Skip to content

Commit 48743c2

Browse files
tomi-fonttomi-font
committed
[nrf noup] make changes needed for CONFIG_BOOT_SIGNATURE_TYPE_RSA
Make it work with TF-PSA-Crypto. This is not a proper way to go about it but MCUboot is so deep in legacy usage that we just make the least amount of adjustments, but the migration should be done properly by the MCUboot team to use only PSA Crypto and get rid of all the Mbed TLS stuff. Legacy SHA-256 and RSA is made available to MCUboot through CONFIG_MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS and other configuration options. With these changes MCUboot builds and links but functionality remains to be tested and confirmed (because for example `mbedtls_rsa_context` lost its `ver` field). Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
1 parent e63da7d commit 48743c2

12 files changed

Lines changed: 98 additions & 40 deletions

File tree

‎boot/bootutil/include/bootutil/crypto/aes_ctr.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
#include "bootutil/enc_key_public.h"
2323

2424
#if defined(MCUBOOT_USE_MBED_TLS)
25-
#include <mbedtls/aes.h>
25+
#include <mbedtls/private/aes.h>
2626
#define BOOT_ENC_BLOCK_SIZE (16)
2727
#endif /* MCUBOOT_USE_MBED_TLS */
2828

‎boot/bootutil/include/bootutil/crypto/aes_kw.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
#endif
1919

2020
#if defined(MCUBOOT_USE_MBED_TLS)
21-
#include <mbedtls/aes.h>
21+
#include <mbedtls/private/aes.h>
2222
#include <mbedtls/nist_kw.h>
2323
#endif /* MCUBOOT_USE_MBED_TLS */
2424

‎boot/bootutil/include/bootutil/crypto/common.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@
1010
/* The check below can be performed even for those cases
1111
* where MCUBOOT_USE_MBED_TLS has not been defined
1212
*/
13-
#include "mbedtls/version.h"
13+
// #include "mbedtls/version.h"
14+
#define MBEDTLS_VERSION_NUMBER 0x04010000
15+
1416
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
1517
#define MBEDTLS_CONTEXT_MEMBER(X) MBEDTLS_PRIVATE(X)
1618
#else

‎boot/bootutil/include/bootutil/crypto/mbedtls-compat-2.x.h‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/**
2+
* \file compat-2.x.h
3+
*
4+
* \brief Compatibility definitions
5+
*
6+
* \deprecated Use the new names directly instead
7+
*/
8+
/*
9+
* Copyright The Mbed TLS Contributors
10+
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
11+
*/
12+
13+
#if defined(MBEDTLS_DEPRECATED_WARNING)
14+
#warning "Including compat-2.x.h is deprecated"
15+
#endif
16+
17+
#ifndef MBEDTLS_COMPAT2X_H
18+
#define MBEDTLS_COMPAT2X_H
19+
20+
/*
21+
* Macros for renamed functions
22+
*/
23+
#define mbedtls_ctr_drbg_update_ret mbedtls_ctr_drbg_update
24+
#define mbedtls_hmac_drbg_update_ret mbedtls_hmac_drbg_update
25+
#define mbedtls_md5_starts_ret mbedtls_md5_starts
26+
#define mbedtls_md5_update_ret mbedtls_md5_update
27+
#define mbedtls_md5_finish_ret mbedtls_md5_finish
28+
#define mbedtls_md5_ret mbedtls_md5
29+
#define mbedtls_ripemd160_starts_ret mbedtls_ripemd160_starts
30+
#define mbedtls_ripemd160_update_ret mbedtls_ripemd160_update
31+
#define mbedtls_ripemd160_finish_ret mbedtls_ripemd160_finish
32+
#define mbedtls_ripemd160_ret mbedtls_ripemd160
33+
#define mbedtls_sha1_starts_ret mbedtls_sha1_starts
34+
#define mbedtls_sha1_update_ret mbedtls_sha1_update
35+
#define mbedtls_sha1_finish_ret mbedtls_sha1_finish
36+
#define mbedtls_sha1_ret mbedtls_sha1
37+
#define mbedtls_sha256_starts_ret mbedtls_sha256_starts
38+
#define mbedtls_sha256_update_ret mbedtls_sha256_update
39+
#define mbedtls_sha256_finish_ret mbedtls_sha256_finish
40+
#define mbedtls_sha256_ret mbedtls_sha256
41+
#define mbedtls_sha512_starts_ret mbedtls_sha512_starts
42+
#define mbedtls_sha512_update_ret mbedtls_sha512_update
43+
#define mbedtls_sha512_finish_ret mbedtls_sha512_finish
44+
#define mbedtls_sha512_ret mbedtls_sha512
45+
46+
#endif /* MBEDTLS_COMPAT2X_H */

