Skip to content

Commit d5e402e

Browse files
danielinuxdanielinux
committed
Removing compile-time parameters from keygen
1 parent 7132a13 commit d5e402e

File tree

6 files changed

+68
-61
lines changed

6 files changed

+68
-61
lines changed

‎Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ ifeq ($(TARGET),ti_hercules)
8686
endif
8787

8888
# Environment variables for sign tool
89-
SIGN_ENV=IMAGE_HEADER_SIZE=$(IMAGE_HEADER_SIZE) WOLFBOOT_SECTOR_SIZE=$(WOLFBOOT_SECTOR_SIZE)
89+
SIGN_ENV=IMAGE_HEADER_SIZE=$(IMAGE_HEADER_SIZE) WOLFBOOT_SECTOR_SIZE=$(WOLFBOOT_SECTOR_SIZE) ML_DSA_LEVEL=$(ML_DSA_LEVEL) IMAGE_SIGNATURE_SIZE=$(IMAGE_SIGNATURE_SIZE)
9090

9191

9292
MAIN_TARGET=factory.bin
@@ -208,15 +208,15 @@ keytools_check: keytools
208208

209209
$(PRIVATE_KEY):
210210
$(Q)$(MAKE) keytools_check
211-
$(Q)(test $(SIGN) = NONE) || ("$(KEYGEN_TOOL)" $(KEYGEN_OPTIONS) -g $(PRIVATE_KEY)) || true
211+
$(Q)(test $(SIGN) = NONE) || ($(SIGN_ENV) "$(KEYGEN_TOOL)" $(KEYGEN_OPTIONS) -g $(PRIVATE_KEY)) || true
212212
$(Q)(test $(SIGN) = NONE) && (echo "// SIGN=NONE" > src/keystore.c) || true
213213
$(Q)(test "$(FLASH_OTP_KEYSTORE)" = "1") && (make -C tools/keytools/otp) || true
214214

215215
$(SECONDARY_PRIVATE_KEY): $(PRIVATE_KEY) keystore.der
216216
$(Q)$(MAKE) keytools_check
217217
$(Q)rm -f src/keystore.c
218218
$(Q)dd if=keystore.der of=pubkey_1.der bs=1 skip=16
219-
$(Q)(test $(SIGN_SECONDARY) = NONE) || ("$(KEYGEN_TOOL)" \
219+
$(Q)(test $(SIGN_SECONDARY) = NONE) || ($(SIGN_ENV) "$(KEYGEN_TOOL)" \
220220
$(KEYGEN_OPTIONS) -i pubkey_1.der $(SECONDARY_KEYGEN_OPTIONS) \
221221
-g $(SECONDARY_PRIVATE_KEY)) || true
222222
$(Q)(test "$(FLASH_OTP_KEYSTORE)" = "1") && (make -C tools/keytools/otp) || true

‎include/wolfboot/wolfboot.h‎

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -138,21 +138,17 @@ extern "C" {
138138
/* ML-DSA pub key size is a function of parameters.
139139
* This needs to be configurable. Default to security
140140
* category 2. */
141-
#ifdef ML_DSA_LEVEL
142-
#if ML_DSA_LEVEL == 2
143-
#define KEYSTORE_PUBKEY_SIZE_ML_DSA 1312
144-
#elif ML_DSA_LEVEL == 3
145-
#define KEYSTORE_PUBKEY_SIZE_ML_DSA 1952
146-
#elif ML_DSA_LEVEL == 5
147-
#define KEYSTORE_PUBKEY_SIZE_ML_DSA 2592
148-
#endif
149-
#else
150-
#ifdef SIGN_ML_DSA
151-
#error "ML_DSA_LEVEL not defined"
152-
#endif
153-
/* Default to max size for keystore */
154-
#define KEYSTORE_PUBKEY_SIZE_ML_DSA 2592
155-
#endif /* defined ML_DSA_LEVEL */
141+
142+
#define ML_DSA_L2_PUBKEY_SIZE 1312
143+
#define ML_DSA_L3_PUBKEY_SIZE 1952
144+
#define ML_DSA_L5_PUBKEY_SIZE 2592
145+
146+
147+
#if defined(SIGN_ML_DSA) && !defined(ML_DSA_LEVEL)
148+
#define ML_DSA_LEVEL 5
149+
#endif
150+
/* Default to max size for keystore */
151+
#define KEYSTORE_PUBKEY_SIZE_ML_DSA 2592
156152

