Skip to content

Commit 5f6d62c

Browse files
de-nordicde-nordic
committed
[nrf noup] bootutil: Separate KMU implementation from ED25519
Move KMU specific implementation to dedicated unit. Signed-off-by: Dominik Ermel <[email protected]>
1 parent 9e03c89 commit 5f6d62c

File tree

2 files changed

+165
-147
lines changed

2 files changed

+165
-147
lines changed

‎boot/bootutil/src/ed25519_psa.c‎

Lines changed: 0 additions & 147 deletions
Original file line numberDiff line numberDiff line change
@@ -13,58 +13,13 @@
1313
#include <psa/crypto.h>
1414
#include <psa/crypto_types.h>
1515
#include <zephyr/sys/util.h>
16-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
17-
#include <cracen_psa_kmu.h>
18-
#endif
1916

2017
BOOT_LOG_MODULE_REGISTER(ed25519_psa);
2118

2219
#define SHA512_DIGEST_LENGTH 64
2320
#define EDDSA_KEY_LENGTH 32
2421
#define EDDSA_SIGNAGURE_LENGTH 64
2522

26-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
27-
/* List of KMU stored key ids available for MCUboot */
28-
#define PSA_KEY_INDEX_SIZE 2
29-
30-
#if CONFIG_MCUBOOT_MCUBOOT_IMAGE_NUMBER != -1 || \
31-
defined(CONFIG_NCS_BOOT_SIGNATURE_KMU_UROT_MAPPING)
32-
#define PSA_KEY_STARTING_ID 226
33-
#else
34-
#define PSA_KEY_STARTING_ID 242
35-
#endif
36-
37-
#define MAKE_PSA_KMU_KEY_ID(id) PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT(CRACEN_KMU_KEY_USAGE_SCHEME_RAW, id)
38-
static psa_key_id_t key_ids[] = {
39-
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID),
40-
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID + PSA_KEY_INDEX_SIZE),
41-
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID + (2 * PSA_KEY_INDEX_SIZE))
42-
};
43-
44-
#define KEY_SLOTS_COUNT CONFIG_BOOT_SIGNATURE_KMU_SLOTS
45-
46-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
47-
#include <bootutil/key_revocation.h>
48-
#define VALIDATED_WITH_UNINITIALIZED INT32_MAX
49-
static int32_t validated_with = VALIDATED_WITH_UNINITIALIZED;
50-
#endif
51-
52-
BUILD_ASSERT(CONFIG_BOOT_SIGNATURE_KMU_SLOTS <= ARRAY_SIZE(key_ids),
53-
"Invalid number of KMU slots, up to 3 are supported on nRF54L15");
54-
#endif
55-
56-
#if defined(CONFIG_NCS_BOOT_SIGNATURE_USING_ITS)
57-
static const psa_key_id_t key_ids[] = {
58-
0x40022100,
59-
0x40022101,
60-
0x40022102,
61-
0x40022103
62-
};
63-
64-
#define KEY_SLOTS_COUNT ARRAY_SIZE(key_ids)
65-
#endif
66-
67-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU) && !defined(CONFIG_NCS_BOOT_SIGNATURE_USING_ITS)
6823
int ED25519_verify(const uint8_t *message, size_t message_len,
6924
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
7025
const uint8_t public_key[EDDSA_KEY_LENGTH])
@@ -117,105 +72,3 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
11772

