Skip to content

Modify MCUboot to use PSA key_id_t for key type in AES encryption context #565

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 424 commits into
base: main
Choose a base branch
from
Open

Modify MCUboot to use PSA key_id_t for key type in AES encryption context #565

wants to merge 424 commits into from

Conversation

@de-nordic
Copy link
Contributor

@de-nordic de-nordic commented Oct 30, 2025

Two commits from upstream:

  • split of encryption headers
  • change in encryption context, where there is no longer raw key stored in encryption context, instead context setup function has been setup to import key into PSA and obtain psa_key_id_t key id for it that is then stored in context; all encryption functions will now operate on that key_id, when using the context.

Replacement of raw key array in encryption context, with psa_key_id_t, has reduced MCUboot binary size by ~224 bytes, for non-KMU and non-log-dbg build; small amount of RAM is saved also.

jukkar added 30 commits September 23, 2025 13:04
@jukkar
Revert "[nrf noup] boot: Improve bootloader request handling"
ad5310a 
This reverts commit 0b54665.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] bootloader: Add bootloader requests"
bde7f77 
This reverts commit 09ce751.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] imgtool: Add support for VID and CID"
94d83b9 
This reverts commit 1aaabde.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] boot: Add VID and CID checks"
7c3acc8 
This reverts commit a652982.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] boot: Enable Encryption with PSA + ECDSA"
62b9990 
This reverts commit 9b60560.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] bootutil: Fix bootutil_aes_ctr_drop memset usage"
1b21524 
This reverts commit 5af259f.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] zephyr: Add support for slot selection boot hook"
7adec5c 
This reverts commit 301ab33.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] loader: Add boot hook for slot selection"
0ae9b52 
This reverts commit c13c652.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] zephyr: boards: nrf54lm20dk_nrf54lm20a_cpuapp.conf"
cc2292e 
This reverts commit d8a2e45.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot: zephyr: Disable self RWX"
a3003ec 
This reverts commit 285fd59.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot: zephyr: firmware_loader: Allow GPIO usage in…
4d9919a 
… BM"

This reverts commit ecc13ac.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot: zephyr: Add NCS boot banner"
8953d48 
This reverts commit c859608.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot: zephyr: Delay bm IO button check"
5fae104 
This reverts commit 1b1a37f.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot: zephyr: remove nonsecure ram cleanup"
1e80b6e 
This reverts commit 3adc1f2.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] zephyr: Add support for AES256"
89933f4 
This reverts commit 3b20ec3.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] imgtool: Allow for AES256 encryption"
e8fa07b 
This reverts commit 1b102ec.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromlist] zephyr: Fix FLASH_DEVICE_ID for nRF54H20 platf…
7d95087 
…orm"

This reverts commit e032eb1.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromlist] bootutil: Fix PureEdDSA when flash base is not…
c813046 
… 0x0"

This reverts commit c03a815.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] zephyr: hw security counter limited set by default"
0496a6a 
This reverts commit 0fadab1.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] bootutil: Fixed security counter overflow dete…
f02b1a8 
…cted to late"

This reverts commit 4e46797.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot: zephyr: Adjust PSA requirements for PSA_CORE…
b4adebf 
…_LITE"

This reverts commit 6c096b8.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] bootutil: Fix scratch scrambling"
5d5e83b 
This reverts commit 95d384a.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromlist] boot/boot_serial: build-time skip of the erasi…
a9e2543 
…ng of img status page"

This reverts commit c72ed15.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromtree] boot: Switch to picolibc"
57c1a83 
This reverts commit edc1c70.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot: zephyr: Fix bm IO button check"
89df5d7 
This reverts commit a184e32.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf fromlist] boot: zephyr: Fix including asn1 when ed25519 …
bf97481 
…is used"

This reverts commit bc5eb3f.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] workflows: Add manifest PRs creation"
a612064 
This reverts commit 37486f5.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot/zephyr/nrf_cleanup: fix index error"
2b45eb8 
This reverts commit 58175b6.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] boot: Use NCS_ prefix for sdk-nrf specific Kconfigs"
5abb665 
This reverts commit 30e7326.

