Skip to content

Commit 65d84a2

Browse files
bigbrettdanielinux
bigbrett
authored and
danielinux
committed
Add SW-only RSA PSS
1 parent 401c034 commit 65d84a2

12 files changed

Lines changed: 673 additions & 40 deletions

File tree

‎.github/workflows/test-sunnyday-simulator.yml‎

Lines changed: 240 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,66 @@ jobs:
175175
run: |
176176
tools/scripts/sim-sunnyday-update.sh
177177
178+
- name: Cleanup to change key type
179+
run: |
180+
make keysclean
181+
182+
- name: Build wolfboot.elf (RSAPSS2048)
183+
run: |
184+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1
185+
186+
- name: Run sunny day update test
187+
run: |
188+
tools/scripts/sim-sunnyday-update.sh
189+
190+
- name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
191+
run: |
192+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1
193+
194+
- name: Run sunny day update test
195+
run: |
196+
tools/scripts/sim-sunnyday-update.sh
197+
198+
- name: Cleanup to change key type
199+
run: |
200+
make keysclean
201+
202+
- name: Build wolfboot.elf (RSAPSS3072)
203+
run: |
204+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1
205+
206+
- name: Run sunny day update test
207+
run: |
208+
tools/scripts/sim-sunnyday-update.sh
209+
210+
- name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
211+
run: |
212+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1
213+
214+
- name: Run sunny day update test
215+
run: |
216+
tools/scripts/sim-sunnyday-update.sh
217+
218+
- name: Cleanup to change key type
219+
run: |
220+
make keysclean
221+
222+
- name: Build wolfboot.elf (RSAPSS4096)
223+
run: |
224+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1
225+
226+
- name: Run sunny day update test
227+
run: |
228+
tools/scripts/sim-sunnyday-update.sh
229+
230+
- name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
231+
run: |
232+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1
233+
234+
- name: Run sunny day update test
235+
run: |
236+
tools/scripts/sim-sunnyday-update.sh
237+
178238
# 32 Bit simulator, FASTMATH
179239
#
180240
- name: make clean
@@ -305,6 +365,66 @@ jobs:
305365
run: |
306366
tools/scripts/sim-sunnyday-update.sh
307367
368+
- name: Cleanup to change key type
369+
run: |
370+
make keysclean
371+
372+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
373+
run: |
374+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0
375+
376+
- name: Run sunny day update test
377+
run: |
378+
tools/scripts/sim-sunnyday-update.sh
379+
380+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
381+
run: |
382+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0
383+
384+
- name: Run sunny day update test
385+
run: |
386+
tools/scripts/sim-sunnyday-update.sh
387+
388+
- name: Cleanup to change key type
389+
run: |
390+
make keysclean
391+
392+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
393+
run: |
394+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0
395+
396+
- name: Run sunny day update test
397+
run: |
398+
tools/scripts/sim-sunnyday-update.sh
399+
400+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
401+
run: |
402+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0
403+
404+
- name: Run sunny day update test
405+
run: |
406+
tools/scripts/sim-sunnyday-update.sh
407+
408+
- name: Cleanup to change key type
409+
run: |
410+
make keysclean
411+
412+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
413+
run: |
414+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1
415+
416+
- name: Run sunny day update test
417+
run: |
418+
tools/scripts/sim-sunnyday-update.sh
419+
420+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
421+
run: |
422+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0
423+
424+
- name: Run sunny day update test
425+
run: |
426+
tools/scripts/sim-sunnyday-update.sh
427+
308428
309429
# 64 Bit simulator, SP_MATH
310430
#
@@ -460,6 +580,66 @@ jobs:
460580
run: |
461581
tools/scripts/sim-sunnyday-update.sh
462582
583+
- name: Cleanup to change key type
584+
run: |
585+
make keysclean
586+
587+
- name: Build wolfboot.elf (RSAPSS2048)
588+
run: |
589+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1
590+
591+
- name: Run sunny day update test
592+
run: |
593+
tools/scripts/sim-sunnyday-update.sh
594+
595+
- name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
596+
run: |
597+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1
598+
599+
- name: Run sunny day update test
600+
run: |
601+
tools/scripts/sim-sunnyday-update.sh
602+
603+
- name: Cleanup to change key type
604+
run: |
605+
make keysclean
606+
607+
- name: Build wolfboot.elf (RSAPSS3072)
608+
run: |
609+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1
610+
611+
- name: Run sunny day update test
612+
run: |
613+
tools/scripts/sim-sunnyday-update.sh
614+
615+
- name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
616+
run: |
617+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1
618+
619+
- name: Run sunny day update test
620+
run: |
621+
tools/scripts/sim-sunnyday-update.sh
622+
623+
- name: Cleanup to change key type
624+
run: |
625+
make keysclean
626+
627+
- name: Build wolfboot.elf (RSAPSS4096)
628+
run: |
629+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1
630+
631+
- name: Run sunny day update test
632+
run: |
633+
tools/scripts/sim-sunnyday-update.sh
634+
635+
- name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
636+
run: |
637+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1
638+
639+
- name: Run sunny day update test
640+
run: |
641+
tools/scripts/sim-sunnyday-update.sh
642+
463643
# 64 Bit simulator, FASTMATH
464644
#
465645
- name: make clean
@@ -590,6 +770,66 @@ jobs:
590770
run: |
591771
tools/scripts/sim-sunnyday-update.sh
592772
773+
- name: Cleanup to change key type
774+
run: |
775+
make keysclean
776+
777+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
778+
run: |
779+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0
780+
781+
- name: Run sunny day update test
782+
run: |
783+
tools/scripts/sim-sunnyday-update.sh
784+
785+
- name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
786+
run: |
787+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0
788+
789+
- name: Run sunny day update test
790+
run: |
791+
tools/scripts/sim-sunnyday-update.sh
792+
793+
- name: Cleanup to change key type
794+
run: |
795+
make keysclean
796+
797+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
798+
run: |
799+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0
800+
801+
- name: Run sunny day update test
802+
run: |
803+
tools/scripts/sim-sunnyday-update.sh
804+
805+
- name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
806+
run: |
807+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0
808+
809+
- name: Run sunny day update test
810+
run: |
811+
tools/scripts/sim-sunnyday-update.sh
812+
813+
- name: Cleanup to change key type
814+
run: |
815+
make keysclean
816+
817+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
818+
run: |
819+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1
820+
821+
- name: Run sunny day update test
822+
run: |
823+
tools/scripts/sim-sunnyday-update.sh
824+
825+
- name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
826+
run: |
827+
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0
828+
829+
- name: Run sunny day update test
830+
run: |
831+
tools/scripts/sim-sunnyday-update.sh
832+
593833
- name: Run sunny day LMS update test
594834
run: |
595835
tools/scripts/sim-pq-sunnyday-update.sh config/examples/sim-lms.config

