Skip to content

Commit 834d3e0

Browse files
gergelykarmurutva
authored andcommitted
provisioning: Add ECDSA provisioning capability
Provides the changeability of the signing method at `application/<app>/CmakeLists.txt`, under `AWS_OTA_SIGNATURE_TYPE`. Provides support for EC_P256, EC_P384, RSA_2048 and RSA_3072. Separates the signing algorithm/keys used for TF-M and the NS side. Signed-off-by: Gergely Korcsák <[email protected]>
1 parent 1128970 commit 834d3e0

File tree

23 files changed

+221
-93
lines changed

23 files changed

+221
-93
lines changed

.gitlab-ci.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ workflow:
7676
build/${APP}_merged.elf \
7777
build/${APP}-update_signed.bin \
7878
build/update-signature.txt \
79+
build/CMakeCache.txt \
7980
applications/${APP_UNDERSCORED}/configs/aws_configs
8081
fi
8182
@@ -252,6 +253,7 @@ test-blinky-output:
252253
tar xf ${TARGET}_${APP}_${TOOLCHAIN}_${INFERENCE}_${AUDIO}_${CONN_STACK}_${PSA_CRYPTO_IMPLEMENTATION}_build.tar.gz
253254
fi
254255
- export APP_UNDERSCORED=$(echo ${APP} | tr '-' '_')
256+
- export SIGNING_ALGO=$(cat build/CMakeCache.txt | grep AWS_OTA_SIGNATURE_TYPE | sed s/.*=// | sed s/-.*//)
255257
- |
256258
if [[ $AUDIO == "VSI" ]]; then
257259
pytest -s tools/tests/test_applications.py \
@@ -261,6 +263,7 @@ test-blinky-output:
261263
--credentials-path "applications/${APP_UNDERSCORED}/configs/aws_configs" \
262264
--merged-elf-name "${APP}_merged.elf" \
263265
--signed-update-bin-name "${APP}-update_signed.bin" \
266+
--signing-algo ${SIGNING_ALGO} \
264267
--timeout-seconds 2700 \
265268
--pass-output-file "applications/${APP_UNDERSCORED}/tests/${TARGET}_pass_output.log" \
266269
--fail-output-file "applications/${APP_UNDERSCORED}/tests/fail_output.log" \
@@ -273,6 +276,7 @@ test-blinky-output:
273276
--credentials-path "applications/${APP_UNDERSCORED}/configs/aws_configs" \
274277
--merged-elf-name "${APP}_merged.elf" \
275278
--signed-update-bin-name "${APP}-update_signed.bin" \
279+
--signing-algo ${SIGNING_ALGO} \
276280
--timeout-seconds 1800 \
277281
--pass-output-file "applications/${APP_UNDERSCORED}/tests/${TARGET}_pass_output.log" \
278282
--fail-output-file "applications/${APP_UNDERSCORED}/tests/fail_output.log"
@@ -283,6 +287,7 @@ test-blinky-output:
283287
--credentials-path "applications/${APP_UNDERSCORED}/configs/aws_configs" \
284288
--merged-elf-name "${APP}_merged.elf" \
285289
--signed-update-bin-name "${APP}-update_signed.bin" \
290+
--signing-algo ${SIGNING_ALGO} \
286291
--timeout-seconds 2700 \
287292
--pass-output-file "applications/${APP_UNDERSCORED}/tests/${TARGET}_pass_output.log" \
288293
--fail-output-file "applications/${APP_UNDERSCORED}/tests/fail_output.log"

applications/freertos_iot_libraries_tests/CMakeLists.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
cmake_minimum_required(VERSION 3.21.0 FATAL_ERROR)
66

