Skip to content

Commit 94dae8e

Browse files
de-nordicde-nordic
committed
[nrf noup] bootutil: Separate KMU implementation from ED25519
Move KMU specific implementation to dedicated unit. Signed-off-by: Dominik Ermel <[email protected]>
1 parent fdcf758 commit 94dae8e

File tree

2 files changed

+160
-142
lines changed

2 files changed

+160
-142
lines changed

‎boot/bootutil/src/ed25519_psa.c‎

Lines changed: 0 additions & 142 deletions
Original file line numberDiff line numberDiff line change
@@ -13,53 +13,13 @@
1313
#include <psa/crypto.h>
1414
#include <psa/crypto_types.h>
1515
#include <zephyr/sys/util.h>
16-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
17-
#include <cracen_psa_kmu.h>
18-
#endif
1916

2017
BOOT_LOG_MODULE_REGISTER(ed25519_psa);
2118

2219
#define SHA512_DIGEST_LENGTH 64
2320
#define EDDSA_KEY_LENGTH 32
2421
#define EDDSA_SIGNAGURE_LENGTH 64
2522

26-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
27-
/* List of KMU stored key ids available for MCUboot */
28-
#define PSA_KEY_INDEX_SIZE 2
29-
30-
#define PSA_KEY_STARTING_ID CONFIG_NCS_BOOT_SIGNATURE_KMU_BASE_SLOT
31-
32-
#define MAKE_PSA_KMU_KEY_ID(id) PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT(CRACEN_KMU_KEY_USAGE_SCHEME_RAW, id)
33-
static psa_key_id_t key_ids[] = {
34-
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID),
35-
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID + PSA_KEY_INDEX_SIZE),
36-
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID + (2 * PSA_KEY_INDEX_SIZE))
37-
};
38-
39-
#define KEY_SLOTS_COUNT CONFIG_BOOT_SIGNATURE_KMU_SLOTS
40-
41-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
42-
#include <bootutil/key_revocation.h>
43-
#define VALIDATED_WITH_UNINITIALIZED INT32_MAX
44-
static int32_t validated_with = VALIDATED_WITH_UNINITIALIZED;
45-
#endif
46-
47-
BUILD_ASSERT(CONFIG_BOOT_SIGNATURE_KMU_SLOTS <= ARRAY_SIZE(key_ids),
48-
"Invalid number of KMU slots, up to 3 are supported on nRF54L15");
49-
#endif
50-
51-
#if defined(CONFIG_NCS_BOOT_SIGNATURE_USING_ITS)
52-
static const psa_key_id_t key_ids[] = {
53-
0x40022100,
54-
0x40022101,
55-
0x40022102,
56-
0x40022103
57-
};
58-
59-
#define KEY_SLOTS_COUNT ARRAY_SIZE(key_ids)
60-
#endif
61-
62-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU) && !defined(CONFIG_NCS_BOOT_SIGNATURE_USING_ITS)
6323
int ED25519_verify(const uint8_t *message, size_t message_len,
6424
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
6525
const uint8_t public_key[EDDSA_KEY_LENGTH])
@@ -112,105 +72,3 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
11272

