Skip to content

Commit 62013cb

Browse files
michalek-nonordicjm
michalek-no
authored and
nordicjm
committed
Revert "[nrf noup] bootutil: Add support for KMU stored ED25519 signature key"
This reverts commit afb178a.
1 parent 323e327 commit 62013cb

File tree

5 files changed

+4
-96
lines changed

5 files changed

+4
-96
lines changed

‎boot/bootutil/src/ed25519_psa.c

Lines changed: 0 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -12,28 +12,13 @@
1212

1313
#include <psa/crypto.h>
1414
#include <psa/crypto_types.h>
15-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
16-
#include <cracen_psa_kmu.h>
17-
#endif
1815

1916
BOOT_LOG_MODULE_REGISTER(ed25519_psa);
2017

2118
#define SHA512_DIGEST_LENGTH 64
2219
#define EDDSA_KEY_LENGTH 32
2320
#define EDDSA_SIGNAGURE_LENGTH 64
2421

25-
#if defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
26-
/* List of KMU stored key ids available for MCUboot */
27-
#define MAKE_PSA_KMU_KEY_ID(id) PSA_KEY_HANDLE_FROM_CRACEN_KMU_SLOT(CRACEN_KMU_KEY_USAGE_SCHEME_RAW, id)
28-
static psa_key_id_t kmu_key_ids[3] = {
29-
MAKE_PSA_KMU_KEY_ID(226),
30-
MAKE_PSA_KMU_KEY_ID(228),
31-
MAKE_PSA_KMU_KEY_ID(230)
32-
};
33-
#define KMU_KEY_COUNT (sizeof(kmu_key_ids)/sizeof(kmu_key_ids[0]))
34-
#endif
35-
36-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
3722
int ED25519_verify(const uint8_t *message, size_t message_len,
3823
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
3924
const uint8_t public_key[EDDSA_KEY_LENGTH])
@@ -86,39 +71,3 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
8671

8772
return ret;
8873
}
89-
#else
90-
int ED25519_verify(const uint8_t *message, size_t message_len,
91-
const uint8_t signature[EDDSA_SIGNAGURE_LENGTH],
92-
const uint8_t public_key[EDDSA_KEY_LENGTH])
93-
{
94-
ARG_UNUSED(public_key);
95-
/* Set to any error */
96-
psa_status_t status = PSA_ERROR_BAD_STATE;
97-
int ret = 0; /* Fail by default */
98-
99-
/* Initialize PSA Crypto */
100-
status = psa_crypto_init();
101-
if (status != PSA_SUCCESS) {
102-
BOOT_LOG_ERR("PSA crypto init failed %d", status);
103-
return 0;
104-
}
105-
106-
status = PSA_ERROR_BAD_STATE;
107-
108-
for (int i = 0; i < KMU_KEY_COUNT; ++i) {
109-
psa_key_id_t kid = kmu_key_ids[i];
110-
111-
status = psa_verify_message(kid, PSA_ALG_PURE_EDDSA, message,
112-
message_len, signature,
113-
EDDSA_SIGNAGURE_LENGTH);
114-
if (status == PSA_SUCCESS) {
115-
ret = 1;
116-
break;
117-
}
118-
119-
BOOT_LOG_ERR("ED25519 signature verification failed %d", status);
120-
}
121-
122-
return ret;
123-
}
124-
#endif

‎boot/bootutil/src/image_ed25519.c

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ extern int ED25519_verify(const uint8_t *message, size_t message_len,
3434
const uint8_t signature[EDDSA_SIGNATURE_LENGTH],
3535
const uint8_t public_key[NUM_ED25519_BYTES]);
3636

37-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
3837
#if !defined(MCUBOOT_KEY_IMPORT_BYPASS_ASN)
3938
/*
4039
* Parse the public key used for signing.
@@ -77,7 +76,6 @@ bootutil_import_key(uint8_t **cp, uint8_t *end)
7776
return 0;
7877
}
7978
#endif /* !defined(MCUBOOT_KEY_IMPORT_BYPASS_ASN) */
80-
#endif
8179