‎config/examples/sim-rsapss2048.config‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
ARCH=sim
2+
TARGET=sim
3+
SIGN?=RSAPSS2048
4+
HASH?=SHA256
5+
WOLFBOOT_SMALL_STACK?=0
6+
SPI_FLASH=0
7+
DEBUG=1
8+
9+
# sizes should be multiple of system page size
10+
WOLFBOOT_PARTITION_SIZE=0x40000
11+
WOLFBOOT_SECTOR_SIZE=0x1000
12+
WOLFBOOT_PARTITION_BOOT_ADDRESS=0x80000
13+
# if on external flash, it should be multiple of system page size
14+
WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x100000
15+
WOLFBOOT_PARTITION_SWAP_ADDRESS=0x180000
16+
17+
# required for keytools
18+
WOLFBOOT_FIXED_PARTITIONS=1
19+
20+
# For debugging XMALLOC/XFREE
21+
#CFLAGS_EXTRA+=-DWOLFBOOT_DEBUG_MALLOC

‎include/image.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,11 @@ extern "C" {
6868
defined (WOLFBOOT_SIGN_RSA4096ENC)
6969
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_rsa
7070
#endif
71+
#if defined (WOLFBOOT_SIGN_RSAPSS2048) || \
72+
defined (WOLFBOOT_SIGN_RSAPSS3072) || \
73+
defined (WOLFBOOT_SIGN_RSAPSS4096)
74+
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_rsa_pss
75+
#endif
7176
#if defined (WOLFBOOT_SIGN_ECC256) || \
7277
defined (WOLFBOOT_SIGN_ECC384) || \
7378
defined (WOLFBOOT_SIGN_ECC521)
@@ -97,6 +102,11 @@ extern "C" {
97102
defined (WOLFBOOT_SIGN_SECONDARY_RSA4096ENC)
98103
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_rsa
99104
#endif
105+
#if defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS2048) || \
106+
defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS3072) || \
107+
defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS4096)
108+
#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_rsa_pss
109+
#endif
100110
#if defined (WOLFBOOT_SIGN_SECONDARY_ECC256) || \
101111
defined (WOLFBOOT_SIGN_SECONDARY_ECC384) || \
102112
defined (WOLFBOOT_SIGN_SECONDARY_ECC521)

‎include/loader.h‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,14 @@ extern "C" {
4040
#define ECC_IMAGE_SIGNATURE_SIZE (132)
4141
#endif
4242

43-
#if defined(WOLFBOOT_SIGN_RSA2048) || defined(WOLFBOOT_SIGN_SECONDARY_RSA2048)
43+
#if defined(WOLFBOOT_SIGN_RSA2048) || defined(WOLFBOOT_SIGN_SECONDARY_RSA2048) || \
44+
defined(WOLFBOOT_SIGN_RSAPSS2048) || defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS2048)
4445
#define RSA_IMAGE_SIGNATURE_SIZE (256)
45-
#elif defined(WOLFBOOT_SIGN_RSA3072) || defined(WOLFBOOT_SIGN_SECONDARY_RSA3072)
46+
#elif defined(WOLFBOOT_SIGN_RSA3072) || defined(WOLFBOOT_SIGN_SECONDARY_RSA3072) || \
47+
defined(WOLFBOOT_SIGN_RSAPSS3072) || defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS3072)
4648
#define RSA_IMAGE_SIGNATURE_SIZE (384)
47-
#elif defined(WOLFBOOT_SIGN_RSA4096) || defined(WOLFBOOT_SIGN_SECONDARY_RSA4096)
49+
#elif defined(WOLFBOOT_SIGN_RSA4096) || defined(WOLFBOOT_SIGN_SECONDARY_RSA4096) || \
50+
defined(WOLFBOOT_SIGN_RSAPSS4096) || defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS4096)
4851
#define RSA_IMAGE_SIGNATURE_SIZE (512)
4952
#endif
5053

