Skip to content

Commit 05b7bf4

Browse files
de-nordicde-nordic
committed
[nrf noup] bootutil: Separate KMU implementation from ED25519
Move KMU specific implementation to dedicated unit. Signed-off-by: Dominik Ermel <[email protected]>
1 parent 2534681 commit 05b7bf4

File tree

3 files changed

+110
-94
lines changed

3 files changed

+110
-94
lines changed

‎boot/bootutil/pkg.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ pkg.ign_files.BOOTUTIL_SINGLE_APPLICATION_SLOT:
4545
pkg.ign_files:
4646
- "ram_load.c"
4747
- "ed25519_psa.c" # Currently no PSA for mynewet
48+
- "ed25519_psa_kmu.c"
4849
- "encrypted_psa.c"
4950

5051
pkg.deps.BOOTUTIL_USE_MBED_TLS:

‎boot/bootutil/src/ed25519_psa.c

Lines changed: 0 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -13,35 +13,13 @@
1313
#include <psa/crypto.h>
1414
#include <psa/crypto_types.h>
1515
#include <zephyr/sys/util.h>
16-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
17-
#include <cracen_psa_kmu.h>
18-
#endif
1916

2017
BOOT_LOG_MODULE_REGISTER(ed25519_psa);
2118

2219
#define SHA512_DIGEST_LENGTH 64
2320
#define EDDSA_KEY_LENGTH 32
2421
#define EDDSA_SIGNAGURE_LENGTH 64
2522

26-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
27-
/* List of KMU stored key ids available for MCUboot */
28-
#define MAKE_PSA_KMU_KEY_ID(id) PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT(CRACEN_KMU_KEY_USAGE_SCHEME_RAW, id)
29-
static psa_key_id_t kmu_key_ids[3] = {
30-
MAKE_PSA_KMU_KEY_ID(226),
31-
MAKE_PSA_KMU_KEY_ID(228),
32-
MAKE_PSA_KMU_KEY_ID(230)
33-
};
34-
35-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
36-
#include <bootutil/key_revocation.h>
37-
static psa_key_id_t *validated_with = NULL;
38-
#endif
39-
40-
BUILD_ASSERT(CONFIG_BOOT_SIGNATURE_KMU_SLOTS <= ARRAY_SIZE(kmu_key_ids),
41-
"Invalid number of KMU slots, up to 3 are supported on nRF54L15");
42-
#endif
43-
44-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
4523
int ED25519_verify(const uint8_t *message, size_t message_len,
4624
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
4725
const uint8_t public_key[EDDSA_KEY_LENGTH])
@@ -94,75 +72,3 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
9472

9573
return ret;
9674
}
97-
#else
98-
int ED25519_verify(const uint8_t *message, size_t message_len,
99-
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
100-
const uint8_t public_key[EDDSA_KEY_LENGTH])
101-
{
102-
ARG_UNUSED(public_key);
103-
/* Set to any error */
104-
psa_status_t status = PSA_ERROR_BAD_STATE;
105-
int ret = 0; /* Fail by default */
106-
107-
/* Initialize PSA Crypto */
108-
status = psa_crypto_init();
109-
if (status != PSA_SUCCESS) {
110-
BOOT_LOG_ERR("PSA crypto init failed %d", status);
111-
return 0;
112-
}
113-
114-
status = PSA_ERROR_BAD_STATE;
115-
116-
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; ++i) {
117-
psa_key_id_t kid = kmu_key_ids[i];
118-
119-
status = psa_verify_message(kid, PSA_ALG_PURE_EDDSA, message,
120-
message_len, signature,
121-
EDDSA_SIGNAGURE_LENGTH);
122-
if (status == PSA_SUCCESS) {
123-
ret = 1;
124-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
125-
validated_with = kmu_key_ids + i;
126-
#endif
127-
break;
128-
}
129-
130-
BOOT_LOG_ERR("ED25519 signature verification failed %d", status);
131-
}
132-
133-
return ret;
134-
}
135-
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
136-
int exec_revoke(void)
137-
{
138-
int ret = BOOT_KEY_REVOKE_OK;
139-
psa_status_t status = psa_crypto_init();
140-
141-
if (!validated_with) {
142-
ret = BOOT_KEY_REVOKE_INVALID;
143-
goto out;
144-
}
145-
146-
if (status != PSA_SUCCESS) {
147-
BOOT_LOG_ERR("PSA crypto init failed with error %d", status);
148-
ret = BOOT_KEY_REVOKE_FAILED;
149-
goto out;
150-
}
151-
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; i++) {
152-
if ((kmu_key_ids + i) == validated_with) {
153-
break;
154-
}
155-
BOOT_LOG_DBG("Invalidating key ID %d", i);
156-
157-
status = psa_destroy_key(kmu_key_ids[i]);
158-
if (status == PSA_SUCCESS) {
159-
BOOT_LOG_DBG("Success on key ID %d", i);
160-
} else {
161-
BOOT_LOG_ERR("Key invalidation failed with: %d", status);
162-
}
163-
}
164-
out:
165-
return ret;
166-
}
167-
#endif /* CONFIG_BOOT_KMU_KEYS_REVOCATION */
168-
#endif