11373
return ret;
11474
}
115-
#else
116-
int ED25519_verify(const uint8_t *message, size_t message_len,
117-
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
118-
const uint8_t public_key[EDDSA_KEY_LENGTH])
119-
{
120-
ARG_UNUSED(public_key);
121-
/* Set to any error */
122-
psa_status_t status = PSA_ERROR_BAD_STATE;
123-
124-
/* Initialize PSA Crypto */
125-
status = psa_crypto_init();
126-
if (status != PSA_SUCCESS) {
127-
BOOT_LOG_ERR("PSA crypto init failed %d", status);
128-
return 0;
129-
}
130-
131-
status = PSA_ERROR_BAD_STATE;
132-
133-
for (int i = 0; i < KEY_SLOTS_COUNT; ++i) {
134-
psa_key_id_t kid = key_ids[i];
135-
136-
status = psa_verify_message(kid, PSA_ALG_PURE_EDDSA, message,
137-
message_len, signature,
138-
EDDSA_SIGNAGURE_LENGTH);
139-
if (status == PSA_SUCCESS) {
140-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
141-
if(i < validated_with) {
142-
validated_with = i;
143-
}
144-
#endif
145-
return 1;
146-
}
147-
148-
}
149-
150-
BOOT_LOG_ERR("ED25519 signature verification failed %d", status);
151-
152-
return 0;
153-
}
154-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
155-
int exec_revoke(void)
156-
{
157-
int ret = BOOT_KEY_REVOKE_OK;
158-
psa_status_t status = psa_crypto_init();
159-
160-
if (validated_with == VALIDATED_WITH_UNINITIALIZED) {
161-
ret = BOOT_KEY_REVOKE_INVALID;
162-
goto out;
163-
}
164-
165-
if (status != PSA_SUCCESS) {
166-
BOOT_LOG_ERR("PSA crypto init failed with error %d", status);
167-
ret = BOOT_KEY_REVOKE_FAILED;
168-
goto out;
169-
}
170-
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; i++) {
171-
if ( i == validated_with) {
172-
break;
173-
}
174-
BOOT_LOG_DBG("Invalidating key ID %d", i);
175-
176-
status = psa_destroy_key(key_ids[i]);
177-
if (status == PSA_SUCCESS) {
178-
BOOT_LOG_DBG("Success on key ID %d", i);
179-
} else {
180-
BOOT_LOG_DBG("Key invalidation failed with: %d", status);
181-
}
182-
}
183-
out:
184-
return ret;
185-
}
186-
#endif /* CONFIG_BOOT_KMU_KEYS_REVOCATION */
187-
188-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
189-
void nrf_crypto_keys_housekeeping(void)
190-
{
191-
psa_status_t status;
192-
193-
/* We will continue through all keys, even if we have error while
194-
* processing any of it. Only doing BOOT_LOG_DBG, as we do not
195-
* really want to inform on failures to lock.
196-
*/
197-
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; ++i) {
198-
psa_key_attributes_t attr;
199-
200-
status = psa_get_key_attributes(key_ids[i], &attr);
201-
BOOT_LOG_DBG("KMU key 0x%x(%d) attr query status == %d",
202-
key_ids[i], i, status);
203-
204-
if (status == PSA_SUCCESS) {
205-
status = cracen_kmu_block(&attr);
206-
BOOT_LOG_DBG("KMU key lock status == %d", status);
207-
}
208-
209-
status = psa_purge_key(key_ids[i]);
210-
BOOT_LOG_DBG("KMU key 0x%x(%d) purge status == %d",
211-
key_ids[i], i, status);
212-
}
213-
}
214-
#endif
215-
216-
#endif

