|
4 | 4 | # |
5 | 5 | # SPDX-License-Identifier: LicenseRef-Nordic-5-Clause |
6 | 6 |
|
7 | | -from ecdsa import SigningKey, NIST256p |
| 7 | +import operator |
8 | 8 | import random |
| 9 | +import sys |
9 | 10 | from hashlib import sha256 |
10 | | -import operator |
11 | 11 | from os import linesep as ls |
12 | | -import sys |
| 12 | + |
| 13 | +from ecdsa import NIST256p, SigningKey |
13 | 14 |
|
14 | 15 |
|
15 | 16 | def c_code_declare_array(name, array): |
16 | | - return "uint8_t %s[] = {%s};%s" % (name, ", ".join([hex(c) for c in array]), ls+ls) |
| 17 | + return "uint8_t {}[] = {{{}}};{}".format(name, ", ".join([hex(c) for c in array]), ls+ls) |
17 | 18 |
|
18 | 19 | def arr_to_hexstr(arr): |
19 | | - return b''.join([bytes([x]) for x in arr]) |
| 20 | + return b''.join([bytes([x]) for x in arr]) |
20 | 21 |
|
21 | 22 | def hexstr_to_array(hexstr): |
22 | | - ret_str = "" |
23 | | - for byte in map(operator.add, hexstr[::2], hexstr[1::2]): |
24 | | - ret_str += "0x"+byte+"," |
25 | | - return ret_str[:-1] |
| 23 | + ret_str = "" |
| 24 | + for byte in map(operator.add, hexstr[::2], hexstr[1::2]): |
| 25 | + ret_str += "0x"+byte+"," |
| 26 | + return ret_str[:-1] |
26 | 27 |
|
27 | 28 | if __name__ == "__main__": |
28 | | - firmware = bytearray(random.randint(0, 255) for _ in range(random.randrange(4, 1000))) |
29 | | - firmware_hash = sha256(firmware).digest() |
30 | | - metadata = b"a%sb" % firmware_hash |
31 | | - priv = SigningKey.generate(curve=NIST256p) |
32 | | - pub = priv.get_verifying_key() |
33 | | - sig = priv.sign(firmware_hash, hashfunc = sha256) |
34 | | - pub_hash = sha256(pub.to_string()).digest() |
35 | | - |
36 | | - with open('fw_data.bin', 'rb') as f: |
37 | | - fw_hex = f.read() |
38 | | - |
39 | | - fw_sk = SigningKey.generate(curve=NIST256p, hashfunc = sha256) |
40 | | - fw_vk = fw_sk.get_verifying_key() |
41 | | - generated_sig = fw_sk.sign(fw_hex, hashfunc = sha256) |
42 | | - fw_hash = sha256(fw_hex).hexdigest() |
43 | | - fw_hash = hexstr_to_array(fw_hash) |
44 | | - gen_sig = hexstr_to_array(generated_sig.hex()) |
45 | | - |
46 | | - fw_x = fw_vk.pubkey.point.x() |
47 | | - fw_pubkey_x = hexstr_to_array(fw_x.to_bytes(32, "big").hex()) |
48 | | - fw_y = fw_vk.pubkey.point.y() |
49 | | - fw_pubkey_y = hexstr_to_array(fw_y.to_bytes(32, "big").hex()) |
50 | | - fw_pubkey = fw_pubkey_x +","+ fw_pubkey_y |
51 | | - |
52 | | - assert fw_vk.verify(generated_sig, fw_hex, hashfunc = sha256) |
53 | | - |
54 | | - sk = SigningKey.generate(curve=NIST256p, hashfunc = sha256) |
55 | | - vk = sk.get_verifying_key() |
56 | | - my_hash = b"breadcrumb" |
57 | | - my_hash_array = hexstr_to_array(my_hash.hex()) |
58 | | - breadcrumb = sha256(b"breadcrumb") |
59 | | - sha256_hash = hexstr_to_array(breadcrumb.hexdigest()) |
60 | | - |
61 | | - signature = sk.sign(my_hash) |
62 | | - r = signature[:int(len(signature)/2)] |
63 | | - s = signature[int(len(signature)/2):] |
64 | | - sig_r = hexstr_to_array(r.hex()) |
65 | | - sig_s = hexstr_to_array(s.hex()) |
66 | | - sig_concat = hexstr_to_array(signature.hex()) |
67 | | - |
68 | | - x = vk.pubkey.point.x() |
69 | | - pubkey_x = hexstr_to_array(x.to_bytes(32, "big").hex()) |
70 | | - y = vk.pubkey.point.y() |
71 | | - pubkey_y = hexstr_to_array(y.to_bytes(32, "big").hex()) |