‎boot/bootutil/src/ed25519_psa_kmu.c

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
/*
2+
* Copyright (c) 2025 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
#include <assert.h>
7+
#include <string.h>
8+
#include <stdint.h>
9+
10+
#include <mcuboot_config/mcuboot_config.h>
11+
#include "bootutil/bootutil_log.h"
12+
13+
#include <psa/crypto.h>
14+
#include <psa/crypto_types.h>
15+
#include <zephyr/sys/util.h>
16+
#include <cracen_psa_kmu.h>
17+
18+
BOOT_LOG_MODULE_REGISTER(ed25519_psa);
19+
20+
#define SHA512_DIGEST_LENGTH 64
21+
#define EDDSA_KEY_LENGTH 32
22+
#define EDDSA_SIGNAGURE_LENGTH 64
23+
24+
/* List of KMU stored key ids available for MCUboot */
25+
#define MAKE_PSA_KMU_KEY_ID(id) PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT(CRACEN_KMU_KEY_USAGE_SCHEME_RAW, id)
26+
static psa_key_id_t kmu_key_ids[3] = {
27+
MAKE_PSA_KMU_KEY_ID(226),
28+
MAKE_PSA_KMU_KEY_ID(228),
29+
MAKE_PSA_KMU_KEY_ID(230)
30+
};
31+
32+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
33+
#include <bootutil/key_revocation.h>
34+
static psa_key_id_t *validated_with = NULL;
35+
#endif
36+
37+
BUILD_ASSERT(CONFIG_BOOT_SIGNATURE_KMU_SLOTS <= ARRAY_SIZE(kmu_key_ids),
38+
"Invalid number of KMU slots, up to 3 are supported on nRF54L15");
39+
40+
int ED25519_verify(const uint8_t *message, size_t message_len,
41+
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
42+
const uint8_t public_key[EDDSA_KEY_LENGTH])
43+
{
44+
ARG_UNUSED(public_key);
45+
/* Set to any error */
46+
psa_status_t status = PSA_ERROR_BAD_STATE;
47+
int ret = 0; /* Fail by default */
48+
49+
/* Initialize PSA Crypto */
50+
status = psa_crypto_init();
51+
if (status != PSA_SUCCESS) {
52+
BOOT_LOG_ERR("PSA crypto init failed %d", status);
53+
return 0;
54+
}
55+
56+
status = PSA_ERROR_BAD_STATE;
57+
58+
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; ++i) {
59+
psa_key_id_t kid = kmu_key_ids[i];
60+
61+
status = psa_verify_message(kid, PSA_ALG_PURE_EDDSA, message,
62+
message_len, signature,
63+
EDDSA_SIGNAGURE_LENGTH);
64+
if (status == PSA_SUCCESS) {
65+
ret = 1;
66+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
67+
validated_with = kmu_key_ids + i;
68+
#endif
69+
break;
70+
}
71+
72+
BOOT_LOG_ERR("ED25519 signature verification failed %d", status);
73+
}
74+
75+
return ret;
76+
}
77+
#if defined(CONFIG_BOOT_KMU_KEYS_REVOCATION)
78+
int exec_revoke(void)
79+
{
80+
int ret = BOOT_KEY_REVOKE_OK;
81+
psa_status_t status = psa_crypto_init();
82+
83+
if (!validated_with) {
84+
ret = BOOT_KEY_REVOKE_INVALID;
85+
goto out;
86+
}
87+
88+
if (status != PSA_SUCCESS) {
89+
BOOT_LOG_ERR("PSA crypto init failed with error %d", status);
90+
ret = BOOT_KEY_REVOKE_FAILED;
91+
goto out;
92+
}
93+
for (int i = 0; i < CONFIG_BOOT_SIGNATURE_KMU_SLOTS; i++) {
94+
if ((kmu_key_ids + i) == validated_with) {
95+
break;
96+
}
97+
BOOT_LOG_DBG("Invalidating key ID %d", i);
98+
99+
status = psa_destroy_key(kmu_key_ids[i]);
100+
if (status == PSA_SUCCESS) {
101+
BOOT_LOG_DBG("Success on key ID %d", i);
102+
} else {
103+
BOOT_LOG_ERR("Key invalidation failed with: %d", status);
104+
}
105+
}
106+
out:
107+
return ret;
108+
}
109+
#endif /* CONFIG_BOOT_KMU_KEYS_REVOCATION */

0 commit comments

Comments
 (0)