7+
set(AWS_OTA_SIGNATURE_TYPE "RSA-3072" CACHE STRING "Supported algorithms for signature validation [RSA-2048, RSA-3072, EC-P256, EC-P384]")
8+
79
# From: ota-for-aws-iot-embedded-sdk/source/include/ota_appversion32.h
810
# struct version
911
# {
@@ -51,6 +53,7 @@ list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/bsp/cm
5153
list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/components/aws_iot/cmake)
5254
list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/components/security/trusted_firmware-m/integration/cmake)
5355
include(SetLinkerOptions)
56+
include(AWSIoTHelpers)
5457
include(GenerateAWSUpdateDigestAndSignature)
5558
include(MergeTfmImages)
5659
include(SignTfmImage)

applications/freertos_iot_libraries_tests/main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ int main( void )
173173

174174
LogInfo( ( "Device key provisioning succeeded \n" ) );
175175

176-
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
176+
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, AWS_OTA_SIGNATURE_KEY_LEN );
177177

178178
if( uxStatus != PSA_SUCCESS )
179179
{

applications/helpers/provisioning/CMakeLists.txt

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@ else()
2323
fri-bsp
2424
)
2525

26-
ExternalProject_Get_Property(trusted_firmware-m-build BINARY_DIR)
27-
2826
if(FREERTOS_LIBRARIES_INTEGRATION_TESTS EQUAL 1)
2927
set(
3028
CODE_SIGNING_PUBLIC_KEY_PEM_PATH
@@ -33,13 +31,14 @@ else()
3331
else()
3432
set(
3533
CODE_SIGNING_PUBLIC_KEY_PEM_PATH
36-
${BINARY_DIR}/api_ns/image_signing/keys/image_ns_signing_public_key.pem
34+
${AWS_OTA_SIGNATURE_PUBLIC_KEY_PATH}
3735
)
3836
endif()
3937

4038
add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/aws_clientcredential_keys.h
4139
DEPENDS ${AWS_CLIENT_PRIVATE_KEY_PEM_PATH}
4240
DEPENDS ${AWS_CLIENT_CERTIFICATE_PEM_PATH}
41+
DEPENDS aws_ota_signing_keys
4342
COMMAND
4443
${Python3_EXECUTABLE} ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/tools/scripts/generate_credentials_header.py
4544
${CMAKE_CURRENT_BINARY_DIR}
@@ -89,4 +88,13 @@ else()
8988
freertos_kernel
9089
mbedtls
9190
)
91+
92+
target_compile_definitions(provisioning-lib
93+
PUBLIC
94+
$<$<STREQUAL:${AWS_OTA_SIG_TYPE},RSA>:AWS_OTA_SIGN_RSA>
95+
$<$<STREQUAL:${AWS_OTA_SIG_TYPE},EC>:AWS_OTA_SIGN_ECDSA>
96+
$<$<STREQUAL:${AWS_OTA_SIG_TYPE},EC>:AWS_OTA_ECDSA_HEADER_SIZE=26>
97+
98+
AWS_OTA_SIGNATURE_KEY_LEN=${AWS_OTA_SIG_LEN}
99+
)
92100
endif() # BUILD_TESTING AND NOT CMAKE_CROSS_COMPILING

applications/helpers/provisioning/dev_mode_key_provisioning.c

Lines changed: 68 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1382,10 +1382,17 @@ int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
13821382
size_t xPubKeyDerLength = DER_FORMAT_BUFFER_LENGTH;
13831383
size_t xPubKeyPemLength = strlen( ( const char * ) pxProvisioningParamsBundle->codeSigningPublicKey );
13841384
int result = 0;
1385+
psa_status_t status = PSA_SUCCESS;
13851386
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1386-
mbedtls_pk_context xMbedPkContext = { 0 };
13871387

1388-
mbedtls_pk_init( &xMbedPkContext );
1388+
#ifdef AWS_OTA_SIGN_RSA
1389+
mbedtls_pk_context xMbedPkContext = { 0 };
1390+
#elif AWS_OTA_SIGN_ECDSA
1391+
uint8_t * pucPubKeyDerFormatBufferEcdsaAligned = pucPubKeyDerFormatBuffer + AWS_OTA_ECDSA_HEADER_SIZE;
1392+
size_t xPubKeyDerLengthEcdsaAligned;
1393+
#else /* ifdef AWS_OTA_SIGN_RSA */
1394+
#error "Unknown crypto algorithm, supportted algorithms are EC and RSA!"
1395+
#endif
13891396