72 | | - |
73 | | - pubkey_concat = pubkey_x + "," + pubkey_y |
74 | | - |
75 | | - mcuboot_key = [0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, |
76 | | - 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, |
77 | | - 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, |
78 | | - 0x42, 0x00, 0x04, 0x2a, 0xcb, 0x40, 0x3c, 0xe8, |
79 | | - 0xfe, 0xed, 0x5b, 0xa4, 0x49, 0x95, 0xa1, 0xa9, |
80 | | - 0x1d, 0xae, 0xe8, 0xdb, 0xbe, 0x19, 0x37, 0xcd, |
81 | | - 0x14, 0xfb, 0x2f, 0x24, 0x57, 0x37, 0xe5, 0x95, |
82 | | - 0x39, 0x88, 0xd9, 0x94, 0xb9, 0xd6, 0x5a, 0xeb, |
83 | | - 0xd7, 0xcd, 0xd5, 0x30, 0x8a, 0xd6, 0xfe, 0x48, 0xb2, 0x4a, 0x6a, 0x81, 0x0e, 0xe5, 0xf0, 0x7d, |
84 | | - 0x8b, 0x68, 0x34, 0xcc, 0x3a, 0x6a, 0xfc, 0x53, |
85 | | - 0x8e, 0xfa, 0xc1] |
86 | | - |
87 | | - mcuboot_key_hash = sha256(b''.join(bytes([x]) for x in mcuboot_key)) |
88 | | - mcuboot_key_hash = hexstr_to_array(mcuboot_key_hash.hexdigest()) |
89 | | - |
90 | | - mcuboot_key = b''.join(bytes([x]) for x in mcuboot_key) |
91 | | - mcuboot_key = hexstr_to_array(mcuboot_key.hex()) |
92 | | - |
93 | | - long_input = b'a' * 100000 |
94 | | - long_input_hash = hexstr_to_array(sha256(long_input).hexdigest()) |
95 | | - long_input = hexstr_to_array(long_input.hex()) |
96 | | - |
97 | | - fw_sig = b'ac95651230dee1b857d29971fd5177cf4536ee4a819abaec950cccae27548a3823ff093cc2a64a8dab7f4df73dec98' |
98 | | - |
99 | | - assert vk.verify(signature, my_hash) |
100 | | - |
101 | | - with open(sys.argv[1], 'w') as f: |
102 | | - f.write(c_code_declare_array("pk_hash", pub_hash)) |
103 | | - f.write(c_code_declare_array("pk", pub.to_string())) |
104 | | - f.write(c_code_declare_array("sig", sig)) |
105 | | - f.write(c_code_declare_array("firmware_hash", firmware_hash)) |
106 | | - f.write(c_code_declare_array("firmware", firmware)) |
107 | | - f.write(c_code_declare_array("pub_x", pubkey_x)) |
108 | | - f.write(c_code_declare_array("pub_y", pubkey_y)) |
109 | | - f.write(c_code_declare_array("pub_concat", pubkey_concat)) |
110 | | - f.write(c_code_declare_array("const_pub_concat", pubkey_concat)) |
111 | | - f.write(c_code_declare_array("sig_r", sig_r)) |
112 | | - f.write(c_code_declare_array("sig_s", sig_s)) |
113 | | - f.write(c_code_declare_array("sig_concat", sig_concat)) |
114 | | - f.write(c_code_declare_array("const_sig_concat", sig_concat)) |
115 | | - f.write(c_code_declare_array("hash", my_hash_array)) |
116 | | - f.write(c_code_declare_array("const_hash", my_hash_array)) |
117 | | - f.write(c_code_declare_array("hash_sha256", sha256_hash)) |
118 | | - f.write(c_code_declare_array("const_hash_sha256", sha256_hash)) |
119 | | - f.write(c_code_declare_array("mcuboot_key", mcuboot_key)) |
120 | | - f.write(c_code_declare_array("const_mcuboot_key", mcuboot_key)) |
121 | | - f.write(c_code_declare_array("mcuboot_key_hash", mcuboot_key_hash)) |
122 | | - f.write(c_code_declare_array("long_input", long_input)) |
123 | | - f.write(c_code_declare_array("const_long_input", long_input)) |
124 | | - f.write(c_code_declare_array("long_input_hash", long_input_hash)) |
125 | | - f.write(c_code_declare_array("image_fw_data", hexstr_to_array(fw_hex.hex()))) |
126 | | - f.write(c_code_declare_array("image_fw_sig", hexstr_to_array(fw_sig_hex.hex()))) |