‎boot/bootutil/include/bootutil/crypto/rsa.h‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,9 @@
4343

4444
#elif defined(MCUBOOT_USE_MBED_TLS)
4545

46-
#include "mbedtls/rsa.h"
47-
#include "mbedtls/version.h"
46+
#include "mbedtls/private/rsa.h"
4847
#if defined(BOOTUTIL_CRYPTO_RSA_CRYPT_ENABLED)
49-
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
5048
#include "rsa_alt_helpers.h"
51-
#else
52-
#include "mbedtls/rsa_internal.h"
53-
#endif
5449
#endif /* BOOTUTIL_CRYPTO_RSA_CRYPT_ENABLED */
5550
#include "mbedtls/asn1.h"
5651
#include "bootutil/crypto/common.h"
@@ -235,9 +230,7 @@ bootutil_rsa_parse_private_key(bootutil_rsa_context *ctx, uint8_t **p, uint8_t *
235230
}
236231

237232
/* Non-optional fields. */
238-
if ( /* version */
239-
mbedtls_asn1_get_int(p, end, &ctx->MBEDTLS_CONTEXT_MEMBER(ver)) != 0 ||
240-
/* public modulus */
233+
if ( /* public modulus */
241234
mbedtls_asn1_get_mpi(p, end, &ctx->MBEDTLS_CONTEXT_MEMBER(N)) != 0 ||
242235
/* public exponent */
243236
mbedtls_asn1_get_mpi(p, end, &ctx->MBEDTLS_CONTEXT_MEMBER(E)) != 0 ||
@@ -288,6 +281,31 @@ bootutil_rsa_parse_private_key(bootutil_rsa_context *ctx, uint8_t **p, uint8_t *
288281
#endif /* BOOTUTIL_CRYPTO_RSA_CRYPT_ENABLED */
289282

290283
#if defined(BOOTUTIL_CRYPTO_RSA_SIGN_ENABLED)
284+
285+
#include <mbedtls/private/error_common.h>
286+
287+
static int mbedtls_rsa_import(mbedtls_rsa_context *ctx,
288+
const mbedtls_mpi *N,
289+
const mbedtls_mpi *P, const mbedtls_mpi *Q,
290+
const mbedtls_mpi *D, const mbedtls_mpi *E)
291+
{
292+
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
293+
294+
if ((N != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(N), N)) != 0) ||
295+
(P != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(P), P)) != 0) ||
296+
(Q != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(Q), Q)) != 0) ||
297+
(D != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(D), D)) != 0) ||
298+
(E != NULL && (ret = mbedtls_mpi_copy(&ctx->MBEDTLS_CONTEXT_MEMBER(E), E)) != 0)) {
299+
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_RSA_BAD_INPUT_DATA, ret);
300+
}
301+
302+
if (N != NULL) {
303+
ctx->MBEDTLS_CONTEXT_MEMBER(len) = mbedtls_mpi_size(&ctx->MBEDTLS_CONTEXT_MEMBER(N));
304+
}
305+
306+
return 0;
307+
}
308+
291309
/*
292310
* Parse a RSA public key with format specified in RFC3447 A.1.1
293311
*/

‎boot/bootutil/include/bootutil/crypto/sha.h‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,10 @@
6060
#ifdef MCUBOOT_SHA512
6161
#include <mbedtls/sha512.h>
6262
#else
63-
#include <mbedtls/sha256.h>
63+
#include <mbedtls/private/sha256.h>
6464
#endif
6565

