@@ -309,7 +309,6 @@ static struct cmd_options CMD = {
309309
310310};
311311
312-
313312static int load_key_ecc (int sign_type , uint32_t curve_sz , int curve_id ,
314313 int header_sz ,
315314 uint8_t * * key_buffer , uint32_t * key_buffer_sz ,
@@ -323,11 +322,7 @@ static int load_key_ecc(int sign_type, uint32_t curve_sz, int curve_id,
323322
324323 * pubkey_sz = curve_sz * 2 ;
325324 * pubkey = malloc (* pubkey_sz ); /* assume malloc works */
326-
327- printf ("Load key: %s" , secondary ?"secondary" :"primary" );
328- printf (" Size: %d\n" , * pubkey_sz );
329325 initRet = ret = wc_ecc_init (& key .ecc );
330-
331326 if (CMD .manual_sign || CMD .sha_only ) {
332327 /* raw (public x + public y) */
333328 if (* key_buffer_sz == (curve_sz * 2 )) {
@@ -520,7 +515,7 @@ static uint8_t *load_key(uint8_t **key_buffer, uint32_t *key_buffer_sz,
520515
521516 f = fopen (key_file , "rb" );
522517 if (f == NULL ) {
523- printf ("Open key file %s failed\n" , CMD . key_file );
518+ printf ("Open key file %s failed\n" , key_file );
524519 goto failure ;
525520 }
526521 fseek (f , 0 , SEEK_END );
@@ -889,11 +884,12 @@ static uint8_t *load_key(uint8_t **key_buffer, uint32_t *key_buffer_sz,
889884/* Sign the digest */
890885static int sign_digest (int sign , int hash_algo ,
891886 uint8_t * signature , uint32_t * signature_sz ,
892- uint8_t * digest , uint32_t digest_sz )
887+ uint8_t * digest , uint32_t digest_sz , int secondary )
893888{
894889 int ret ;
895890 WC_RNG rng ;
896891 printf ("Sign: %02x\n" , sign >> 8 );
892+ (void )secondary ;
897893
898894 if ((ret = wc_InitRng (& rng )) != 0 ) {
899895 return ret ;
@@ -976,6 +972,10 @@ static int sign_digest(int sign, int hash_algo,
976972#endif
977973#ifdef WOLFSSL_HAVE_LMS
978974 if (sign == SIGN_LMS ) {
975+ const char * key_file = CMD .key_file ;
976+ if (secondary ) {
977+ key_file = CMD .secondary_key_file ;
978+ }
979979 /* Set the callbacks, so LMS can update the private key while signing */
980980 ret = wc_LmsKey_SetWriteCb (& key .lms , lms_write_key );
981981 if (ret == 0 ) {
@@ -999,6 +999,10 @@ static int sign_digest(int sign, int hash_algo,
999999#endif /* WOLFSSL_HAVE_LMS */
10001000#ifdef WOLFSSL_HAVE_XMSS
10011001 if (sign == SIGN_XMSS ) {
1002+ const char * key_file = CMD .key_file ;
1003+ if (secondary ) {
1004+ key_file = CMD .secondary_key_file ;
1005+ }
10021006 ret = wc_XmssKey_Init (& key .xmss , NULL , INVALID_DEVID );
10031007 /* Set the callbacks, so XMSS can update the private key while signing */
10041008 if (ret == 0 ) {
@@ -1200,6 +1204,7 @@ static int make_header_ex(int is_diff, uint8_t *pubkey, uint32_t pubkey_sz,
12001204 if (ret == 0 ) {
12011205 ret = wc_InitSha256_ex (& sha , NULL , INVALID_DEVID );
12021206 if (ret == 0 ) {
1207+ printf ("Hashing primary pubkey, size: %d\n" , pubkey_sz );
12031208 ret = wc_Sha256Update (& sha , pubkey , pubkey_sz );
12041209 if (ret == 0 )
12051210 wc_Sha256Final (& sha , buf );
@@ -1209,6 +1214,7 @@ static int make_header_ex(int is_diff, uint8_t *pubkey, uint32_t pubkey_sz,
12091214 /* secondary public key in hybrid mode */
12101215 if (ret == 0 && secondary_key_sz > 0 ) {