127 | | - f.write(c_code_declare_array("image_gen_sig", gen_sig)) |
128 | | - f.write(c_code_declare_array("image_public_key", fw_pubkey)) |
129 | | - f.write(c_code_declare_array("image_fw_hash", fw_hash)) |
130 | | - f.write(c_code_declare_array("const_fw_sig", hexstr_to_array(fw_sig_hex.hex()))) |
131 | | - f.write(c_code_declare_array("const_gen_sig", gen_sig)) |
132 | | - f.write(c_code_declare_array("const_public_key", fw_pubkey)) |
133 | | - f.write(c_code_declare_array("const_fw_hash", fw_hash)) |
134 | | - f.write(c_code_declare_array("const_fw_data", hexstr_to_array(fw_hex.hex()))) |
| 29 | + firmware = bytearray(random.randint(0, 255) for _ in range(random.randrange(4, 1000))) |
| 30 | + firmware_hash = sha256(firmware).digest() |
| 31 | + metadata = b"a%sb" % firmware_hash |
| 32 | + priv = SigningKey.generate(curve=NIST256p) |
| 33 | + pub = priv.get_verifying_key() |
| 34 | + sig = priv.sign(firmware_hash, hashfunc = sha256) |
| 35 | + pub_hash = sha256(pub.to_string()).digest() |
| 36 | + |
| 37 | + with open('fw_data.bin', 'rb') as f: |
| 38 | + fw_hex = f.read() |
| 39 | + |
| 40 | + fw_sk = SigningKey.generate(curve=NIST256p, hashfunc = sha256) |
| 41 | + fw_vk = fw_sk.get_verifying_key() |
| 42 | + generated_sig = fw_sk.sign(fw_hex, hashfunc = sha256) |
| 43 | + fw_hash = sha256(fw_hex).hexdigest() |
| 44 | + fw_hash = hexstr_to_array(fw_hash) |
| 45 | + gen_sig = hexstr_to_array(generated_sig.hex()) |
| 46 | + |
| 47 | + fw_x = fw_vk.pubkey.point.x() |
| 48 | + fw_pubkey_x = hexstr_to_array(fw_x.to_bytes(32, "big").hex()) |
| 49 | + fw_y = fw_vk.pubkey.point.y() |
| 50 | + fw_pubkey_y = hexstr_to_array(fw_y.to_bytes(32, "big").hex()) |
| 51 | + fw_pubkey = fw_pubkey_x +","+ fw_pubkey_y |
| 52 | + |
| 53 | + assert fw_vk.verify(generated_sig, fw_hex, hashfunc = sha256) |
| 54 | + |
| 55 | + sk = SigningKey.generate(curve=NIST256p, hashfunc = sha256) |
| 56 | + vk = sk.get_verifying_key() |
| 57 | + my_hash = b"breadcrumb" |
| 58 | + my_hash_array = hexstr_to_array(my_hash.hex()) |
| 59 | + breadcrumb = sha256(b"breadcrumb") |
| 60 | + sha256_hash = hexstr_to_array(breadcrumb.hexdigest()) |
| 61 | + |
| 62 | + signature = sk.sign(my_hash) |
| 63 | + r = signature[:int(len(signature)/2)] |
| 64 | + s = signature[int(len(signature)/2):] |
| 65 | + sig_r = hexstr_to_array(r.hex()) |
| 66 | + sig_s = hexstr_to_array(s.hex()) |
| 67 | + sig_concat = hexstr_to_array(signature.hex()) |
| 68 | + |
| 69 | + x = vk.pubkey.point.x() |
| 70 | + pubkey_x = hexstr_to_array(x.to_bytes(32, "big").hex()) |
| 71 | + y = vk.pubkey.point.y() |
| 72 | + pubkey_y = hexstr_to_array(y.to_bytes(32, "big").hex()) |
| 73 | + |
| 74 | + pubkey_concat = pubkey_x + "," + pubkey_y |
| 75 | + |
| 76 | + mcuboot_key = [0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, |
| 77 | + 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, |
| 78 | + 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, |
| 79 | + 0x42, 0x00, 0x04, 0x2a, 0xcb, 0x40, 0x3c, 0xe8, |
| 80 | + 0xfe, 0xed, 0x5b, 0xa4, 0x49, 0x95, 0xa1, 0xa9, |
| 81 | + 0x1d, 0xae, 0xe8, 0xdb, 0xbe, 0x19, 0x37, 0xcd, |
| 82 | + 0x14, 0xfb, 0x2f, 0x24, 0x57, 0x37, 0xe5, 0x95, |
| 83 | + 0x39, 0x88, 0xd9, 0x94, 0xb9, 0xd6, 0x5a, 0xeb, |
