Skip to content

Commit 5dc56cb

Browse files
adsz-nordicadsz-nordic
committed
Initial experiments
Signed-off-by: Adam Szczygieł <adam.szczygiel@nordicsemi.no>
1 parent 0bf6ef9 commit 5dc56cb

5 files changed

Lines changed: 131 additions & 6 deletions

File tree

‎boot/bootutil/include/bootutil/crypto/ecdsa.h‎

Lines changed: 62 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,9 @@
3535
#if (defined(MCUBOOT_USE_TINYCRYPT) + \
3636
defined(MCUBOOT_USE_CC310) + \
3737
defined(MCUBOOT_USE_NRF_EXTERNAL_CRYPTO) + \
38-
defined(MCUBOOT_USE_PSA_OR_MBED_TLS)) != 1
39-
#error "One crypto backend must be defined: either CC310/TINYCRYPT/MBED_TLS/PSA_CRYPTO"
38+
defined(MCUBOOT_USE_PSA_OR_MBED_TLS) + \
39+
defined(MCUBOOT_USE_NRF_OBERON)) != 1
40+
#error "One crypto backend must be defined: either CC310/TINYCRYPT/MBED_TLS/PSA_CRYPTO/NRF_OBERON"
4041
#endif
4142

4243
#if defined(MCUBOOT_USE_TINYCRYPT)
@@ -58,8 +59,13 @@
5859
#define MCUBOOT_ECDSA_NEED_ASN1_SIG
5960
#endif /* MCUBOOT_USE_MBED_TLS */
6061

62+
#if defined(MCUBOOT_USE_NRF_OBERON)
63+
#include <ocrypto_ecdsa_p256.h>
64+
#endif /* MCUBOOT_USE_NRF_OBERON */
65+
6166
/*TODO: remove this after cypress port mbedtls to abstract crypto api */
62-
#if defined(MCUBOOT_USE_CC310) || defined(MCUBOOT_USE_MBED_TLS)
67+
#if defined(MCUBOOT_USE_CC310) || defined(MCUBOOT_USE_MBED_TLS) || \
68+
defined(MCUBOOT_USE_NRF_OBERON)
6369
#define NUM_ECC_BYTES (256 / 8)
6470
#endif
6571

@@ -83,7 +89,8 @@ extern "C" {
8389
#endif
8490

8591
#if (defined(MCUBOOT_USE_TINYCRYPT) || defined(MCUBOOT_USE_MBED_TLS) || \
86-
defined(MCUBOOT_USE_CC310) || defined(MCUBOOT_USE_NRF_EXTERNAL_CRYPTO)) \
92+
defined(MCUBOOT_USE_CC310) || defined(MCUBOOT_USE_NRF_EXTERNAL_CRYPTO) || \
93+
defined(MCUBOOT_USE_NRF_OBERON)) \
8794
&& !defined(MCUBOOT_USE_PSA_CRYPTO)
8895
/*
8996
* Declaring these like this adds NULL termination.
@@ -719,6 +726,57 @@ static inline int bootutil_ecdsa_parse_public_key(bootutil_ecdsa_context *ctx,
719726
}
720727
#endif /* MCUBOOT_USE_NRF_EXTERNAL_CRYPTO */
721728

729+
#if defined(MCUBOOT_USE_NRF_OBERON)
730+
#define UNCOMPRESSED_KEY_PREFIX 0x04
731+
732+
typedef uintptr_t bootutil_ecdsa_context;
733+
734+
static inline void bootutil_ecdsa_init(bootutil_ecdsa_context *ctx)
735+
{
736+
(void)ctx;
737+
}
738+
739+
static inline void bootutil_ecdsa_drop(bootutil_ecdsa_context *ctx)
740+
{
741+
(void)ctx;
742+
}
743+
744+
static inline int bootutil_ecdsa_verify(bootutil_ecdsa_context *ctx,
745+
uint8_t *pk, size_t pk_len,
746+
uint8_t *hash, size_t hash_len,
747+
uint8_t *sig, size_t sig_len)
748+
{
749+
if (pk == NULL || hash == NULL || sig == NULL) {
750+
return -1;
751+
}
752+
753+
uint8_t signature[2 * NUM_ECC_BYTES];
754+
int rc = bootutil_decode_sig(signature, sig, sig + sig_len);
755+
if (rc) {
756+
return rc;
757+
}
758+
759+
/* Support only uncompressed keys */
760+
if (pk[0] != UNCOMPRESSED_KEY_PREFIX) {
761+
return -2;
762+
}
763+
764+
/* Skip the first byte holding key format */
765+
pk++;
766+
767+
return ocrypto_ecdsa_p256_verify_hash(signature, hash, pk);
768+
}
769+
770+
static inline int bootutil_ecdsa_parse_public_key(bootutil_ecdsa_context *ctx,
771+
uint8_t **cp, uint8_t *end)
772+
{
773+
(void)ctx;
774+
775+
return bootutil_import_key(cp, end);
776+
}
777+
778+
#endif /* MCUBOOT_USE_NRF_OBERON */
779+
722780
#ifdef __cplusplus
723781
}
724782
#endif

‎boot/bootutil/include/bootutil/crypto/sha.h‎

Lines changed: 52 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,9 @@
3131
#if (defined(MCUBOOT_USE_PSA_OR_MBED_TLS) + \
3232
defined(MCUBOOT_USE_TINYCRYPT) + \
3333
defined(MCUBOOT_USE_NRF_EXTERNAL_CRYPTO) + \
34-
defined(MCUBOOT_USE_CC310)) != 1
35-
#error "One crypto backend must be defined: either CC310/MBED_TLS/TINYCRYPT/PSA_CRYPTO"
34+
defined(MCUBOOT_USE_CC310) + \
35+
defined(MCUBOOT_USE_NRF_OBERON)) != 1
36+
#error "One crypto backend must be defined: either CC310/MBED_TLS/TINYCRYPT/PSA_CRYPTO/NRF_OBERON"
3637
#endif
3738

3839
#if defined(MCUBOOT_SHA512)
@@ -84,6 +85,10 @@
8485

8586
#include <stdint.h>
8687

88+
#if defined(MCUBOOT_USE_NRF_OBERON)
89+
#include <ocrypto_sha256.h>
90+
#endif /* MCUBOOT_USE_NRF_OBERON */
91+
8792
#ifdef __cplusplus
8893
extern "C" {
8994
#endif
@@ -302,6 +307,51 @@ static inline int bootutil_sha_finish(bootutil_sha_context *ctx,
302307
}
303308
#endif /* MCUBOOT_USE_NRF_EXTERNAL_CRYPTO */
304309

310+
#if defined(MCUBOOT_USE_NRF_OBERON)
311+
typedef ocrypto_sha256_ctx bootutil_sha_context;
312+
313+
static inline int bootutil_sha_init(bootutil_sha_context *ctx)
314+
{
315+
if (ctx == NULL) {
316+
return -1;
317+
}
318+
319+
ocrypto_sha256_init(ctx);
320+
return 0;
321+
}
322+
323+
static inline int bootutil_sha_drop(bootutil_sha_context *ctx)
324+
{
325+
/* NOTE: No corresponding function for ocrypto_sha256 */
326+
(void)ctx;
327+
return 0;
328+
}
329+
330+
static inline int bootutil_sha_update(bootutil_sha_context *ctx,
331+
const void *data,
332+
uint32_t data_len)
333+
{
334+
if (ctx == NULL || data == NULL) {
335+
return -1;
336+
}
337+
338+
ocrypto_sha256_update(ctx, (const uint8_t *)data, (size_t)data_len);
339+
return 0;
340+
}
341+
342+
static inline int bootutil_sha_finish(bootutil_sha_context *ctx,
343+
uint8_t *output)
344+
{
345+
if (ctx == NULL || output == NULL) {
346+
return -1;
347+
}
348+
349+
ocrypto_sha256_final(ctx, output);
350+
return 0;
351+
}
352+
353+
#endif /* MCUBOOT_USE_NRF_OBERON */
354+
305355
#ifdef __cplusplus
306356
}
307357
#endif

‎boot/bootutil/zephyr/CMakeLists.txt‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ if(CONFIG_BOOT_USE_TINYCRYPT)
4848
)
4949
endif()
5050

51+
if(CONFIG_BOOT_USE_NRF_OBERON)
52+
target_include_directories(MCUBOOT_BOOTUTIL INTERFACE ${OBERON_BASE}/include)
53+
zephyr_link_libraries(nrfxlib_crypto)
54+
endif()
55+
5156
if(CONFIG_BOOT_USE_PSA_CRYPTO)
5257
target_include_directories(MCUBOOT_BOOTUTIL INTERFACE
5358
${ZEPHYR_MBEDTLS_MODULE_DIR}/include

‎boot/zephyr/Kconfig‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@ config BOOT_USE_CC310
5454
config BOOT_USE_NRF_CC310_BL
5555
bool
5656

57+
config BOOT_USE_NRF_OBERON
58+
bool
59+
default n
60+
help
61+
Use nrf oberon SW crypto.
62+
5763
config NRFXLIB_CRYPTO
5864
bool
5965

@@ -286,6 +292,10 @@ choice BOOT_ECDSA_IMPLEMENTATION
286292
default BOOT_ECDSA_PSA if NRF_SECURITY
287293
default BOOT_ECDSA_TINYCRYPT
288294

295+
config BOOT_ECDSA_NRF_OBERON
296+
bool "use nrf oberon SW crypto."
297+
select BOOT_USE_NRF_OBERON
298+
289299
config BOOT_ECDSA_TINYCRYPT
290300
bool "Use tinycrypt"
291301
select BOOT_USE_TINYCRYPT

‎boot/zephyr/include/mcuboot_config/mcuboot_config.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@
5151
#define MCUBOOT_USE_PSA_CRYPTO
5252
#elif defined(CONFIG_BOOT_USE_NRF_EXTERNAL_CRYPTO)
5353
#define MCUBOOT_USE_NRF_EXTERNAL_CRYPTO
54+
#elif defined(CONFIG_BOOT_USE_NRF_OBERON)
55+
#define MCUBOOT_USE_NRF_OBERON
5456
#endif
5557

5658
#ifdef CONFIG_BOOT_IMG_HASH_ALG_SHA512

0 commit comments

Comments
 (0)