Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

encrypted: Replace MCUBOOT_HW_KEY with the MCUBOOT_ENC_BUILTIN_KEY option #2037

Merged
merged 1 commit into from
Aug 21, 2024
Merged

encrypted: Replace MCUBOOT_HW_KEY with the MCUBOOT_ENC_BUILTIN_KEY option #2037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions boot/bootutil/src/encrypted.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,20 +336,20 @@ hkdf(uint8_t *ikm, uint16_t ikm_len, uint8_t *info, uint16_t info_len,
}
#endif /* MCUBOOT_ENCRYPT_EC256 || MCUBOOT_ENCRYPT_X25519 */

#if !defined(MCUBOOT_HW_KEY)
#if !defined(MCUBOOT_ENC_BUILTIN_KEY)
extern const struct bootutil_key bootutil_enc_key;

/*
* Default implementation to retrieve the private encryption key which is
* embedded in the bootloader code (when MCUBOOT_HW_KEY is not defined).
* embedded in the bootloader code (when MCUBOOT_ENC_BUILTIN_KEY is not defined).
*/
int boot_enc_retrieve_private_key(struct bootutil_key **private_key)
{
*private_key = (struct bootutil_key *)&bootutil_enc_key;

return 0;
}
#endif /* !MCUBOOT_HW_KEY */
#endif /* !MCUBOOT_ENC_BUILTIN_KEY */

int
boot_enc_init(struct enc_key_data *enc_state, uint8_t slot)
Expand Down
27 changes: 27 additions & 0 deletions samples/mcuboot_config/mcuboot_config.template.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,33 @@
/* Uncomment to use Tinycrypt's. */
/* #define MCUBOOT_USE_TINYCRYPT */

/*
* Encrypted images
*
* Uncomment one of the below options (MCUBOOT_ENCRYPT_x) to enable
* encrypted image upgrades.
*/

/* Uncomment to use RSA-OAEP for key encryption */
/* #define MCUBOOT_ENCRYPT_RSA */
/* Uncomment to use AES-KW for key encryption */
/* #define MCUBOOT_ENCRYPT_KW */
/* Uncomment to use ECIES-P256 for key encryption */
/* #define MCUBOOT_ENCRYPT_EC256 */
/* Uncomment to use ECIES-X25519 for key encryption */
/* #define MCUBOOT_ENCRYPT_X25519 */

/* Uncomment to use a builtin key-encryption key (retrieved from a trusted
* source - if implemented) instead of a key embedded in the bootloader. */
/* #define MCUBOOT_ENC_BUILTIN_KEY */

#if defined(MCUBOOT_ENCRYPT_RSA) || \
defined(MCUBOOT_ENCRYPT_KW) || \
defined(MCUBOOT_ENCRYPT_EC256) || \
defined(MCUBOOT_ENCRYPT_X25519)
#define MCUBOOT_ENC_IMAGES
#endif

/*
* Always check the signature of the image in the primary slot before booting,
* even if no upgrade was performed. This is recommended if the boot
Expand Down
Loading