8280
/* Signature verification base function.
8381
* The function takes buffer of specified length and tries to verify
@@ -92,10 +90,8 @@ bootutil_verify(uint8_t *buf, uint32_t blen,
9290
{
9391
int rc;
9492
FIH_DECLARE(fih_rc, FIH_FAILURE);
95-
uint8_t *pubkey = NULL;
96-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
93+
uint8_t *pubkey;
9794
uint8_t *end;
98-
#endif
9995

10096
BOOT_LOG_DBG("bootutil_verify: ED25519 key_id %d", (int)key_id);
10197

@@ -106,7 +102,6 @@ bootutil_verify(uint8_t *buf, uint32_t blen,
106102
goto out;
107103
}
108104

109-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
110105
pubkey = (uint8_t *)bootutil_keys[key_id].key;
111106
end = pubkey + *bootutil_keys[key_id].len;
112107

@@ -130,8 +125,6 @@ bootutil_verify(uint8_t *buf, uint32_t blen,
130125
}
131126

132127
pubkey = end - NUM_ED25519_BYTES;
133-
#endif
134-
135128
#endif
136129

137130
rc = ED25519_verify(buf, blen, sig, pubkey);

‎boot/bootutil/src/image_validate.c

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,6 @@ bootutil_img_hash(struct boot_loader_state *state,
292292
# define KEY_BUF_SIZE (SIG_BUF_SIZE + 24)
293293
#endif /* !MCUBOOT_HW_KEY */
294294

295-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
296295
#if !defined(MCUBOOT_HW_KEY)
297296
static int
298297
bootutil_find_key(uint8_t *keyhash, uint8_t keyhash_len)
@@ -361,7 +360,6 @@ bootutil_find_key(uint8_t image_index, uint8_t *key, uint16_t key_len)
361360
}
362361
#endif /* !MCUBOOT_HW_KEY */
363362
#endif /* !MCUBOOT_BUILTIN_KEY */
364-
#endif /* !defined(CONFIG_BOOT_SIGNATURE_USING_KMU) */
365363
#endif /* EXPECTED_SIG_TLV */
366364

367365
/**
@@ -731,7 +729,6 @@ bootutil_img_validate(struct boot_loader_state *state,
731729
break;
732730
}
733731
#endif /* defined(EXPECTED_HASH_TLV) && !defined(MCUBOOT_SIGN_PURE) */
734-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
735732
#ifdef EXPECTED_KEY_TLV
736733
case EXPECTED_KEY_TLV:
737734
{
@@ -763,18 +760,15 @@ bootutil_img_validate(struct boot_loader_state *state,
763760
break;
764761
}
765762
#endif /* EXPECTED_KEY_TLV */
766-
#endif /* !defined(CONFIG_BOOT_SIGNATURE_USING_KMU) */
767763
#ifdef EXPECTED_SIG_TLV
768764
case EXPECTED_SIG_TLV:
769765
{
770766
BOOT_LOG_DBG("bootutil_img_validate: EXPECTED_SIG_TLV == %d", EXPECTED_SIG_TLV);
771-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
772767
/* Ignore this signature if it is out of bounds. */
773768
if (key_id < 0 || key_id >= bootutil_key_cnt) {
774769
key_id = -1;
775770
continue;
776771
}
777-
#endif /* !defined(CONFIG_BOOT_SIGNATURE_USING_KMU) */
778772
if (!EXPECTED_SIG_LEN(len) || len > sizeof(buf)) {
779773
rc = -1;
780774
goto out;
@@ -931,7 +925,7 @@ bootutil_img_validate(struct boot_loader_state *state,
931925
}
932926

933927
#ifdef EXPECTED_SIG_TLV
934-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU) && defined(EXPECTED_KEY_TLV)
928+
#ifdef EXPECTED_KEY_TLV
935929
rc = bootutil_tlv_iter_begin(&it, hdr, fap, EXPECTED_KEY_TLV, false);
936930
if (rc) {
937931
goto out;
@@ -977,7 +971,7 @@ bootutil_img_validate(struct boot_loader_state *state,
977971
*/
978972
}
979973
}
980-
#endif /* !CONFIG_BOOT_SIGNATURE_USING_KMU && EXPECTED_KEY_TLV */
974+
#endif /* EXPECTED_KEY_TLV */
981975