157153
/* Mask for key permissions */
158154
#define KEY_VERIFY_ALL (0xFFFFFFFFU)

‎tools/keytools/Makefile‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ LDFLAGS =
1717
OBJDIR = ./
1818
LIBS =
1919

20-
ML_DSA_LEVEL?=2
20+
ML_DSA_LEVEL?=5
21+
CFLAGS+=-DML_DSA_LEVEL=$(ML_DSA_LEVEL)
2122

2223
LMS_LEVELS?=1
2324
LMS_HEIGHT?=10
@@ -33,6 +34,9 @@ CFLAGS +=-DWOLFBOOT_SIGN_LMS -DWOLFSSL_HAVE_LMS \
3334
# LMS flags
3435
CFLAGS +=-DWOLFSSL_WC_LMS
3536

37+
# ML_DSA flags
38+
CFLAGS +=-DWOLFSSL_HAVE_DILITHIUM
39+
3640
# XMSS flags
3741
CFLAGS +=-DWOLFBOOT_SIGN_XMSS -DWOLFSSL_HAVE_XMSS \
3842
-D"IMAGE_SIGNATURE_SIZE"=$(IMAGE_SIGNATURE_SIZE) \
@@ -111,10 +115,6 @@ OBJS_REAL+=\
111115
$(WOLFDIR)/wolfcrypt/src/wc_xmss_impl.o
112116
OBJS_REAL+=$(WOLFDIR)/wolfcrypt/src/dilithium.o
113117

114-
CFLAGS += -D"WOLFBOOT_SIGN_ML_DSA" \
115-
-D"IMAGE_SIGNATURE_SIZE"=$(IMAGE_SIGNATURE_SIZE) \
116-
-D"ML_DSA_LEVEL"=$(ML_DSA_LEVEL)
117-
118118
OBJS_VIRT=$(addprefix $(OBJDIR), $(notdir $(OBJS_REAL)))
119119
vpath %.c $(WOLFDIR)/wolfcrypt/src/
120120
vpath %.c $(WOLFBOOTDIR)/src/

‎tools/keytools/keygen.c‎

Lines changed: 38 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -451,15 +451,35 @@ static uint32_t get_pubkey_size(uint32_t keyType)
451451
case KEYGEN_XMSS:
452452
size = KEYSTORE_PUBKEY_SIZE_XMSS;
453453
break;
454-
#ifdef KEYSTORE_PUBKEY_SIZE_ML_DSA
455454
case KEYGEN_ML_DSA:
456-
size = KEYSTORE_PUBKEY_SIZE_ML_DSA;
455+
{
456+
char *env_ml_dsa_level = getenv("ML_DSA_LEVEL");
457+
if (env_ml_dsa_level == NULL) {
458+
fprintf(stderr, "warning: ML_DSA_LEVEL environment variable"
459+
" not set, assuming level 2\n");
460+
size = ML_DSA_L2_PUBKEY_SIZE;
461+
} else {
462+
int level = atoi(env_ml_dsa_level);
463+
switch (level) {
464+
case 2:
465+
size = ML_DSA_L2_PUBKEY_SIZE;
466+
break;
467+
case 3:
468+
size = ML_DSA_L3_PUBKEY_SIZE;
469+
break;
470+
case 5:
471+
size = ML_DSA_L5_PUBKEY_SIZE;
472+
break;
473+
default:
474+
fprintf(stderr, "error: invalid ML_DSA_LEVEL: %d\n", level);
475+
exit(1);
476+
}
477+
}
457478
break;
458-
#endif
459479
default:
460480
size = 0;
481+
}
461482
}
462-
463483
return size;
464484
}
465485

@@ -520,7 +540,6 @@ void keystore_add(uint32_t ktype, uint8_t *key, uint32_t sz, const char *keyfile
520540
}
521541

522542

523-
#if !defined(NO_RSA) && defined(WOLFSSL_KEY_GEN)
524543
static void keygen_rsa(const char *keyfile, int kbits, uint32_t id_mask)
525544
{
526545
RsaKey k;
@@ -570,9 +589,7 @@ static void keygen_rsa(const char *keyfile, int kbits, uint32_t id_mask)
570589
else if (kbits == 4096)
571590
keystore_add(KEYGEN_RSA4096, pub_der, publen, keyfile, id_mask);
572591
}
573-
#endif
574592