66-
#include <mbedtls/version.h>
67-
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
68-
#include <mbedtls/compat-2.x.h>
69-
#endif
66+
#include "mbedtls-compat-2.x.h"
7067

7168
#endif /* MCUBOOT_USE_MBED_TLS */
7269

‎boot/bootutil/zephyr/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ target_include_directories(MCUBOOT_BOOTUTIL INTERFACE
1313
)
1414

1515
zephyr_library_named(mcuboot_util)
16+
zephyr_library_link_libraries(mbedcrypto)
1617
zephyr_library_sources(
1718
../src/bootutil_public.c
1819
)

‎boot/zephyr/CMakeLists.txt‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -57,16 +57,12 @@ add_subdirectory(uuid)
5757
# Include the IronSide-based HW counters implementation
5858
add_subdirectory_ifdef(CONFIG_NRF_MCUBOOT_IRONSIDE_COUNTERS ironside_counters)
5959

60+
zephyr_library_link_libraries(mbedcrypto)
61+
6062
zephyr_library_include_directories(
6163
include
6264
)
6365

64-
if(DEFINED CONFIG_MBEDTLS)
65-
zephyr_library_include_directories(
66-
${ZEPHYR_MBEDTLS_MODULE_DIR}/include
67-
)
68-
endif()
69-
7066
# Zephyr port-specific sources.
7167
zephyr_library_sources(
7268
main.c

‎boot/zephyr/Kconfig‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -262,19 +262,21 @@ config BOOT_SIGNATURE_TYPE_NONE
262262
config BOOT_SIGNATURE_TYPE_RSA
263263
bool "RSA signatures"
264264
select BOOT_USE_MBEDTLS
265-
select MBEDTLS
266-
select MBEDTLS_ASN1_PARSE_C if MBEDTLS_BUILTIN
267-
select MBEDTLS_MD_C if MBEDTLS_BUILTIN
268-
select MBEDTLS_SHA256 if MBEDTLS_BUILTIN
269-
select MBEDTLS_RSA_C if MBEDTLS_BUILTIN
270-
select MBEDTLS_PKCS1_V15 if MBEDTLS_BUILTIN
271-
select MBEDTLS_PKCS1_V21 if MBEDTLS_BUILTIN
272-
select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED if MBEDTLS_BUILTIN
273-
select MBEDTLS_PLATFORM_NO_STD_FUNCTIONS if MBEDTLS_BUILTIN
274-
select MBEDTLS_PLATFORM_SNPRINTF_ALT if MBEDTLS_BUILTIN
265+
select PSA_CRYPTO
266+
select PSA_WANT_KEY_TYPE_AES
267+
select PSA_WANT_ALG_CTR
268+
select MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
269+
select MBEDTLS_ASN1_PARSE_C
270+
select MBEDTLS_MD_C
271+
select MBEDTLS_SHA256_C
272+
select MBEDTLS_RSA_C
273+
select MBEDTLS_PKCS1_V15
274+
select MBEDTLS_PKCS1_V21
275+
select MBEDTLS_KEY_EXCHANGE_RSA_ENABLED if NRF_SECURITY
276+
select MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
277+
select MBEDTLS_PLATFORM_SNPRINTF_ALT
275278
select BOOT_ENCRYPTION_SUPPORT
276279
select BOOT_IMG_HASH_ALG_SHA256_ALLOW
277-
select BOOT_AES_MBEDTLS_DEPENDENCIES if MBEDTLS_BUILTIN && BOOT_ENCRYPT_IMAGE
278280

279281
if BOOT_SIGNATURE_TYPE_RSA
280282
config BOOT_SIGNATURE_TYPE_RSA_LEN

‎ext/fiat/src/curve25519.c‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,6 @@
3535
#if defined(MCUBOOT_USE_MBED_TLS)
3636
#include <mbedtls/platform_util.h>
3737
#include <mbedtls/sha512.h>
38-
#include <mbedtls/version.h>
39-
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
40-
#include <mbedtls/compat-2.x.h>
41-
#endif
4238
#else
4339
#include <tinycrypt/constants.h>
4440
#include <tinycrypt/utils.h>

0 commit comments

Comments
 (0)