982976
rc = bootutil_tlv_iter_begin(&it, hdr, fap, IMAGE_TLV_DECOMP_SIGNATURE, true);
983977
if (rc) {
@@ -1000,12 +994,10 @@ bootutil_img_validate(struct boot_loader_state *state,
1000994

1001995
if (type == IMAGE_TLV_DECOMP_SIGNATURE) {
1002996
/* Ignore this signature if it is out of bounds. */
1003-
#if !defined(CONFIG_BOOT_SIGNATURE_USING_KMU)
1004997
if (key_id < 0 || key_id >= bootutil_key_cnt) {
1005998
key_id = -1;
1006999
continue;
10071000
}
1008-
#endif
10091001

10101002
if (!EXPECTED_SIG_LEN(len) || len > sizeof(buf)) {
10111003
rc = -1;

‎boot/zephyr/CMakeLists.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -352,7 +352,7 @@ if(CONFIG_MCUBOOT_SERIAL)
352352
endif()
353353
endif()
354354

355-
if(NOT CONFIG_BOOT_SIGNATURE_USING_KMU AND NOT CONFIG_BOOT_SIGNATURE_KEY_FILE STREQUAL "")
355+
if(NOT CONFIG_BOOT_SIGNATURE_KEY_FILE STREQUAL "")
356356
# CONF_FILE points to the KConfig configuration files of the bootloader.
357357
foreach (filepath ${CONF_FILE})
358358
file(READ ${filepath} temp_text)

‎boot/zephyr/Kconfig

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -332,22 +332,6 @@ endif
332332

333333
endchoice
334334

335-
config BOOT_SIGNATURE_USING_KMU
336-
bool "Use KMU stored keys for signature verification"
337-
depends on NRF_SECURITY
338-
depends on CRACEN_LIB_KMU
339-
select PSA_WANT_ALG_GCM
340-
select PSA_WANT_KEY_TYPE_AES
341-
select PSA_WANT_AES_KEY_SIZE_256
342-
select PSA_WANT_ALG_SP800_108_COUNTER_CMAC
343-
select PSA_WANT_ALG_CMAC
344-
select PSA_WANT_ALG_ECB_NO_PADDING
345-
help
346-
MCUboot will use keys provisioned to the device key management unit for signature
347-
verification instead of compiling in key data from a file.
348-
349-
if !BOOT_SIGNATURE_USING_KMU
350-
351335
config BOOT_SIGNATURE_KEY_FILE
352336
string "PEM key file"
353337
default "root-ec-p256.pem" if BOOT_SIGNATURE_TYPE_ECDSA_P256
@@ -365,8 +349,6 @@ config BOOT_SIGNATURE_KEY_FILE
365349
with the public key information will be written in a format expected by
366350
MCUboot.
367351

368-
endif
369-
370352
config MCUBOOT_CLEANUP_ARM_CORE
371353
bool "Perform core cleanup before chain-load the application"
372354
depends on CPU_CORTEX_M
@@ -389,14 +371,6 @@ config MCUBOOT_CLEANUP_RAM
389371
help
390372
Sets contents of memory to 0 before jumping to application.
391373

392-
# Disable MBEDTLS from being selected if NRF_SECURITY is enabled, and use default NRF_SECURITY
393-
# configuration file for MBEDTLS
394-
config MBEDTLS
395-
depends on !NRF_SECURITY
396-
397-
config NRF_SECURITY
398-
select MBEDTLS_PROMPTLESS
399-
400374
config MBEDTLS_CFG_FILE
401375
# It might be awkward to define an Mbed TLS header file when TinyCrypt
402376
# is used, but the fact is that Mbed TLS' ASN1 parse module is used

0 commit comments

Comments
 (0)