13901397
result = convert_pem_to_der( ( const unsigned char * ) pxProvisioningParamsBundle->codeSigningPublicKey,
13911398
xPubKeyPemLength,
@@ -1394,59 +1401,73 @@ int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
13941401

13951402
if( result != 0 )
13961403
{
1397-
goto exit;
1404+
return result;
13981405
}
13991406

1400-
/*
1401-
* From mbedtls 3.6.0 release note:
1402-
*
1403-
* Default behavior changes
1404-
* psa_import_key() now only accepts RSA keys in the PSA standard formats.
1405-
* The undocumented ability to import other formats (PKCS#8, SubjectPublicKey,
1406-
* PEM) accepted by the pkparse module has been removed. Applications that
1407-
* need these formats can call mbedtls_pk_parse_{public,}key() followed by
1408-
* mbedtls_pk_import_into_psa().
1409-
*/
1410-
1411-
result = mbedtls_pk_parse_public_key( &xMbedPkContext,
1412-
( const unsigned char * ) pucPubKeyDerFormatBuffer,
1413-
xPubKeyDerLength );
1414-
1415-
if( result != 0 )
1416-
{
1417-
goto exit;
1418-
}
1419-
1420-
result = mbedtls_pk_get_psa_attributes( &xMbedPkContext,
1421-
PSA_KEY_USAGE_VERIFY_HASH,
1422-
&attributes );
1423-
1424-
if( result != 0 )
1425-
{
1426-
goto exit;
1427-
}
1428-
1429-
#ifdef PSA_CRYPTO_IMPLEMENTATION_MBEDTLS
1430-
psa_set_key_lifetime( &attributes, PSA_KEY_LIFETIME_VOLATILE );
1431-
#endif
1407+
#ifdef AWS_OTA_SIGN_RSA
1408+
mbedtls_pk_init( &xMbedPkContext );
1409+
1410+
/*
1411+
* From mbedtls 3.6.0 release note:
1412+
*
1413+
* Default behavior changes
1414+
* psa_import_key() now only accepts RSA keys in the PSA standard formats.
1415+
* The undocumented ability to import other formats (PKCS#8, SubjectPublicKey,
1416+
* PEM) accepted by the pkparse module has been removed. Applications that
1417+
* need these formats can call mbedtls_pk_parse_{public,}key() followed by
1418+
* mbedtls_pk_import_into_psa().
1419+
*/
1420+
result = mbedtls_pk_parse_public_key( &xMbedPkContext,
1421+
( const unsigned char * ) pucPubKeyDerFormatBuffer,
1422+
xPubKeyDerLength );
1423+
1424+
if( result != 0 )
1425+
{
1426+
mbedtls_pk_free( &xMbedPkContext );
1427+
return result;
1428+
}
14321429

1433-
psa_set_key_algorithm( &attributes, PSA_ALG_RSA_PSS_ANY_SALT( PSA_ALG_SHA_256 ) );
1434-
psa_set_key_bits( &attributes, keyBits );
1430+
result = mbedtls_pk_get_psa_attributes( &xMbedPkContext,
1431+
PSA_KEY_USAGE_VERIFY_HASH,
1432+
&attributes );
14351433

1436-
result = mbedtls_pk_import_into_psa( &xMbedPkContext,
1437-
&attributes,
1438-
pxKeyHandle );
1434+
if( result != 0 )
1435+
{
1436+
mbedtls_pk_free( &xMbedPkContext );
1437+
return result;
1438+
}
14391439

