Skip to content

Commit 8af2bf6

Browse files
bigbrettbigbrett
committed
expand tests, add additional macro protection, fix keygen type bug
1 parent c31df80 commit 8af2bf6

File tree

5 files changed

+297
-3
lines changed

5 files changed

+297
-3
lines changed

‎.github/workflows/test-sunnyday-simulator.yml‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,66 @@ jobs:
218218
run: |
219219
tools/scripts/sim-sunnyday-update.sh
220220
221+
- name: Cleanup to change key type
222+
run: |
223+
make keysclean
224+
225+
- name: Build wolfboot.elf (RSAPSS2048)
226+
run: |
227+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1
228+
229+
- name: Run sunny day update test
230+
run: |
231+
tools/scripts/sim-sunnyday-update.sh
232+
233+
- name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
234+
run: |
235+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1
236+
237+
- name: Run sunny day update test
238+
run: |
239+
tools/scripts/sim-sunnyday-update.sh
240+
241+
- name: Cleanup to change key type
242+
run: |
243+
make keysclean
244+
245+
- name: Build wolfboot.elf (RSAPSS3072)
246+
run: |
247+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1
248+
249+
- name: Run sunny day update test
250+
run: |
251+
tools/scripts/sim-sunnyday-update.sh
252+
253+
- name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
254+
run: |
255+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1
256+
257+
- name: Run sunny day update test
258+
run: |
259+
tools/scripts/sim-sunnyday-update.sh
260+
261+
- name: Cleanup to change key type
262+
run: |
263+
make keysclean
264+
265+
- name: Build wolfboot.elf (RSAPSS4096)
266+
run: |
267+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1
268+
269+
- name: Run sunny day update test
270+
run: |
271+
tools/scripts/sim-sunnyday-update.sh
272+
273+
- name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
274+
run: |
275+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1
276+
277+
- name: Run sunny day update test
278+
run: |
279+
tools/scripts/sim-sunnyday-update.sh
280+
221281
# 32 Bit simulator, FASTMATH
222282
#
223283
- name: make clean
@@ -348,6 +408,66 @@ jobs:
348408
run: |
349409
tools/scripts/sim-sunnyday-update.sh
350410
411+
- name: Cleanup to change key type
412+
run: |
413+
make keysclean
414+
415+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
416+
run: |
417+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0
418+
419+
- name: Run sunny day update test
420+
run: |
421+
tools/scripts/sim-sunnyday-update.sh
422+
423+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
424+
run: |
425+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0
426+
427+
- name: Run sunny day update test
428+
run: |
429+
tools/scripts/sim-sunnyday-update.sh
430+
431+
- name: Cleanup to change key type
432+
run: |
433+
make keysclean
434+
435+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
436+
run: |
437+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0
438+
439+
- name: Run sunny day update test
440+
run: |
441+
tools/scripts/sim-sunnyday-update.sh
442+
443+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
444+
run: |
445+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0
446+
447+
- name: Run sunny day update test
448+
run: |
449+
tools/scripts/sim-sunnyday-update.sh
450+
451+
- name: Cleanup to change key type
452+
run: |
453+
make keysclean
454+
455+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
456+
run: |
457+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1
458+
459+
- name: Run sunny day update test
460+
run: |
461+
tools/scripts/sim-sunnyday-update.sh
462+
463+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
464+
run: |
465+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0
466+
467+