11873
return ret;
11974
}
120-
#else
121-
int ED25519_verify(const uint8_t *message, size_t message_len,
122-
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
123-
const uint8_t public_key[EDDSA_KEY_LENGTH])
124-
{
125-
ARG_UNUSED(public_key);
126-
/* Set to any error */
127-
psa_status_t status = PSA_ERROR_BAD_STATE;
128-
129-
/* Initialize PSA Crypto */
130-
status = psa_crypto_init();
131-
if (status != PSA_SUCCESS) {
132-
BOOT_LOG_ERR("PSA crypto init failed %d", status);
133-
return 0;
134-
}
135-
136-
status = PSA_ERROR_BAD_STATE;
137-
138-
for (int i = 0; i < KEY_SLOTS_COUNT; ++i) {
139-
psa_key_id_t kid = key_ids[i];
140-
141-
status = psa_verify_message(kid, PSA_ALG_PURE_EDDSA, message,
142-
message_len, signature,
143-
EDDSA_SIGNAGURE_LENGTH);
144-
if (status == PSA_SUCCESS) {
145-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
146-
if(i < validated_with) {
147-
validated_with = i;
148-
}
149-
#endif
150-
return 1;
151-
}
152-
153-
}
154-
155-
BOOT_LOG_ERR("ED25519 signature verification failed %d", status);
156-
157-
return 0;
158-
}
159-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
160-
int exec_revoke(void)
161-
{
162-
int ret = BOOT_KEY_REVOKE_OK;
163-
psa_status_t status = psa_crypto_init();
164-
165-
if (validated_with == VALIDATED_WITH_UNINITIALIZED) {
166-
ret = BOOT_KEY_REVOKE_INVALID;
167-
goto out;
168-
}
169-
170-
if (status != PSA_SUCCESS) {
171-
BOOT_LOG_ERR("PSA crypto init failed with error %d", status);
172-
ret = BOOT_KEY_REVOKE_FAILED;
173-
goto out;
174-
}
175-
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; i++) {
176-
if ( i == validated_with) {
177-
break;
178-
}
179-
BOOT_LOG_DBG("Invalidating key ID %d", i);
180-
181-
status = psa_destroy_key(key_ids[i]);
182-
if (status == PSA_SUCCESS) {
183-
BOOT_LOG_DBG("Success on key ID %d", i);
184-
} else {
185-
BOOT_LOG_DBG("Key invalidation failed with: %d", status);
186-
}
187-
}
188-
out:
189-
return ret;
190-
}
191-
#endif /* CONFIG_BOOT_KMU_KEYS_REVOCATION */
192-
193-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
194-
void nrf_crypto_keys_housekeeping(void)
195-
{
196-
psa_status_t status;
197-
198-
/* We will continue through all keys, even if we have error while
199-
* processing any of it. Only doing BOOT_LOG_DBG, as we do not
200-
* really want to inform on failures to lock.
201-
*/
202-
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; ++i) {
203-
psa_key_attributes_t attr;
204-
205-
status = psa_get_key_attributes(key_ids[i], &attr);
206-
BOOT_LOG_DBG("KMU key 0x%x(%d) attr query status == %d",
207-
key_ids[i], i, status);
208-
209-
if (status == PSA_SUCCESS) {
210-
status = cracen_kmu_block(&attr);
211-
BOOT_LOG_DBG("KMU key lock status == %d", status);
212-
}
213-
214-
status = psa_purge_key(key_ids[i]);
215-
BOOT_LOG_DBG("KMU key 0x%x(%d) purge status == %d",
216-
key_ids[i], i, status);
217-
}
218-
}
219-
#endif
220-
221-
#endif