575-
#ifdef HAVE_ECC
576593
#define MAX_ECC_KEY_SIZE 66
577594

578595
static void keygen_ecc(const char *priv_fname, uint16_t ecc_key_size,
@@ -676,10 +693,8 @@ static void keygen_ecc(const char *priv_fname, uint16_t ecc_key_size,
676693
else if (ecc_key_size == 66)
677694
keystore_add(KEYGEN_ECC521, k_buffer, 2 * ecc_key_size, priv_fname, id_mask);
678695
}
679-
#endif
680696

681697

682-
#ifdef HAVE_ED25519
683698
static void keygen_ed25519(const char *privkey, uint32_t id_mask)
684699
{
685700
ed25519_key k;
@@ -716,9 +731,7 @@ static void keygen_ed25519(const char *privkey, uint32_t id_mask)
716731

717732
keystore_add(KEYGEN_ED25519, pub, ED25519_PUB_KEY_SIZE, privkey, id_mask);
718733
}
719-
#endif
720734

721-
#ifdef HAVE_ED448
722735
static void keygen_ed448(const char *privkey, uint32_t id_mask)
723736
{
724737
ed448_key k;
@@ -755,9 +768,7 @@ static void keygen_ed448(const char *privkey, uint32_t id_mask)
755768

756769
keystore_add(KEYGEN_ED448, pub, ED448_PUB_KEY_SIZE, privkey, id_mask);
757770
}
758-
#endif
759771

760-
#if defined(WOLFSSL_HAVE_LMS)
761772
#include "../lms/lms_common.h"
762773

763774
static void keygen_lms(const char *priv_fname, uint32_t id_mask)
@@ -844,9 +855,7 @@ static void keygen_lms(const char *priv_fname, uint32_t id_mask)
844855

845856
wc_LmsKey_Free(&key);
846857
}
847-
#endif /* if defined(WOLFSSL_HAVE_LMS) */
848858

849-
#if defined(WOLFSSL_HAVE_XMSS)
850859
#include "../xmss/xmss_common.h"
851860

852861
static void keygen_xmss(const char *priv_fname, uint32_t id_mask)
@@ -942,9 +951,7 @@ static void keygen_xmss(const char *priv_fname, uint32_t id_mask)
942951

943952
wc_XmssKey_Free(&key);
944953
}
945-
#endif /* if defined(WOLFSSL_HAVE_XMSS) */
946954

947-
#if defined(WOLFSSL_WC_DILITHIUM)
948955

949956
static void keygen_ml_dsa(const char *priv_fname, uint32_t id_mask)
950957
{
@@ -957,17 +964,24 @@ static void keygen_ml_dsa(const char *priv_fname, uint32_t id_mask)
957964
word32 pub_len = 0;
958965
int ml_dsa_priv_len = 0;
959966
int ml_dsa_pub_len = 0;
967+
int ml_dsa_level = ML_DSA_LEVEL;
968+
char * env_ml_dsa_level = getenv("ML_DSA_LEVEL");
969+
if (env_ml_dsa_level != NULL) {
970+
ml_dsa_level = atoi(env_ml_dsa_level);
971+
}
972+
973+
fprintf(stderr, "info: using DSA level %d\n", ml_dsa_level);
960974

961975
ret = wc_MlDsaKey_Init(&key, NULL, INVALID_DEVID);
962976
if (ret != 0) {
963977
fprintf(stderr, "error: wc_MlDsaKey_Init returned %d\n", ret);
964978
exit(1);
965979
}
966980

967-
ret = wc_MlDsaKey_SetParams(&key, ML_DSA_LEVEL);
981+
ret = wc_MlDsaKey_SetParams(&key, ml_dsa_level);
968982
if (ret != 0) {
969983
fprintf(stderr, "error: wc_MlDsaKey_SetParams(%d) returned %d\n",
970-
ML_DSA_LEVEL, ret);
984+
ml_dsa_level, ret);
971985
exit(1);
972986
}
973987

@@ -985,6 +999,7 @@ static void keygen_ml_dsa(const char *priv_fname, uint32_t id_mask)
985999
ret);
9861000
exit(1);
9871001
}
1002+
printf("info: ml-dsa public key length: %d\n", ml_dsa_pub_len);
9881003