| 84 | + 0xd7, 0xcd, 0xd5, 0x30, 0x8a, 0xd6, 0xfe, 0x48, 0xb2, 0x4a, 0x6a, 0x81, 0x0e, 0xe5, 0xf0, 0x7d, |
| 85 | + 0x8b, 0x68, 0x34, 0xcc, 0x3a, 0x6a, 0xfc, 0x53, |
| 86 | + 0x8e, 0xfa, 0xc1] |
| 87 | + |
| 88 | + mcuboot_key_hash = sha256(b''.join(bytes([x]) for x in mcuboot_key)) |
| 89 | + mcuboot_key_hash = hexstr_to_array(mcuboot_key_hash.hexdigest()) |
| 90 | + |
| 91 | + mcuboot_key = b''.join(bytes([x]) for x in mcuboot_key) |
| 92 | + mcuboot_key = hexstr_to_array(mcuboot_key.hex()) |
| 93 | + |
| 94 | + long_input = b'a' * 100000 |
| 95 | + long_input_hash = hexstr_to_array(sha256(long_input).hexdigest()) |
| 96 | + long_input = hexstr_to_array(long_input.hex()) |
| 97 | + |
| 98 | + fw_sig = b'ac95651230dee1b857d29971fd5177cf4536ee4a819abaec950cccae27548a3823ff093cc2a64a8dab7f4df73dec98' |
| 99 | + |
| 100 | + assert vk.verify(signature, my_hash) |
| 101 | + |
| 102 | + with open(sys.argv[1], 'w') as f: |
| 103 | + f.write(c_code_declare_array("pk_hash", pub_hash)) |
| 104 | + f.write(c_code_declare_array("pk", pub.to_string())) |
| 105 | + f.write(c_code_declare_array("sig", sig)) |
| 106 | + f.write(c_code_declare_array("firmware_hash", firmware_hash)) |
| 107 | + f.write(c_code_declare_array("firmware", firmware)) |
| 108 | + f.write(c_code_declare_array("pub_x", pubkey_x)) |
| 109 | + f.write(c_code_declare_array("pub_y", pubkey_y)) |
| 110 | + f.write(c_code_declare_array("pub_concat", pubkey_concat)) |
| 111 | + f.write(c_code_declare_array("const_pub_concat", pubkey_concat)) |
| 112 | + f.write(c_code_declare_array("sig_r", sig_r)) |
| 113 | + f.write(c_code_declare_array("sig_s", sig_s)) |
| 114 | + f.write(c_code_declare_array("sig_concat", sig_concat)) |
| 115 | + f.write(c_code_declare_array("const_sig_concat", sig_concat)) |
| 116 | + f.write(c_code_declare_array("hash", my_hash_array)) |
| 117 | + f.write(c_code_declare_array("const_hash", my_hash_array)) |
| 118 | + f.write(c_code_declare_array("hash_sha256", sha256_hash)) |
| 119 | + f.write(c_code_declare_array("const_hash_sha256", sha256_hash)) |
| 120 | + f.write(c_code_declare_array("mcuboot_key", mcuboot_key)) |
| 121 | + f.write(c_code_declare_array("const_mcuboot_key", mcuboot_key)) |
| 122 | + f.write(c_code_declare_array("mcuboot_key_hash", mcuboot_key_hash)) |
| 123 | + f.write(c_code_declare_array("long_input", long_input)) |
| 124 | + f.write(c_code_declare_array("const_long_input", long_input)) |
| 125 | + f.write(c_code_declare_array("long_input_hash", long_input_hash)) |
| 126 | + f.write(c_code_declare_array("image_fw_data", hexstr_to_array(fw_hex.hex()))) |
| 127 | + f.write(c_code_declare_array("image_fw_sig", hexstr_to_array(fw_sig_hex.hex()))) |
| 128 | + f.write(c_code_declare_array("image_gen_sig", gen_sig)) |
| 129 | + f.write(c_code_declare_array("image_public_key", fw_pubkey)) |
| 130 | + f.write(c_code_declare_array("image_fw_hash", fw_hash)) |
| 131 | + f.write(c_code_declare_array("const_fw_sig", hexstr_to_array(fw_sig_hex.hex()))) |
| 132 | + f.write(c_code_declare_array("const_gen_sig", gen_sig)) |
| 133 | + f.write(c_code_declare_array("const_public_key", fw_pubkey)) |
| 134 | + f.write(c_code_declare_array("const_fw_hash", fw_hash)) |
| 135 | + f.write(c_code_declare_array("const_fw_data", hexstr_to_array(fw_hex.hex()))) |
0 commit comments