12111216 ret = wc_InitSha256_ex (& sha , NULL , INVALID_DEVID );
1217+ printf ("Hashing secondary pubkey, size: %d\n" , secondary_key_sz );
12121218 if (ret == 0 ) {
12131219 ret = wc_Sha256Update (& sha , secondary_key , secondary_key_sz );
12141220 if (ret == 0 )
@@ -1387,7 +1393,7 @@ static int make_header_ex(int is_diff, uint8_t *pubkey, uint32_t pubkey_sz,
13871393 /* Sign the digest */
13881394 printf ("CMD.sign == %02x\n" , CMD .sign );
13891395 ret = sign_digest (CMD .sign , CMD .hash_algo ,
1390- signature , & CMD .signature_sz , digest , digest_sz );
1396+ signature , & CMD .signature_sz , digest , digest_sz , 0 );
13911397 if (ret != 0 ) {
13921398 printf ("Signing error %d\n" , ret );
13931399 goto failure ;
@@ -1419,7 +1425,7 @@ static int make_header_ex(int is_diff, uint8_t *pubkey, uint32_t pubkey_sz,
14191425 }
14201426 memset (secondary_signature , 0 , CMD .secondary_signature_sz );
14211427 ret = sign_digest (CMD .secondary_sign , CMD .hash_algo ,
1422- secondary_signature , & CMD .secondary_signature_sz , digest , digest_sz );
1428+ secondary_signature , & CMD .secondary_signature_sz , digest , digest_sz , 1 );
14231429 if (ret != 0 ) {
14241430 printf ("Secondary Signing error %d\n" , ret );
14251431 goto failure ;
@@ -1471,7 +1477,7 @@ static int make_header_ex(int is_diff, uint8_t *pubkey, uint32_t pubkey_sz,
14711477 /* Policy is always SHA2-256 */
14721478 ret = sign_digest (CMD .sign , HASH_SHA256 ,
14731479 policy + sizeof (uint32_t ), & CMD .policy_sz ,
1474- digest , digest_sz );
1480+ digest , digest_sz , 0 );
14751481 if (ret != 0 ) {
14761482 printf ("Signing policy error %d\n" , ret );
14771483 goto failure ;
@@ -2047,7 +2053,7 @@ static void set_signature_sizes(int secondary)
20472053 if (lms_ret != 0 ) {
20482054 fprintf (stderr , "error: wc_LmsKey_SetParameters(%d, %d, %d)" \
20492055 " returned %d\n" , LMS_LEVELS , LMS_HEIGHT ,
2050- LMS_WINTERNITZ , ret );
2056+ LMS_WINTERNITZ , lms_ret );
20512057 exit (1 );
20522058 }
20532059
@@ -2146,8 +2152,8 @@ int main(int argc, char** argv)
21462152 uint8_t buf [PATH_MAX - 32 ]; /* leave room to avoid "directive output may be truncated" */
21472153 uint8_t * pubkey = NULL ;
21482154 uint32_t pubkey_sz = 0 ;
2149- uint8_t * kbuf = NULL , * key_buffer ;
2150- uint32_t key_buffer_sz ;
2155+ uint8_t * kbuf = NULL , * key_buffer , * key_buffer2 ;
2156+ uint32_t key_buffer_sz , key_buffer_sz2 ;
21512157
21522158#ifdef DEBUG_SIGNTOOL
21532159 wolfSSL_Debugging_ON ();
@@ -2625,10 +2631,10 @@ int main(int argc, char** argv)
26252631
26262632 if (CMD .hybrid ) {
26272633 uint8_t * kbuf2 = NULL ;
2628- uint32_t key_buffer_sz2 ;
26292634 uint8_t * pubkey2 = NULL ;
26302635 uint32_t pubkey_sz2 ;
2631- kbuf2 = load_key (& key_buffer , & key_buffer_sz2 , & pubkey2 , & pubkey_sz2 , 1 );
2636+ printf ("Loading secondary key\n" );
2637+ kbuf2 = load_key (& key_buffer2 , & key_buffer_sz2 , & pubkey2 , & pubkey_sz2 , 1 );
26322638 printf ("Creating hybrid signature\n" );
26332639 make_hybrid_header (pubkey , pubkey_sz , CMD .image_file , CMD .output_image_file ,
26342640 pubkey2 , pubkey_sz2 );
0 commit comments