1440-
if( result != 0 )
1441-
{
1440+
#ifdef PSA_CRYPTO_IMPLEMENTATION_MBEDTLS
1441+
psa_set_key_lifetime( &attributes, PSA_KEY_LIFETIME_VOLATILE );
1442+
#endif
1443+
1444+
psa_set_key_bits( &attributes, keyBits );
1445+
psa_set_key_algorithm( &attributes, PSA_ALG_RSA_PSS_ANY_SALT( PSA_ALG_SHA_256 ) );
1446+
status = mbedtls_pk_import_into_psa( &xMbedPkContext,
1447+
&attributes,
1448+
pxKeyHandle );
1449+
#elif AWS_OTA_SIGN_ECDSA
1450+
xPubKeyDerLengthEcdsaAligned = xPubKeyDerLength - AWS_OTA_ECDSA_HEADER_SIZE;
1451+
#ifdef PSA_CRYPTO_IMPLEMENTATION_MBEDTLS
1452+
psa_set_key_lifetime( &attributes, PSA_KEY_LIFETIME_VOLATILE );
1453+
#endif
1454+
psa_set_key_bits( &attributes, keyBits );
1455+
psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
1456+
psa_set_key_algorithm( &attributes, PSA_ALG_ECDSA( PSA_ALG_SHA_256 ) );
1457+
psa_set_key_type( &attributes, PSA_KEY_TYPE_ECC_PUBLIC_KEY( PSA_ECC_FAMILY_SECP_R1 ) );
1458+
status = psa_import_key( &attributes, ( const uint8_t * ) pucPubKeyDerFormatBufferEcdsaAligned,
1459+
xPubKeyDerLengthEcdsaAligned, pxKeyHandle );
1460+
#endif /* ifdef AWS_OTA_SIGN_RSA */
1461+
1462+
if( status != PSA_SUCCESS )
1463+
{
1464+
#ifdef AWS_OTA_SIGN_RSA
1465+
mbedtls_pk_free( &xMbedPkContext );
1466+
#endif
14421467
*pxKeyHandle = NULL;
1443-
goto exit;
14441468
}
14451469

1446-
exit:
1447-
mbedtls_pk_free( &xMbedPkContext );
1448-
1449-
return result;
1470+
return status;
14501471
}
14511472

14521473
UBaseType_t uxIsDeviceProvisioned( void )

applications/keyword_detection/CMakeLists.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,10 @@
44

55
cmake_minimum_required(VERSION 3.21.0 FATAL_ERROR)
66

7-
set(ML_INFERENCE_ENGINE "ETHOS" CACHE STRING "Machine Learning inference engine (ETHOS | SOFTWARE)")
8-
9-
set(AUDIO_SOURCE "ROM" CACHE STRING "Source of audio data (ROM | VSI)")
10-
11-
set(APPLICATION_PATH "${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/applications/keyword_detection" CACHE STRING "Path to the application folder")
7+
set(ML_INFERENCE_ENGINE "ETHOS" CACHE STRING "Machine Learning inference engine (ETHOS | SOFTWARE)")
8+
set(AUDIO_SOURCE "ROM" CACHE STRING "Source of audio data (ROM | VSI)")
9+
set(APPLICATION_PATH "${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/applications/keyword_detection" CACHE STRING "Path to the application folder")
10+
set(AWS_OTA_SIGNATURE_TYPE "RSA-3072" CACHE STRING "Supported algorithms for signature validation [RSA-2048, RSA-3072, EC-P256, EC-P384]")
1211

1312
# From: ota-for-aws-iot-embedded-sdk/source/include/ota_appversion32.h
1413
# struct version
@@ -68,6 +67,7 @@ list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/compon
6867
list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/components/security/trusted_firmware-m/integration/cmake)
6968
include(SetupMlEmbeddedEvaluationKitLibraries)
7069
include(ConvertAudioSourceToCode)
70+
include(AWSIoTHelpers)
7171
include(GenerateAWSUpdateDigestAndSignature)
7272
include(MergeTfmImages)
7373
include(SignTfmImage)

applications/keyword_detection/main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ int main( void )
196196

197197
LogInfo( ( "Device key provisioning succeeded \n" ) );
198198

199-
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
199+
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, AWS_OTA_SIGNATURE_KEY_LEN );
200200

