Skip to content

Add secboot example#132

Merged
bigbrett merged 7 commits intowolfSSL:mainfrom
billphipps:add_secboot_example
Jul 24, 2025
Merged

Add secboot example#132
bigbrett merged 7 commits intowolfSSL:mainfrom
billphipps:add_secboot_example

Conversation

@billphipps
Copy link
Contributor

@billphipps billphipps commented Jul 10, 2025

Adds 3 additional examples into the client demos:

  1. provision: Generates server private key, measures example file (/bin/sh), and pushes signature into nvm
  2. sec boot: Simulates a secure boot by measuring a file, and using the NVM-stored key and signature
  3. zeroize: Simulates a zeroization where the provisioning keys are destroyed.

Added crypto examples for 5 different usage context:

  1. Local client crypto
  2. Remote client crypto
  3. Local server crypto
  4. Server HW crypto
  5. Default to hardware handling for server

This comment was marked as outdated.

Copy link
Contributor

@bigbrett bigbrett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we make these new functionalities self-contained demos in the demo directory, rather than done inline in the client example driver?

@billphipps
Copy link
Contributor Author

Can we make these new functionalities self-contained demos in the demo directory, rather than done inline in the client example driver?

Concur. Great idea. I'll switch this to draft as I rework.

@billphipps billphipps marked this pull request as draft July 10, 2025 17:08
@billphipps billphipps marked this pull request as ready for review July 14, 2025 17:53
@billphipps billphipps requested review from bigbrett and Copilot July 14, 2025 19:02
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR enriches the wolfHSM demos by adding a full secure-boot workflow (provision, boot, zeroize), extends the TCP client/server examples with multiple crypto contexts, and standardizes demo header guards.

  • Added secure-boot examples (wh_demo_client_secboot.c) with provisioning, measurement, signing, verification, and zeroization.
  • Extended wh_server_tcp.c and wh_client_tcp.c to showcase software/hardware RNG contexts and added shared sleep/hex-dump helpers.
  • Renamed and unified header guards across all demo client headers and updated the demo driver to invoke the new examples.

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

Show a summary per file
File Description
examples/posix/tcp/wh_server_tcp/wh_server_tcp.c Added _SleepMs, _HexDump, hardware RNG callback, and server crypto contexts for demos
examples/posix/tcp/wh_client_tcp/wh_client_tcp.c Added _SleepMs, _HexDump and two client RNG contexts
examples/demo/client/wh_demo_client_wctest.h Updated include guard to DEMO_CLIENT_WCTEST_H_
examples/demo/client/wh_demo_client_wctest.c Fixed include from counter to wctest header
examples/demo/client/wh_demo_client_wcbench.h Updated include guard to DEMO_CLIENT_WCBENCH_H_
examples/demo/client/wh_demo_client_secboot.h Introduced secure-boot demo function declarations
examples/demo/client/wh_demo_client_secboot.c Implemented provisioning, boot, and zeroize workflows
examples/demo/client/wh_demo_client_nvm.h Updated include guard to DEMO_CLIENT_NVM_H_
examples/demo/client/wh_demo_client_nvm.c Reordered and cleaned up includes
examples/demo/client/wh_demo_client_keystore.h Updated include guard to DEMO_CLIENT_KEYSTORE_H_
examples/demo/client/wh_demo_client_keystore.c Reordered and cleaned up includes
examples/demo/client/wh_demo_client_crypto.h Updated include guard to DEMO_CLIENT_CRYPTO_H_
examples/demo/client/wh_demo_client_crypto.c Reordered and cleaned up includes
examples/demo/client/wh_demo_client_counter.h Updated include guard to DEMO_CLIENT_COUNTER_H_
examples/demo/client/wh_demo_client_counter.c Fixed include order
examples/demo/client/wh_demo_client_all.h Updated include guard to DEMO_CLIENT_ALL_H_
examples/demo/client/wh_demo_client_all.c Added SecBoot routines to the demo driver

Copy link
Contributor

@bigbrett bigbrett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good addition. One typo that needs to be fixed, and a few other small things that could be punted or addressed

@billphipps billphipps requested a review from bigbrett July 24, 2025 14:10
@bigbrett bigbrett merged commit d84fcb0 into wolfSSL:main Jul 24, 2025
6 checks passed
@billphipps billphipps deleted the add_secboot_example branch August 12, 2025 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants