Whitebox
/
u-boot
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

rsa: add sha256,rsa4096 algorithm

Browse Source 
Add support for sha256,rsa4096 signatures in u-boot.

Signed-off-by: Heiko Schocher <hs@denx.de>
Acked-by: Simon Glass <sjg@chromium.org>
Cc: andreas@oetken.name
master
Heiko Schocher 10 years ago committed by Tom Rini
parent 646257d1f4
commit db1b5f3d20
6 changed files with 104 additions and 16 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 23
      common/image-sig.c
  2. 1
      include/image.h
  3. 1
      include/rsa-checksum.h
  4. 10
      include/rsa.h
  5. 65
      lib/rsa/rsa-checksum.c
  6. 20
      lib/rsa/rsa-verify.c

23
common/image-sig.c
Unescape View File

@ -29,6 +29,7 @@ struct checksum_algo checksum_algos[] = {
{
"sha1",
SHA1_SUM_LEN,
RSA2048_BYTES,
#if IMAGE_ENABLE_SIGN
EVP_sha1,
#else
@ -39,14 +40,28 @@ struct checksum_algo checksum_algos[] = {
{
"sha256",
SHA256_SUM_LEN,
RSA2048_BYTES,
#if IMAGE_ENABLE_SIGN
EVP_sha256,
#else
sha256_calculate,
padding_sha256_rsa2048,
#endif
},
{
"sha256",
SHA256_SUM_LEN,
RSA4096_BYTES,
#if IMAGE_ENABLE_SIGN
EVP_sha256,
#else
sha256_calculate,
padding_sha256_rsa4096,
#endif
}
};
struct image_sig_algo image_sig_algos[] = {
{
"sha1,rsa2048",
@ -61,7 +76,15 @@ struct image_sig_algo image_sig_algos[] = {
rsa_add_verify_data,
rsa_verify,
&checksum_algos[1],
},
{
"sha256,rsa4096",
rsa_sign,
rsa_add_verify_data,
rsa_verify,
&checksum_algos[2],
}
};
struct image_sig_algo *image_get_sig_algo(const char *name)

1
include/image.h
Unescape View File

@ -879,6 +879,7 @@ struct image_region {
struct checksum_algo {
const char *name;
const int checksum_len;
const int pad_len;
#if IMAGE_ENABLE_SIGN
const EVP_MD *(*calculate)(void);
#else

1
include/rsa-checksum.h
Unescape View File

@ -12,6 +12,7 @@
#include <sha1.h>
#include <sha256.h>
extern const uint8_t padding_sha256_rsa4096[];
extern const uint8_t padding_sha256_rsa2048[];
extern const uint8_t padding_sha1_rsa2048[];

10
include/rsa.h
Unescape View File

@ -103,4 +103,14 @@ static inline int rsa_verify(struct image_sign_info *info,
}
#endif
#define RSA2048_BYTES (2048 / 8)
#define RSA4096_BYTES (4096 / 8)
/* This is the minimum/maximum key size we support, in bits */
#define RSA_MIN_KEY_BITS 2048
#define RSA_MAX_KEY_BITS 4096
/* This is the maximum signature length that we support, in bits */
#define RSA_MAX_SIG_BITS 4096
#endif

65
lib/rsa/rsa-checksum.c
Unescape View File

@ -13,8 +13,6 @@
#include <asm/errno.h>
#include <asm/unaligned.h>
#define RSA2048_BYTES 256
/* PKCS 1.5 paddings as described in the RSA PKCS#1 v2.1 standard. */
const uint8_t padding_sha256_rsa2048[RSA2048_BYTES - SHA256_SUM_LEN] = {
@ -71,6 +69,69 @@ const uint8_t padding_sha1_rsa2048[RSA2048_BYTES - SHA1_SUM_LEN] = {
0x05, 0x00, 0x04, 0x14
};
const uint8_t padding_sha256_rsa4096[RSA4096_BYTES - SHA256_SUM_LEN] = {
0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff, 0xff, 0xff, 0xff, 0x00, 0x30, 0x31, 0x30,
0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20
};
void sha1_calculate(const struct image_region region[], int region_count,
uint8_t *checksum)
{

20
lib/rsa/rsa-verify.c
Unescape View File

@ -15,15 +15,6 @@
#define UINT64_MULT32(v, multby) (((uint64_t)(v)) * ((uint32_t)(multby)))
#define RSA2048_BYTES (2048 / 8)
/* This is the minimum/maximum key size we support, in bits */
#define RSA_MIN_KEY_BITS 2048
#define RSA_MAX_KEY_BITS 2048
/* This is the maximum signature length that we support, in bits */
#define RSA_MAX_SIG_BITS 2048
/**
* subtract_modulus() - subtract modulus from the given value
*
@ -197,7 +188,7 @@ static int rsa_verify_key(const struct rsa_public_key *key, const uint8_t *sig,
return ret;
padding = algo->rsa_padding;
pad_len = RSA2048_BYTES - algo->checksum_len;
pad_len = algo->pad_len - algo->checksum_len;
/* Check pkcs1.5 padding bytes. */
if (memcmp(buf, padding, pad_len)) {
@ -281,7 +272,7 @@ int rsa_verify(struct image_sign_info *info,
{
const void *blob = info->fdt_blob;
/* Reserve memory for maximum checksum-length */
uint8_t hash[RSA2048_BYTES];
uint8_t hash[info->algo->checksum->pad_len];
int ndepth, noffset;
int sig_node, node;
char name[100];
@ -291,9 +282,10 @@ int rsa_verify(struct image_sign_info *info,
* Verify that the checksum-length does not exceed the
* rsa-signature-length
*/
if (info->algo->checksum->checksum_len > RSA2048_BYTES) {
debug("%s: invlaid checksum-algorithm %s for RSA2048\n",
__func__, info->algo->checksum->name);
if (info->algo->checksum->checksum_len >
info->algo->checksum->pad_len) {
debug("%s: invlaid checksum-algorithm %s for %s\n",
__func__, info->algo->checksum->name, info->algo->name);
return -EINVAL;
}

Write Preview
Loading…
Cancel
Save