Signed-off-by: Jukka Rissanen <[email protected]>
@jukkar
Revert "[nrf noup] zephyr: Enforce HMAC-SHA512 for NRF54L with X25519"
205ac07 
This reverts commit 8b2d04c.

Signed-off-by: Jukka Rissanen <[email protected]>
ahasztag and others added 7 commits October 17, 2025 13:55
@ahasztag @nvlsianpu
[nrf noup] boot/zephyr: fix and rename nrf54l15dk ext flash configs
6227edc 
nrf-squash! [nrf noup] boot/zephyr: update nrf54l15dk ext flash configs

This commit removes the partition definitions from nrf54L ext flash
configs, as they are no longer needed, as the pure DTS configuration
is no longer supported on nRF54L. They also caused issues, as they
were not compatible with nRF54L10 and nRF54L05.

It renames nrf54l15dk_nrf54l15_cpuapp_ext_flash.* overlays to
nrf54l15dk_ext_flash.*, as now the same configuration can be used
on nRF54L15, nRF54L10 and nRF54L05.

Signed-off-by: Artur Hadasz <[email protected]>
@nordicjm
[nrf fromtree] scripts: Safely fix python files
1734eeb 
Uses ruff with --fix to fix python files in this folder

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit f23154c251e07013d45c9f97c875404e83e7d2dc)
@nordicjm
[nrf fromtree] scripts: Non-safely fix python files
9f768d2 
Uses ruff with --unsafe-fixes to fix python files in this folder
This is a separate commit so it can be reverted if it causes
problems

Signed-off-by: Jamie McCrae <[email protected]>
(cherry picked from commit 497688bafff2c3e183a016b68fc51f1bedf488c9)
@tomchy @nordicjm
[nrf fromtree] Revert "loader: Allow to specify slot number in version"
4b5901f 
This reverts commit dce784a.

Signed-off-by: Tomasz Chyrowicz <[email protected]>
(cherry picked from commit b192716c969ad358bb3a1db60c898212f3275c55)
@eivindj-nordic @nordicjm
[nrf noup] boot: zephyr: update for NCS BM include folder structure
92b8fd3 
nrf-squash! [nrf noup] boot: zephyr: Add bm firmware loader code

Update for NCS BM include folder structure.

Signed-off-by: Eivind Jølsgard <[email protected]>
@ahasztag @nvlsianpu
[nrf noup] boot: zephyr: Region protection adjustments for nRF54L
697ca33 
nrf-squash! [nrf noup] boot: zephyr: Disable self RWX

This commit fixes a couple of issues regarding
MCUBoot region protection for nRF54L.

Also, support for region and protection is added for
nRF54LM20 and nRF54LV10 platforms.

Signed-off-by: Artur Hadasz <[email protected]>
@bjarki-andreasen
[nrf fromtree] boot: zephyr: boards: remove nrf54h20dk overlay
a8161d7 
The nrf54h20dk overlay is no longer required as the gpio pad groups
have been removed.

Signed-off-by: Bjarki Arge Andreasen <[email protected]>
(cherry picked from commit 71b41e38e9f5d278178be17f6d42f2559f8e46aa)
@NordicBuilder NordicBuilder mentioned this pull request Oct 30, 2025
Open
tomchy and others added 2 commits November 3, 2025 09:41
@tomchy @nordicjm
[nrf noup] Handle pending confirm requests
484a6f3 
fixup! [nrf noup] bootloader: Add bootloader requests

Interpret pending bootloader requests while investigating the confirm
flag.

Signed-off-by: Tomasz Chyrowicz <[email protected]>
@ahasztag @nordicjm
[nrf noup] bootutil: Fix ITS key locking compile error
459288d 
nrf-squash! [nrf noup] bootutil: Locking KMU keys

KMU key locking is not available in case ITS
is used. Old code cause compilation errors
when build for signature using ITS.