‎boot/bootutil/src/ed25519_psa_kmu.c‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
/*
2+
* Copyright (c) 2025 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
#include <assert.h>
7+
#include <string.h>
8+
#include <stdint.h>
9+
10+
#include <mcuboot_config/mcuboot_config.h>
11+
#include "bootutil/bootutil_log.h"
12+
13+
#include <psa/crypto.h>
14+
#include <psa/crypto_types.h>
15+
#include <zephyr/sys/util.h>
16+
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
17+
#include <cracen_psa_kmu.h>
18+
#endif
19+
20+
BOOT_LOG_MODULE_DECLARE(ed25519_psa);
21+
22+
#define EDDSA_KEY_LENGTH 32
23+
#define EDDSA_SIGNAGURE_LENGTH 64
24+
25+
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
26+
/* List of KMU stored key ids available for MCUboot */
27+
#define PSA_KEY_INDEX_SIZE 2
28+
29+
#define PSA_KEY_STARTING_ID CONFIG_NCS_BOOT_SIGNATURE_KMU_BASE_SLOT
30+
31+
#define MAKE_PSA_KMU_KEY_ID(id) PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT(CRACEN_KMU_KEY_USAGE_SCHEME_RAW, id)
32+
static psa_key_id_t key_ids[] = {
33+
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID),
34+
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID + PSA_KEY_INDEX_SIZE),
35+
MAKE_PSA_KMU_KEY_ID(PSA_KEY_STARTING_ID + (2 * PSA_KEY_INDEX_SIZE))
36+
};
37+
38+
#define KEY_SLOTS_COUNT CONFIG_BOOT_SIGNATURE_KMU_SLOTS
39+
40+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
41+
#include <bootutil/key_revocation.h>
42+
#define VALIDATED_WITH_UNINITIALIZED INT32_MAX
43+
static int32_t validated_with = VALIDATED_WITH_UNINITIALIZED;
44+
#endif
45+
46+
BUILD_ASSERT(CONFIG_BOOT_SIGNATURE_KMU_SLOTS <= ARRAY_SIZE(key_ids),
47+
"Invalid number of KMU slots, up to 3 are supported on nRF54L15");
48+
#endif
49+
50+
#if defined(CONFIG_NCS_BOOT_SIGNATURE_USING_ITS)
51+
static const psa_key_id_t key_ids[] = {
52+
0x40022100,
53+
0x40022101,
54+
0x40022102,
55+
0x40022103
56+
};
57+
58+
#define KEY_SLOTS_COUNT ARRAY_SIZE(key_ids)
59+
#endif
60+
61+
int ED25519_verify(const uint8_t *message, size_t message_len,
62+
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
63+
const uint8_t public_key[EDDSA_KEY_LENGTH])
64+
{
65+
ARG_UNUSED(public_key);
66+
/* Set to any error */
67+
psa_status_t status = PSA_ERROR_BAD_STATE;
68+
69+
/* Initialize PSA Crypto */
70+
status = psa_crypto_init();
71+
if (status != PSA_SUCCESS) {
72+
BOOT_LOG_ERR("PSA crypto init failed %d", status);
73+
return 0;
74+
}
75+
76+
status = PSA_ERROR_BAD_STATE;
77+
78+
for (int i = 0; i < KEY_SLOTS_COUNT; ++i) {
79+
psa_key_id_t kid = key_ids[i];
80+
81+
status = psa_verify_message(kid, PSA_ALG_PURE_EDDSA, message,
82+
message_len, signature,
83+
EDDSA_SIGNAGURE_LENGTH);
84+
if (status == PSA_SUCCESS) {
85+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
86+
if(i < validated_with) {
87+
validated_with = i;
88+
}
89+
#endif
90+
return 1;
91+
}
92+
93+
}
94+
95+
BOOT_LOG_ERR("ED25519 signature verification failed %d", status);
96+
97+
return 0;
98+
}
99+
100+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
101+
int exec_revoke(void)
102+
{
103+
int ret = BOOT_KEY_REVOKE_OK;
104+
psa_status_t status = psa_crypto_init();
105+
106+
if (validated_with == VALIDATED_WITH_UNINITIALIZED) {
107+
ret = BOOT_KEY_REVOKE_INVALID;
108+
goto out;
109+
}
110+
111+
if (status != PSA_SUCCESS) {
112+
BOOT_LOG_ERR("PSA crypto init failed with error %d", status);
113+
ret = BOOT_KEY_REVOKE_FAILED;
114+
goto out;
115+
}
116+
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; i++) {
117+
if ( i == validated_with) {
118+
break;
119+
}
120+
BOOT_LOG_DBG("Invalidating key ID %d", i);
121+
122+
status = psa_destroy_key(key_ids[i]);
123+
if (status == PSA_SUCCESS) {
124+
BOOT_LOG_DBG("Success on key ID %d", i);
125+
} else {
126+
BOOT_LOG_DBG("Key invalidation failed with: %d", status);
127+
}
128+
}
129+
out:
130+
return ret;
131+
}
132+
#endif /* CONFIG_BOOT_KMU_KEYS_REVOCATION */
133+
134+
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
135+
void nrf_crypto_keys_housekeeping(void)
136+
{
137+
psa_status_t status;
138+
139+
/* We will continue through all keys, even if we have error while
140+
* processing any of it. Only doing BOOT_LOG_DBG, as we do not
141+
* really want to inform on failures to lock.
142+
*/
143+
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; ++i) {
144+
psa_key_attributes_t attr;
145+
146+
status = psa_get_key_attributes(key_ids[i], &attr);
147+
BOOT_LOG_DBG("KMU key 0x%x(%d) attr query status == %d",
148+
key_ids[i], i, status);
149+
150+
if (status == PSA_SUCCESS) {
151+
status = cracen_kmu_block(&attr);
152+
BOOT_LOG_DBG("KMU key lock status == %d", status);
153+
}
154+
155+
status = psa_purge_key(key_ids[i]);
156+
BOOT_LOG_DBG("KMU key 0x%x(%d) purge status == %d",
157+
key_ids[i], i, status);
158+
}
159+
}
160+
#endif

0 commit comments

Comments
 (0)