From 529f0f2c0e1f6b22555626f945685039058fabb1 Mon Sep 17 00:00:00 2001 From: David Vincze Date: Fri, 26 Jul 2024 11:04:47 +0200 Subject: [PATCH 1/2] Reapply "boot: Add MCUBOOT_HW_KEY support for image encryption" This reverts commit c06f7bb36782e0220b30c3d0640219d1368735d3. Signed-off-by: David Vincze Change-Id: Ic2ab2c4d3981dec3cd3c25a50b5a989000375372 --- boot/bootutil/include/bootutil/enc_key.h | 13 +++++++++- boot/bootutil/src/encrypted.c | 30 ++++++++++++++++-------- boot/cypress/MCUBootApp/keys.c | 9 +++++++ boot/mbed/app_enc_keys.c | 9 +++++++ boot/zephyr/keys.c | 9 +++++++ ci/mynewt_keys/enc_kw/src/keys.c | 9 +++++++ ci/mynewt_keys/enc_rsa/src/keys.c | 9 +++++++ sim/mcuboot-sys/csupport/keys.c | 9 +++++++ 8 files changed, 86 insertions(+), 11 deletions(-) diff --git a/boot/bootutil/include/bootutil/enc_key.h b/boot/bootutil/include/bootutil/enc_key.h index 8db6e72c8..297381fbb 100644 --- a/boot/bootutil/include/bootutil/enc_key.h +++ b/boot/bootutil/include/bootutil/enc_key.h @@ -32,6 +32,7 @@ #include #include "bootutil/crypto/aes_ctr.h" #include "bootutil/image.h" +#include "bootutil/sign_key.h" #include "bootutil/enc_key_public.h" #ifdef __cplusplus @@ -45,7 +46,17 @@ struct enc_key_data { bootutil_aes_ctr_context aes_ctr; }; -extern const struct bootutil_key bootutil_enc_key; +/** + * Retrieve the private key for image encryption. + * + * @param[out] private_key structure to store the private key and + * its length. + * + * @return 0 on success; nonzero on failure. + * + */ +int boot_enc_retrieve_private_key(struct bootutil_key **private_key); + struct boot_status; /* Decrypt random, symmetric encryption key */ diff --git a/boot/bootutil/src/encrypted.c b/boot/bootutil/src/encrypted.c index f3516ac74..ea73b172f 100644 --- a/boot/bootutil/src/encrypted.c +++ b/boot/bootutil/src/encrypted.c @@ -67,13 +67,13 @@ static int bootutil_constant_time_compare(const uint8_t *a, const uint8_t *b, si #if defined(MCUBOOT_ENCRYPT_KW) static int -key_unwrap(const uint8_t *wrapped, uint8_t *enckey) +key_unwrap(const uint8_t *wrapped, uint8_t *enckey, struct bootutil_key *bootutil_enc_key) { bootutil_aes_kw_context aes_kw; int rc; bootutil_aes_kw_init(&aes_kw); - rc = bootutil_aes_kw_set_unwrap_key(&aes_kw, bootutil_enc_key.key, *bootutil_enc_key.len); + rc = bootutil_aes_kw_set_unwrap_key(&aes_kw, bootutil_enc_key->key, *bootutil_enc_key->len); if (rc != 0) { goto done; } @@ -441,13 +441,23 @@ boot_decrypt_key(const uint8_t *buf, uint8_t *enckey) uint8_t counter[BOOTUTIL_CRYPTO_AES_CTR_BLOCK_SIZE]; uint16_t len; #endif + struct bootutil_key *bootutil_enc_key = NULL; int rc = -1; + rc = boot_enc_retrieve_private_key(&bootutil_enc_key); + if (rc) { + return rc; + } + + if (bootutil_enc_key == NULL) { + return rc; + } + #if defined(MCUBOOT_ENCRYPT_RSA) bootutil_rsa_init(&rsa); - cp = (uint8_t *)bootutil_enc_key.key; - cpend = cp + *bootutil_enc_key.len; + cp = (uint8_t *)bootutil_enc_key->key; + cpend = cp + *bootutil_enc_key->len; /* The enckey is encrypted through RSA so for decryption we need the private key */ rc = bootutil_rsa_parse_private_key(&rsa, &cp, cpend); @@ -466,15 +476,15 @@ boot_decrypt_key(const uint8_t *buf, uint8_t *enckey) #if defined(MCUBOOT_ENCRYPT_KW) - assert(*bootutil_enc_key.len == BOOT_ENC_KEY_SIZE); - rc = key_unwrap(buf, enckey); + assert(*bootutil_enc_key->len == BOOT_ENC_KEY_SIZE); + rc = key_unwrap(buf, enckey, bootutil_enc_key); #endif /* defined(MCUBOOT_ENCRYPT_KW) */ #if defined(MCUBOOT_ENCRYPT_EC256) - cp = (uint8_t *)bootutil_enc_key.key; - cpend = cp + *bootutil_enc_key.len; + cp = (uint8_t *)bootutil_enc_key->key; + cpend = cp + *bootutil_enc_key->len; /* * Load the stored EC256 decryption private key @@ -500,8 +510,8 @@ boot_decrypt_key(const uint8_t *buf, uint8_t *enckey) #if defined(MCUBOOT_ENCRYPT_X25519) - cp = (uint8_t *)bootutil_enc_key.key; - cpend = cp + *bootutil_enc_key.len; + cp = (uint8_t *)bootutil_enc_key->key; + cpend = cp + *bootutil_enc_key->len; /* * Load the stored X25519 decryption private key diff --git a/boot/cypress/MCUBootApp/keys.c b/boot/cypress/MCUBootApp/keys.c index 20c0332f6..6f06a7d99 100644 --- a/boot/cypress/MCUBootApp/keys.c +++ b/boot/cypress/MCUBootApp/keys.c @@ -167,3 +167,12 @@ const struct bootutil_key bootutil_enc_key = { .key = enc_priv_key, .len = &enc_priv_key_len, }; + +#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) +int boot_enc_retrieve_private_key(struct bootutil_key **private_key) +{ + *private_key = (struct bootutil_key *)&bootutil_enc_key; + + return 0; +} +#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/boot/mbed/app_enc_keys.c b/boot/mbed/app_enc_keys.c index 9bed4d80f..be4f9cb55 100644 --- a/boot/mbed/app_enc_keys.c +++ b/boot/mbed/app_enc_keys.c @@ -69,3 +69,12 @@ const struct bootutil_key bootutil_enc_key = { #endif #endif + +#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) +int boot_enc_retrieve_private_key(struct bootutil_key **private_key) +{ + *private_key = (struct bootutil_key *)&bootutil_enc_key; + + return 0; +} +#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/boot/zephyr/keys.c b/boot/zephyr/keys.c index ab403ddc3..f1d7e3475 100644 --- a/boot/zephyr/keys.c +++ b/boot/zephyr/keys.c @@ -86,3 +86,12 @@ const struct bootutil_key bootutil_enc_key = { #elif defined(MCUBOOT_ENCRYPT_KW) #error "Encrypted images with AES-KW is not implemented yet." #endif + +#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) +int boot_enc_retrieve_private_key(struct bootutil_key **private_key) +{ + *private_key = (struct bootutil_key *)&bootutil_enc_key; + + return 0; +} +#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/ci/mynewt_keys/enc_kw/src/keys.c b/ci/mynewt_keys/enc_kw/src/keys.c index ae4c5c7bb..c53459ef7 100644 --- a/ci/mynewt_keys/enc_kw/src/keys.c +++ b/ci/mynewt_keys/enc_kw/src/keys.c @@ -28,3 +28,12 @@ const struct bootutil_key bootutil_enc_key = { .key = enc_key, .len = &enc_key_len, }; + +#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) +int boot_enc_retrieve_private_key(struct bootutil_key **private_key) +{ + *private_key = (struct bootutil_key *)&bootutil_enc_key; + + return 0; +} +#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/ci/mynewt_keys/enc_rsa/src/keys.c b/ci/mynewt_keys/enc_rsa/src/keys.c