201201
if( uxStatus != PSA_SUCCESS )
202202
{

applications/object_detection/CMakeLists.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,10 @@
44

55
cmake_minimum_required(VERSION 3.21.0 FATAL_ERROR)
66

7-
set(ML_INFERENCE_ENGINE "ETHOS" CACHE STRING "Machine Learning inference engine (ETHOS)")
8-
9-
set(AUDIO_SOURCE "ROM" CACHE STRING "Source of audio data (ROM | VSI)")
10-
11-
set(APPLICATION_PATH "${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/applications/object_detection" CACHE STRING "Path to the application folder")
7+
set(ML_INFERENCE_ENGINE "ETHOS" CACHE STRING "Machine Learning inference engine (ETHOS)")
8+
set(AUDIO_SOURCE "ROM" CACHE STRING "Source of audio data (ROM | VSI)")
9+
set(APPLICATION_PATH "${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/applications/object_detection" CACHE STRING "Path to the application folder")
10+
set(AWS_OTA_SIGNATURE_TYPE "RSA-3072" CACHE STRING "Supported algorithms for signature validation [RSA-2048, RSA-3072, EC-P256, EC-P384]")
1211

1312
# From: ota-for-aws-iot-embedded-sdk/source/include/ota_appversion32.h
1413
# struct version
@@ -67,6 +66,7 @@ list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/compon
6766
list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/components/ai/ml_embedded_evaluation_kit/integration/cmake)
6867
list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/components/security/trusted_firmware-m/integration/cmake)
6968
include(SetupMlEmbeddedEvaluationKitLibraries)
69+
include(AWSIoTHelpers)
7070
include(GenerateAWSUpdateDigestAndSignature)
7171
include(MergeTfmImages)
7272
include(SignTfmImage)

applications/object_detection/main.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ int main( void )
184184

185185
LogInfo( ( "Device key provisioning succeeded \n" ) );
186186

187-
uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
187+
uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, AWS_OTA_SIGNATURE_KEY_LEN );
188188

189189
if( uxStatus != PSA_SUCCESS )
190190
{

applications/speech_recognition/CMakeLists.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,10 @@
44

55
cmake_minimum_required(VERSION 3.21.0 FATAL_ERROR)
66

7-
set(ML_INFERENCE_ENGINE "ETHOS" CACHE STRING "Machine Learning inference engine (ETHOS)")
8-
9-
set(AUDIO_SOURCE "ROM" CACHE STRING "Source of audio data (ROM | VSI)")
10-
11-
set(APPLICATION_PATH "${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/applications/speech_recognition" CACHE STRING "Path to the application folder")
7+
set(ML_INFERENCE_ENGINE "ETHOS" CACHE STRING "Machine Learning inference engine (ETHOS)")
8+
set(AUDIO_SOURCE "ROM" CACHE STRING "Source of audio data (ROM | VSI)")
9+
set(APPLICATION_PATH "${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/applications/speech_recognition" CACHE STRING "Path to the application folder")
10+
set(AWS_OTA_SIGNATURE_TYPE "RSA-3072" CACHE STRING "Supported algorithms for signature validation [RSA-2048, RSA-3072, EC-P256, EC-P384]")
1211

1312
# From: ota-for-aws-iot-embedded-sdk/source/include/ota_appversion32.h
1413
# struct version
@@ -68,6 +67,7 @@ list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/compon
6867
list(APPEND CMAKE_MODULE_PATH ${IOT_REFERENCE_ARM_CORSTONE3XX_SOURCE_DIR}/components/security/trusted_firmware-m/integration/cmake)
6968
include(SetupMlEmbeddedEvaluationKitLibraries)
7069
include(ConvertAudioSourceToCode)
70+
include(AWSIoTHelpers)
7171
include(GenerateAWSUpdateDigestAndSignature)
7272
include(MergeTfmImages)
7373
include(SignTfmImage)

0 commit comments

Comments
 (0)