9891004
/* Get the ML-DSA private key length. This API returns
9901005
* the public + private length. */
@@ -994,6 +1009,7 @@ static void keygen_ml_dsa(const char *priv_fname, uint32_t id_mask)
9941009
ret);
9951010
exit(1);
9961011
}
1012+
printf("info: ml-dsa private key length: %d\n", ml_dsa_priv_len);
9971013

9981014
if (ml_dsa_priv_len <= ml_dsa_pub_len) {
9991015
printf("error: ml-dsa: unexpected key lengths: %d, %d",
@@ -1026,9 +1042,9 @@ static void keygen_ml_dsa(const char *priv_fname, uint32_t id_mask)
10261042
exit(1);
10271043
}
10281044

1029-
if (pub_len != sizeof(pub)) {
1045+
if ((int)pub_len != ml_dsa_pub_len) {
10301046
fprintf(stderr, "error: wc_MlDsaKey_ExportPubRaw returned pub_len=%d, " \
1031-
"expected %zu\n", pub_len, sizeof(pub));
1047+
"expected %d\n", pub_len, ml_dsa_pub_len);
10321048
exit(1);
10331049
}
10341050

@@ -1050,14 +1066,13 @@ static void keygen_ml_dsa(const char *priv_fname, uint32_t id_mask)
10501066
fwrite(pub, pub_len, 1, fpriv);
10511067
fclose(fpriv);
10521068

1053-
keystore_add(KEYGEN_ML_DSA, pub, KEYSTORE_PUBKEY_SIZE_ML_DSA,
1069+
keystore_add(KEYGEN_ML_DSA, pub, pub_len,
10541070
priv_fname, id_mask);
10551071

10561072
wc_MlDsaKey_Free(&key);
10571073
free(priv);
10581074
priv = NULL;
10591075
}
1060-
#endif /* if defined(WOLFSSL_WC_DILITHIUM) */
10611076

10621077
static void key_gen_check(const char *kfilename)
10631078
{

‎tools/keytools/user_settings.h‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -74,19 +74,17 @@
7474
#undef NO_SHA256
7575

7676
/* ML-DSA (dilithium) */
77-
#if defined(WOLFBOOT_SIGN_ML_DSA)
78-
# define HAVE_DILITHIUM
79-
# define WOLFSSL_WC_DILITHIUM
80-
# define WOLFSSL_EXPERIMENTAL_SETTINGS
81-
/* Wolfcrypt builds ML-DSA (dilithium) to the FIPS 204 final
82-
* standard by default. Uncomment this if you want the draft
83-
* version instead. */
84-
#if 0
85-
#define WOLFSSL_DILITHIUM_FIPS204_DRAFT
86-
#endif
87-
/* dilithium needs these sha functions. */
88-
# define WOLFSSL_SHAKE128
89-
#endif /* WOLFBOOT_SIGN_ML_DSA */
77+
#define HAVE_DILITHIUM
78+
#define WOLFSSL_WC_DILITHIUM
79+
#define WOLFSSL_EXPERIMENTAL_SETTINGS
80+
/* Wolfcrypt builds ML-DSA (dilithium) to the FIPS 204 final
81+
* standard by default. Uncomment this if you want the draft
82+
* version instead. */
83+
#if 0
84+
#define WOLFSSL_DILITHIUM_FIPS204_DRAFT
85+
#endif
86+
/* dilithium needs these sha functions. */
87+
#define WOLFSSL_SHAKE128
9088

9189
/* ASN */
9290
#define WOLFSSL_ASN_TEMPLATE

‎tools/test-renode.mk‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,6 @@ else
3636
SIGN_TOOL?=$(WOLFBOOT_ROOT)/tools/keytools/sign
3737
endif
3838

39-
SIGN_ENV=IMAGE_HEADER_SIZE=$(IMAGE_HEADER_SIZE) WOLFBOOT_SECTOR_SIZE=$(WOLFBOOT_SECTOR_SIZE)
40-
4139
ifeq ($(TARGET),stm32f7)
4240
RENODE_CONFIG=tools/renode/stm32f746_wolfboot.resc
4341
POFF=393211

0 commit comments

Comments
 (0)