commit bf94339025ace9841e29b5d6d23ab03749a89834
author Marko Kiiskila <marko@runtime.io> Thu Dec 29 17:29:48 2016 -0800
committer Christopher Collins <ccollins@apache.org> Thu Jan 05 17:57:46 2017 -0800
tree f2e5b0ac4f1a6d395160b8509e9d5aa3ae612964
parent 919eaf4111897c46830d0f84700b334054d5a5b8

boot; first cut at adding support for signatures with ECSDA using NIST P-256.

boot/bootutil/src/image_validate.c

diff --git a/boot/bootutil/src/image_validate.c b/boot/bootutil/src/image_validate.c
index 98fdc9b..9ab08b7 100644
--- a/boot/bootutil/src/image_validate.c
+++ b/boot/bootutil/src/image_validate.c
@@ -93,7 +93,8 @@
     uint32_t off;
     uint32_t size;
     uint32_t sha_off = 0;
-#if MYNEWT_VAL(BOOTUTIL_SIGN_RSA) || MYNEWT_VAL(BOOTUTIL_SIGN_EC)
+#if MYNEWT_VAL(BOOTUTIL_SIGN_RSA) || MYNEWT_VAL(BOOTUTIL_SIGN_EC) || \
+    MYNEWT_VAL(BOOTUTIL_SIGN_EC256)
     uint32_t sig_off = 0;
     uint32_t sig_len = 0;
 #endif
@@ -112,6 +113,11 @@
         return -1;
     }
 #endif
+#if MYNEWT_VAL(BOOTUTIL_SIGN_EC256)
+    if ((hdr->ih_flags & IMAGE_F_ECDSA256_SHA256) == 0) {
+        return -1;
+    }
+#endif
     if ((hdr->ih_flags & IMAGE_F_SHA256) == 0) {
         return -1;
     }
@@ -159,6 +165,15 @@
             sig_len = tlv.it_len;
         }
 #endif
+#if MYNEWT_VAL(BOOTUTIL_SIGN_EC256)
+        if (tlv.it_type == IMAGE_TLV_ECDSA256) {
+            if (tlv.it_len < 72) { /* oids + 2 * 32 bytes */
+                return -1;
+            }
+            sig_off = off + sizeof(tlv);
+            sig_len = tlv.it_len;
+        }
+#endif
     }
     if (hdr->ih_flags & IMAGE_F_SHA256) {
         if (!sha_off) {
@@ -175,7 +190,8 @@
             return -1;
         }
     }
-#if MYNEWT_VAL(BOOTUTIL_SIGN_RSA) || MYNEWT_VAL(BOOTUTIL_SIGN_EC)
+#if MYNEWT_VAL(BOOTUTIL_SIGN_RSA) || MYNEWT_VAL(BOOTUTIL_SIGN_EC) || \
+    MYNEWT_VAL(BOOTUTIL_SIGN_EC256)
     if (!sig_off) {
         /*
          * Header said there should be PKCS1.v5 signature, no TLV