Signed-off-by: Artur Hadasz <[email protected]>
@de-nordic de-nordic requested a review from tomchy November 4, 2025 15:07
@michalek-no @nordicjm
[nrf noup] boot: zephyr: BM key revocation
82b1eee 
nrf-squash! [nrf noup] boot: zephyr: Add bm firmware loader code

adds KMU key reocation to BM firmware loader.

Signed-off-by: Mateusz Michalek <[email protected]>
@michalek-no @nordicjm
[nrf noup] bootutil: ed25519_psa: multi verification revocation
0d263fa 
take into account multiple verification done in one boot.
Make sure only unused keys are revoked.

Signed-off-by: Mateusz Michalek <[email protected]>
tomchy
tomchy reviewed Nov 7, 2025
View reviewed changes
boot/bootutil/include/bootutil/crypto/aes_ctr_mbedtls.h
return mbedtls_aes_setkey_enc(ctx, k, BOOT_ENC_KEY_SIZE * 8);
}

static inline int bootutil_aes_ctr_encrypt(bootutil_aes_ctr_context *ctx, uint8_t *counter, const uint8_t *m, uint32_t mlen, size_t blk_off, uint8_t *c)
Copy link
Contributor

@tomchy tomchy Nov 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally, I'd prefer to have docstrings inside the interface header, but since this is a [fromtree] commit, I'm not going to require them at this stage.

@de-nordic de-nordic requested a review from nordicjm November 13, 2025 11:22
@tomchy @nordicjm
[nrf fromtree] bootutil: Add API to lock HW counter
9e03c89 
Add a new API to lock further updates of the HW-based security counter.
This API may prevent the non-bootloader application from accidental
invalidation of the bootable firmware.

Signed-off-by: Tomasz Chyrowicz <[email protected]>
(cherry picked from commit f9ad3ee202d53e27a3399976b5fcd0a84c572ba3)
tomchy and others added 4 commits November 17, 2025 11:22
@tomchy @nordicjm
[nrf fromtree] zephyr: Fix BOOT_DOWNGRADE_PREVENTION_CHOICE symbol
2842eb0 
The BOOT_DOWNGRADE_PREVENTION_CHOICE choice should not have a child
Kconfig symbols defined inside it.

Signed-off-by: Tomasz Chyrowicz <[email protected]>
(cherry picked from commit 496f74f318fb12b7e7437db4e8c5c8c429713728)
@tomchy @nordicjm
[nrf noup] bootloader: Add support for IronSide counters
3839107 
Add an implementation of HW rollback prevention, based on the IronSide
secure counters service.

Ref: NCSDK-36295

Signed-off-by: Tomasz Chyrowicz <[email protected]>
@de-nordic
[nrf fromtree] bootutil: Split header with encryption functions
d0a4138 
Split definitions to crypto backend specific headers.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit 5a161e4cc1cd5329c073d996f0300d2661c6b768)
@de-nordic
[nrf fromtree] bootutil: Allow using psa_key_id_t in AES crypto context
208edf4 
Store psa_key_id_t key in AES context instead of RAW key.

Signed-off-by: Dominik Ermel <[email protected]>
(cherry picked from commit e92551838e18b6219af0891a18a757e538bd3ff6)
@sonarqubecloud
Copy link

sonarqubecloud bot commented Nov 18, 2025

Quality Gate Passed Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

nvlsianpu
nvlsianpu approved these changes Nov 27, 2025
View reviewed changes
Copy link
Contributor

@nvlsianpu nvlsianpu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reviewed upstream

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tomchy tomchy tomchy approved these changes

@nvlsianpu nvlsianpu nvlsianpu approved these changes

@michalek-no michalek-no Awaiting requested review from michalek-no

@nordicjm nordicjm Awaiting requested review from nordicjm nordicjm is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.