- name: Run sunny day update test
468+
run: |
469+
tools/scripts/sim-sunnyday-update.sh
470+
351471
352472
# 64 Bit simulator, SP_MATH
353473
#
@@ -479,6 +599,66 @@ jobs:
479599
run: |
480600
tools/scripts/sim-sunnyday-update.sh
481601
602+
- name: Cleanup to change key type
603+
run: |
604+
make keysclean
605+
606+
- name: Build wolfboot.elf (RSAPSS2048)
607+
run: |
608+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1
609+
610+
- name: Run sunny day update test
611+
run: |
612+
tools/scripts/sim-sunnyday-update.sh
613+
614+
- name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
615+
run: |
616+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1
617+
618+
- name: Run sunny day update test
619+
run: |
620+
tools/scripts/sim-sunnyday-update.sh
621+
622+
- name: Cleanup to change key type
623+
run: |
624+
make keysclean
625+
626+
- name: Build wolfboot.elf (RSAPSS3072)
627+
run: |
628+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1
629+
630+
- name: Run sunny day update test
631+
run: |
632+
tools/scripts/sim-sunnyday-update.sh
633+
634+
- name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
635+
run: |
636+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1
637+
638+
- name: Run sunny day update test
639+
run: |
640+
tools/scripts/sim-sunnyday-update.sh
641+
642+
- name: Cleanup to change key type
643+
run: |
644+
make keysclean
645+
646+
- name: Build wolfboot.elf (RSAPSS4096)
647+
run: |
648+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1
649+
650+
- name: Run sunny day update test
651+
run: |
652+
tools/scripts/sim-sunnyday-update.sh
653+
654+
- name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
655+
run: |
656+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1
657+
658+
- name: Run sunny day update test
659+
run: |
660+
tools/scripts/sim-sunnyday-update.sh
661+
482662
# 64 Bit simulator, FASTMATH
483663
#
484664
- name: make clean
@@ -609,6 +789,66 @@ jobs:
609789
run: |
610790
tools/scripts/sim-sunnyday-update.sh
611791
792+
- name: Cleanup to change key type
793+
run: |
794+
make keysclean
795+
796+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
797+
run: |
798+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0
799+
800+
- name: Run sunny day update test
801+
run: |
802+
tools/scripts/sim-sunnyday-update.sh
803+
804+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
805+
run: |
806+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0
807+
808+
- name: Run sunny day update test
809+
run: |
810+
tools/scripts/sim-sunnyday-update.sh
811+
812+
- name: Cleanup to change key type
813+
run: |
814+
make keysclean
815+
816+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
817+
run: |
818+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0
819+
820+
- name: Run sunny day update test
821+
run: |
822+
tools/scripts/sim-sunnyday-update.sh
823+
824+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
825+
run: |
826+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0
827+
828+
- name: Run sunny day update test
829+
run: |
830+
tools/scripts/sim-sunnyday-update.sh
831+
832+
- name: Cleanup to change key type
833+
run: |
834+
make keysclean
835+
836+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
837+
run: |
838+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1
839+
840+
- name: Run sunny day update test
841+
run: |
842+
tools/scripts/sim-sunnyday-update.sh
843+
844+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
845+
run: |
846+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0
847+
848+
- name: Run sunny day update test
849+
run: |
850+
tools/scripts/sim-sunnyday-update.sh
851+
612852
- name: Run sunny day LMS update test
613853
run: |
614854
tools/scripts/sim-pq-sunnyday-update.sh config/examples/sim-lms.config