‎include/user_settings.h‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -222,20 +222,35 @@ extern int tolower(int c);
222222
defined(WOLFBOOT_SIGN_SECONDARY_RSA2048) || \
223223
defined(WOLFBOOT_SIGN_SECONDARY_RSA3072) || \
224224
defined(WOLFBOOT_SIGN_SECONDARY_RSA4096) || \
225+
defined(WOLFBOOT_SIGN_RSAPSS2048) || \
226+
defined(WOLFBOOT_SIGN_RSAPSS3072) || \
227+
defined(WOLFBOOT_SIGN_RSAPSS4096) || \
228+
defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS2048) || \
229+
defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS3072) || \
230+
defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS4096) || \
225231
(defined(WOLFCRYPT_SECURE_MODE) && (!defined(PKCS11_SMALL)))
226232

227233
# define WC_RSA_BLINDING
228234
# define WC_RSA_DIRECT
229235
# define RSA_LOW_MEM
230236
# define WC_ASN_HASH_SHA256
237+
# if defined(WOLFBOOT_SIGN_RSAPSS2048) || defined(WOLFBOOT_SIGN_RSAPSS3072) || \
238+
defined(WOLFBOOT_SIGN_RSAPSS4096) || \
239+
defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS2048) || \
240+
defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS3072) || \
241+
defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS4096)
242+
# define WC_RSA_PSS
243+
# endif
231244
# if !defined(WOLFBOOT_TPM) && !defined(WOLFCRYPT_SECURE_MODE) && \
232245
!defined(WOLFCRYPT_TEST) && !defined(WOLFCRYPT_BENCHMARK) && \
233246
!defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) && \
234247
!defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
235248
# define WOLFSSL_RSA_VERIFY_INLINE
236249
# define WOLFSSL_RSA_VERIFY_ONLY
237250
# define WOLFSSL_RSA_PUBLIC_ONLY
238-
# define WC_NO_RSA_OAEP
251+
# if !defined(WC_RSA_PSS)
252+
# define WC_NO_RSA_OAEP
253+
# endif
239254
# define NO_RSA_BOUNDS_CHECK
240255
# endif
241256
# if !defined(USE_FAST_MATH) && !defined(WOLFSSL_SP_MATH_ALL)
@@ -244,7 +259,8 @@ extern int tolower(int c);
244259
# define WOLFSSL_SP_SMALL
245260
# define WOLFSSL_SP_MATH
246261
# endif
247-
# if defined(WOLFBOOT_SIGN_RSA2048) || defined(WOLFBOOT_SIGN_SECONDARY_RSA2048)
262+
# if defined(WOLFBOOT_SIGN_RSA2048) || defined(WOLFBOOT_SIGN_SECONDARY_RSA2048) || \
263+
defined(WOLFBOOT_SIGN_RSAPSS2048) || defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS2048)
248264
# define FP_MAX_BITS (2048 * 2)
249265
# define SP_INT_BITS 2048
250266
# define WOLFSSL_SP_NO_3072
@@ -253,7 +269,8 @@ extern int tolower(int c);
253269
# define RSA_MIN_SIZE 2048
254270
# define RSA_MAX_SIZE 2048
255271
# endif
256-
# if defined(WOLFBOOT_SIGN_RSA3072) || defined(WOLFBOOT_SIGN_SECONDARY_RSA3072)
272+
# if defined(WOLFBOOT_SIGN_RSA3072) || defined(WOLFBOOT_SIGN_SECONDARY_RSA3072) || \
273+
defined(WOLFBOOT_SIGN_RSAPSS3072) || defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS3072)
257274
# define FP_MAX_BITS (3072 * 2)
258275
# define SP_INT_BITS 3072
259276
# define WOLFSSL_SP_NO_2048
@@ -263,7 +280,8 @@ extern int tolower(int c);
263280
# define RSA_MAX_SIZE 3072
264281
# endif
265282

266-
# if defined(WOLFBOOT_SIGN_RSA4096) || defined(WOLFBOOT_SIGN_SECONDARY_RSA4096)
283+
# if defined(WOLFBOOT_SIGN_RSA4096) || defined(WOLFBOOT_SIGN_SECONDARY_RSA4096) || \
284+
defined(WOLFBOOT_SIGN_RSAPSS4096) || defined(WOLFBOOT_SIGN_SECONDARY_RSAPSS4096)
267285
# define FP_MAX_BITS (4096 * 2)
268286
# define SP_INT_BITS 4096
269287
# define WOLFSSL_SP_NO_2048

0 commit comments

Comments
 (0)