure_boot_signing_key3.pem"),
                 output_file2,
             )
         finally:
@@ -477,17 +484,18 @@ def test_sign_v2_with_pre_calculated_signature(self, scheme):
             output_file.close()
             os.unlink(output_file.name)
 
-    def test_sign_v2_with_multiple_pre_calculated_signatures(self):
+    @pytest.mark.parametrize("scheme", ["rsa", "ecdsa192", "ecdsa256", "ecdsa384"])
+    def test_sign_v2_with_multiple_pre_calculated_signatures(self, scheme):
         # Sign using multiple pre-calculated signatures + Verify
         signing_pubkeys = [
-            "rsa_secure_boot_signing_pubkey.pem",
-            "rsa_secure_boot_signing_pubkey.pem",
-            "rsa_secure_boot_signing_pubkey.pem",
+            f"{scheme}_secure_boot_signing_pubkey.pem",
+            f"{scheme}_secure_boot_signing_pubkey.pem",
+            f"{scheme}_secure_boot_signing_pubkey.pem",
         ]
         pre_calculated_signatures = [
-            "pre_calculated_bootloader_signature_rsa.bin",
-            "pre_calculated_bootloader_signature_rsa.bin",
-            "pre_calculated_bootloader_signature_rsa.bin",
+            f"pre_calculated_bootloader_signature_{scheme}.bin",
+            f"pre_calculated_bootloader_signature_{scheme}.bin",
+            f"pre_calculated_bootloader_signature_{scheme}.bin",
         ]
         try:
             output_file = tempfile.NamedTemporaryFile(delete=False)
@@ -588,14 +596,15 @@ def test_verify_signature_wrong_scheme(self):
             )
         assert "Invalid datafile" in str(cm.value)
 
-    def test_verify_signature_multi_signed_wrong_key(self):
+    @pytest.mark.parametrize("scheme", ["rsa", "ecdsa192", "ecdsa256", "ecdsa384"])
+    def test_verify_signature_multi_signed_wrong_key(self, scheme):
         with pytest.raises(esptool.FatalError) as cm:
             espsecure.verify_signature(
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_key4.pem"),
-                self._open("bootloader_multi_signed_v2.bin"),
+                self._open(f"{scheme}_secure_boot_signing_key4.pem"),
+                self._open(f"bootloader_multi_signed_v2_{scheme}.bin"),
             )
         assert "Signature could not be verified with the provided key." in str(cm.value)
 
@@ -654,14 +663,15 @@ def test_verify_signature_wrong_pubkey_v2(self, scheme):
             )
         assert "Signature could not be verified with the provided key." in str(cm.value)
 
-    def test_verify_signature_multi_signed_wrong_pubkey(self):
+    @pytest.mark.parametrize("scheme", ["rsa", "ecdsa192", "ecdsa256", "ecdsa384"])
+    def test_verify_signature_multi_signed_wrong_pubkey(self, scheme):
         with pytest.raises(esptool.FatalError) as cm:
             espsecure.verify_signature(
                 "2",
                 False,
                 None,
-                self._open("rsa_secure_boot_signing_pubkey4.pem"),
-                self._open("bootloader_multi_signed_v2.bin"),
+                self._open(f"{scheme}_secure_boot_signing_pubkey4.pem"),
+                self._open(f"bootloader_multi_signed_v2_{scheme}.bin"),
             )
         assert "Signature could not be verified with the provided key." in str(cm.value)
 