‎config/examples/sim-rsapss2048.config‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
ARCH=sim
2+
TARGET=sim
3+
SIGN?=RSAPSS2048
4+
HASH?=SHA256
5+
WOLFBOOT_SMALL_STACK?=0
6+
SPI_FLASH=0
7+
DEBUG=1
8+
9+
# sizes should be multiple of system page size
10+
WOLFBOOT_PARTITION_SIZE=0x40000
11+
WOLFBOOT_SECTOR_SIZE=0x1000
12+
WOLFBOOT_PARTITION_BOOT_ADDRESS=0x80000
13+
# if on external flash, it should be multiple of system page size
14+
WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x100000
15+
WOLFBOOT_PARTITION_SWAP_ADDRESS=0x180000
16+
17+
# required for keytools
18+
WOLFBOOT_FIXED_PARTITIONS=1
19+
20+
# For debugging XMALLOC/XFREE
21+
#CFLAGS_EXTRA+=-DWOLFBOOT_DEBUG_MALLOC

‎options.mk‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -574,6 +574,18 @@ ifneq ($(SIGN_SECONDARY),)
574574
WOLFCRYPT_OBJS+=$(RSA_OBJS)
575575
WOLFCRYPT_OBJS+=$(MATH_OBJS)
576576
endif
577+
ifeq ($(SIGN_SECONDARY),RSAPSS2048)
578+
WOLFCRYPT_OBJS+=$(RSA_OBJS)
579+
WOLFCRYPT_OBJS+=$(MATH_OBJS)
580+
endif
581+
ifeq ($(SIGN_SECONDARY),RSAPSS3072)
582+
WOLFCRYPT_OBJS+=$(RSA_OBJS)
583+
WOLFCRYPT_OBJS+=$(MATH_OBJS)
584+
endif
585+
ifeq ($(SIGN_SECONDARY),RSAPSS4096)
586+
WOLFCRYPT_OBJS+=$(RSA_OBJS)
587+
WOLFCRYPT_OBJS+=$(MATH_OBJS)
588+
endif
577589
ifeq ($(SIGN_SECONDARY),ECC256)
578590
WOLFCRYPT_OBJS+=$(ECC_OBJS)
579591
WOLFCRYPT_OBJS+=$(MATH_OBJS)

‎src/image.c‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -617,7 +617,16 @@ static void wolfBoot_verify_signature_rsa_pss(uint8_t key_slot,
617617
wc_FreeRsaKey(&rsa);
618618
/* wc_RsaPSS_VerifyCheckInline returns the PSS-verified data length on
619619
* success (>= digest size), or a negative error code on failure.
620-
* The hash comparison is performed internally by the function. */
620+
* The hash comparison is performed internally by the function.
621+
*
622+
* Note: uses '>=' rather than '==' because PSS verify returns the digest
623+
* size on success, unlike PKCS#1 v1.5 which returns exact decoded length.
624+
*
625+
* ARMORED limitation: the PKCS#1 v1.5 path uses both RSA_VERIFY_FN and
626+
* RSA_VERIFY_HASH armored macros (two hardened gates), but PSS only uses
627+
* RSA_VERIFY_FN because wc_RsaPSS_VerifyCheckInline performs the hash
628+
* comparison internally. The branch below is not armored. Full armored
629+
* hardening for PSS would require a new macro or restructuring. */
621630
if (ret >= WOLFBOOT_SHA_DIGEST_SIZE && img) {
622631
wolfBoot_image_confirm_signature_ok(img);
623632
}
@@ -2411,7 +2420,10 @@ int wolfBoot_verify_authenticity(struct wolfBoot_image *img)
24112420
defined (WOLFBOOT_SIGN_SECONDARY_RSA4096) || \
24122421
defined (WOLFBOOT_SIGN_SECONDARY_RSA2048ENC) || \
24132422
defined (WOLFBOOT_SIGN_SECONDARY_RSA3072ENC) || \
2414-
defined (WOLFBOOT_SIGN_SECONDARY_RSA4096ENC)
2423+
defined (WOLFBOOT_SIGN_SECONDARY_RSA4096ENC) || \
2424+
defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS2048) || \
2425+
defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS3072) || \
2426+
defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS4096)
24152427
expected_secondary_signature_size = RSA_IMAGE_SIGNATURE_SIZE;
24162428
#elif defined (WOLFBOOT_SIGN_SECONDARY_ECC256) || \
24172429
defined (WOLFBOOT_SIGN_SECONDARY_ECC384) || \

‎tools/keytools/keygen.c‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -535,7 +535,16 @@ void keystore_add(uint32_t ktype, uint8_t *key, uint32_t sz, const char *keyfile
535535

536536
memset(&sl, 0, sizeof(sl));
537537
sl.slot_id = id_slot;
538-
sl.key_type = ktype;
538+
/* Map keygen key type to AUTH_KEY_* value for binary keystore.
539+
* KEYGEN_RSAPSS* values (12-14) differ from AUTH_KEY_RSAPSS* (0x0A-0x0C). */
540+
if (ktype == KEYGEN_RSAPSS2048)
541+
sl.key_type = AUTH_KEY_RSAPSS2048;
542+
else if (ktype == KEYGEN_RSAPSS3072)
543+
sl.key_type = AUTH_KEY_RSAPSS3072;
544+
else if (ktype == KEYGEN_RSAPSS4096)
545+
sl.key_type = AUTH_KEY_RSAPSS4096;
546+
else
547+
sl.key_type = ktype;
539548
sl.part_id_mask = id_mask;
540549

541550
sl.pubkey_size = get_pubkey_size(ktype);

0 commit comments

Comments
 (0)