index 201d6ad12..1d07f5cc1 100644 --- a/ci/mynewt_keys/enc_rsa/src/keys.c +++ b/ci/mynewt_keys/enc_rsa/src/keys.c @@ -126,3 +126,12 @@ const struct bootutil_key bootutil_enc_key = { .key = enc_key, .len = &enc_key_len, }; + +#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) +int boot_enc_retrieve_private_key(struct bootutil_key **private_key) +{ + *private_key = (struct bootutil_key *)&bootutil_enc_key; + + return 0; +} +#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/sim/mcuboot-sys/csupport/keys.c b/sim/mcuboot-sys/csupport/keys.c index 82a746ba0..316d10385 100644 --- a/sim/mcuboot-sys/csupport/keys.c +++ b/sim/mcuboot-sys/csupport/keys.c @@ -328,3 +328,12 @@ const struct bootutil_key bootutil_enc_key = { .len = &enc_key_len, }; #endif + +#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) +int boot_enc_retrieve_private_key(struct bootutil_key **private_key) +{ + *private_key = (struct bootutil_key *)&bootutil_enc_key; + + return 0; +} +#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ From e268fca6a2b4771f64bc74f9da53f1ff4f2c8ca7 Mon Sep 17 00:00:00 2001 From: David Vincze Date: Thu, 25 Jul 2024 17:14:28 +0200 Subject: [PATCH 2/2] bootutil: Move encryption key function to common file Move the definition of boot_enc_retrieve_private_key() to a common file to avoid code duplication and also endure seamless transition to this new key handling approach for targets which don't use hardware keys. Change-Id: I57e54e4332503c11d18762f8291c3cab53df3d20 Signed-off-by: David Vincze --- boot/bootutil/src/encrypted.c | 19 +++++++++++++++++-- boot/cypress/MCUBootApp/keys.c | 9 --------- boot/mbed/app_enc_keys.c | 9 --------- boot/zephyr/keys.c | 9 --------- ci/mynewt_keys/enc_kw/src/keys.c | 9 --------- ci/mynewt_keys/enc_rsa/src/keys.c | 9 --------- sim/mcuboot-sys/csupport/keys.c | 9 --------- 7 files changed, 17 insertions(+), 56 deletions(-) diff --git a/boot/bootutil/src/encrypted.c b/boot/bootutil/src/encrypted.c index ea73b172f..08df0fe08 100644 --- a/boot/bootutil/src/encrypted.c +++ b/boot/bootutil/src/encrypted.c @@ -2,7 +2,7 @@ * SPDX-License-Identifier: Apache-2.0 * * Copyright (c) 2018-2019 JUUL Labs - * Copyright (c) 2019-2023 Arm Limited + * Copyright (c) 2019-2024 Arm Limited */ #include "mcuboot_config/mcuboot_config.h" @@ -334,7 +334,22 @@ hkdf(uint8_t *ikm, uint16_t ikm_len, uint8_t *info, uint16_t info_len, bootutil_hmac_sha256_drop(&hmac); return -1; } -#endif +#endif /* MCUBOOT_ENCRYPT_EC256 || MCUBOOT_ENCRYPT_X25519 */ + +#if !defined(MCUBOOT_HW_KEY) +extern const struct bootutil_key bootutil_enc_key; + +/* + * Default implementation to retrieve the private encryption key which is + * embedded in the bootloader code (when MCUBOOT_HW_KEY is not defined). + */ +int boot_enc_retrieve_private_key(struct bootutil_key **private_key) +{ + *private_key = (struct bootutil_key *)&bootutil_enc_key; + + return 0; +} +#endif /* !MCUBOOT_HW_KEY */ int boot_enc_init(struct enc_key_data *enc_state, uint8_t slot) diff --git a/boot/cypress/MCUBootApp/keys.c b/boot/cypress/MCUBootApp/keys.c index 6f06a7d99..20c0332f6 100644 --- a/boot/cypress/MCUBootApp/keys.c +++ b/boot/cypress/MCUBootApp/keys.c @@ -167,12 +167,3 @@ const struct bootutil_key bootutil_enc_key = { .key = enc_priv_key, .len = &enc_priv_key_len, }; - -#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) -int boot_enc_retrieve_private_key(struct bootutil_key **private_key) -{ - *private_key = (struct bootutil_key *)&bootutil_enc_key; - - return 0; -} -#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/boot/mbed/app_enc_keys.c b/boot/mbed/app_enc_keys.c index be4f9cb55..9bed4d80f 100644 --- a/boot/mbed/app_enc_keys.c +++ b/boot/mbed/app_enc_keys.c @@ -69,12 +69,3 @@ const struct bootutil_key bootutil_enc_key = { #endif #endif - -#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) -int boot_enc_retrieve_private_key(struct bootutil_key **private_key) -{ - *private_key = (struct bootutil_key *)&bootutil_enc_key; - - return 0; -} -#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/boot/zephyr/keys.c b/boot/zephyr/keys.c index f1d7e3475..ab403ddc3 100644 --- a/boot/zephyr/keys.c +++ b/boot/zephyr/keys.c @@ -86,12 +86,3 @@ const struct bootutil_key bootutil_enc_key = { #elif defined(MCUBOOT_ENCRYPT_KW) #error "Encrypted images with AES-KW is not implemented yet." #endif - -#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) -int boot_enc_retrieve_private_key(struct bootutil_key **private_key) -{ - *private_key = (struct bootutil_key *)&bootutil_enc_key; - - return 0; -} -#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/ci/mynewt_keys/enc_kw/src/keys.c b/ci/mynewt_keys/enc_kw/src/keys.c index c53459ef7..ae4c5c7bb 100644 --- a/ci/mynewt_keys/enc_kw/src/keys.c +++ b/ci/mynewt_keys/enc_kw/src/keys.c @@ -28,12 +28,3 @@ const struct bootutil_key bootutil_enc_key = { .key = enc_key, .len = &enc_key_len, }; - -#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) -int boot_enc_retrieve_private_key(struct bootutil_key **private_key) -{ - *private_key = (struct bootutil_key *)&bootutil_enc_key; - - return 0; -} -#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/ci/mynewt_keys/enc_rsa/src/keys.c b/ci/mynewt_keys/enc_rsa/src/keys.c index 1d07f5cc1..201d6ad12 100644 --- a/ci/mynewt_keys/enc_rsa/src/keys.c +++ b/ci/mynewt_keys/enc_rsa/src/keys.c @@ -126,12 +126,3 @@ const struct bootutil_key bootutil_enc_key = { .key = enc_key, .len = &enc_key_len, }; - -#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) -int boot_enc_retrieve_private_key(struct bootutil_key **private_key) -{ - *private_key = (struct bootutil_key *)&bootutil_enc_key; - - return 0; -} -#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */ diff --git a/sim/mcuboot-sys/csupport/keys.c b/sim/mcuboot-sys/csupport/keys.c index 316d10385..82a746ba0 100644 --- a/sim/mcuboot-sys/csupport/keys.c +++ b/sim/mcuboot-sys/csupport/keys.c @@ -328,12 +328,3 @@ const struct bootutil_key bootutil_enc_key = { .len = &enc_key_len, }; #endif - -#if !defined(MCUBOOT_HW_KEY) && defined(MCUBOOT_ENC_IMAGES) -int boot_enc_retrieve_private_key(struct bootutil_key **private_key) -{ - *private_key = (struct bootutil_key *)&bootutil_enc_key; - - return 0; -} -#endif /* !MCUBOOT_HW_KEY && MCUBOOT_ENC_IMAGES */