‎boot/bootutil/src/ed25519_psa_kmu.c‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
/*
2+
* Copyright (c) 2025 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
#include <assert.h>
7+
#include <string.h>
8+
#include <stdint.h>
9+
10+
#include <mcuboot_config/mcuboot_config.h>
11+
#include "bootutil/bootutil_log.h"
12+
13+
#include <psa/crypto.h>
14+
#include <psa/crypto_types.h>
15+
#include <zephyr/sys/util.h>
16+
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
17+
#include <cracen_psa_kmu.h>
18+
#endif
19+
20+
BOOT_LOG_MODULE_DECLARE(ed25519_psa);
21+
22+
#define EDDSA_KEY_LENGTH 32
23+
#define EDDSA_SIGNAGURE_LENGTH 64
24+
25+
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
26+
/* List of KMU stored key ids available for MCUboot */
27+
#define PSA_KEY_INDEX_SIZE 2
28+
29+
#if CONFIG_MCUBOOT_MCUBOOT_IMAGE_NUMBER != -1 || \
30+
defined(CONFIG_NCS_BOOT_SIGNATURE_KMU_UROT_MAPPING)
31+
#define PSA_KEY_STARTING_ID 226
32+
#else
33+
#define PSA_KEY_STARTING_ID 242
34+
#endif
35+
36+
#define MAKE_PSA_KMU_KEY_ID(id) PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT(CRACEN_KMU_KEY_USAGE_SCHEME_RAW, id)
37+
static psa_key_id_t key_ids[] = {
38+
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID),
39+
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID + PSA_KEY_INDEX_SIZE),
40+
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID + (2 * PSA_KEY_INDEX_SIZE))
41+
};
42+
43+
#define KEY_SLOTS_COUNT CONFIG_BOOT_SIGNATURE_KMU_SLOTS
44+
45+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
46+
#include <bootutil/key_revocation.h>
47+
#define VALIDATED_WITH_UNINITIALIZED INT32_MAX
48+
static int32_t validated_with = VALIDATED_WITH_UNINITIALIZED;
49+
#endif
50+
51+
BUILD_ASSERT(CONFIG_BOOT_SIGNATURE_KMU_SLOTS <= ARRAY_SIZE(key_ids),
52+
"Invalid number of KMU slots, up to 3 are supported on nRF54L15");
53+
#endif
54+
55+
#if defined(CONFIG_NCS_BOOT_SIGNATURE_USING_ITS)
56+
static const psa_key_id_t key_ids[] = {
57+
0x40022100,
58+
0x40022101,
59+
0x40022102,
60+
0x40022103
61+
};
62+
63+
#define KEY_SLOTS_COUNT ARRAY_SIZE(key_ids)
64+
#endif
65+
66+
int ED25519_verify(const uint8_t *message, size_t message_len,
67+
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
68+
const uint8_t public_key[EDDSA_KEY_LENGTH])
69+
{
70+
ARG_UNUSED(public_key);
71+
/* Set to any error */
72+
psa_status_t status = PSA_ERROR_BAD_STATE;
73+
74+
/* Initialize PSA Crypto */
75+
status = psa_crypto_init();
76+
if (status != PSA_SUCCESS) {
77+
BOOT_LOG_ERR("PSA crypto init failed %d", status);
78+
return 0;
79+
}
80+
81+
status = PSA_ERROR_BAD_STATE;
82+
83+
for (int i = 0; i < KEY_SLOTS_COUNT; ++i) {
84+
psa_key_id_t kid = key_ids[i];
85+
86+
status = psa_verify_message(kid, PSA_ALG_PURE_EDDSA, message,
87+
message_len, signature,
88+
EDDSA_SIGNAGURE_LENGTH);
89+
if (status == PSA_SUCCESS) {
90+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
91+
if(i < validated_with) {
92+
validated_with = i;
93+
}
94+
#endif
95+
return 1;
96+
}
97+
98+
}
99+
100+
BOOT_LOG_ERR("ED25519 signature verification failed %d", status);
101+
102+
return 0;
103+
}
104+
105+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
106+
int exec_revoke(void)
107+
{
108+
int ret = BOOT_KEY_REVOKE_OK;
109+
psa_status_t status = psa_crypto_init();
110+
111+
if (validated_with == VALIDATED_WITH_UNINITIALIZED) {
112+
ret = BOOT_KEY_REVOKE_INVALID;
113+
goto out;
114+
}
115+
116+
if (status != PSA_SUCCESS) {
117+
BOOT_LOG_ERR("PSA crypto init failed with error %d", status);
118+
ret = BOOT_KEY_REVOKE_FAILED;
119+
goto out;
120+
}
121+
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; i++) {
122+
if ( i == validated_with) {
123+
break;
124+
}
125+
BOOT_LOG_DBG("Invalidating key ID %d", i);
126+
127+
status = psa_destroy_key(key_ids[i]);
128+
if (status == PSA_SUCCESS) {
129+
BOOT_LOG_DBG("Success on key ID %d", i);
130+
} else {
131+
BOOT_LOG_DBG("Key invalidation failed with: %d", status);
132+
}
133+
}
134+
out:
135+
return ret;
136+
}
137+
#endif /* CONFIG_BOOT_KMU_KEYS_REVOCATION */
138+
139+
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
140+
void nrf_crypto_keys_housekeeping(void)
141+
{
142+
psa_status_t status;
143+
144+
/* We will continue through all keys, even if we have error while
145+
* processing any of it. Only doing BOOT_LOG_DBG, as we do not
146+
* really want to inform on failures to lock.
147+
*/
148+
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; ++i) {
149+
psa_key_attributes_t attr;
150+
151+
status = psa_get_key_attributes(key_ids[i], &attr);
152+
BOOT_LOG_DBG("KMU key 0x%x(%d) attr query status == %d",
153+
key_ids[i], i, status);
154+
155+
if (status == PSA_SUCCESS) {
156+
status = cracen_kmu_block(&attr);
157+
BOOT_LOG_DBG("KMU key lock status == %d", status);
158+
}
159+
160+
status = psa_purge_key(key_ids[i]);
161+
BOOT_LOG_DBG("KMU key 0x%x(%d) purge status == %d",
162+
key_ids[i], i, status);
163+
}
164+
}
165+
#endif

0 commit comments

Comments
 (0)