blob: 4604913b40aba517959a9e049372ded268f6768d [file] [log] [blame]
Antonio de Angelis10529d32023-04-21 21:43:14 +01001/*
2 * SPDX-License-Identifier: Apache-2.0
3 *
4 * Copyright (c) 2016-2019 JUUL Labs
5 * Copyright (c) 2017 Linaro LTD
David Vinczef06bc712024-04-03 12:38:34 +02006 * Copyright (C) 2021-2024 Arm Limited
Antonio de Angelis10529d32023-04-21 21:43:14 +01007 *
8 * Original license:
9 *
10 * Licensed to the Apache Software Foundation (ASF) under one
11 * or more contributor license agreements. See the NOTICE file
12 * distributed with this work for additional information
13 * regarding copyright ownership. The ASF licenses this file
14 * to you under the Apache License, Version 2.0 (the
15 * "License"); you may not use this file except in compliance
16 * with the License. You may obtain a copy of the License at
17 *
18 * http://www.apache.org/licenses/LICENSE-2.0
19 *
20 * Unless required by applicable law or agreed to in writing,
21 * software distributed under the License is distributed on an
22 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
23 * KIND, either express or implied. See the License for the
24 * specific language governing permissions and limitations
25 * under the License.
26 */
27
28#include <string.h>
29
30#include "mcuboot_config/mcuboot_config.h"
31
32#if defined(MCUBOOT_SIGN_EC256) || defined(MCUBOOT_SIGN_EC384)
33
34#include "bootutil_priv.h"
35#include "bootutil/fault_injection_hardening.h"
36#include "bootutil/crypto/ecdsa.h"
37
David Vinczef06bc712024-04-03 12:38:34 +020038#if !defined(MCUBOOT_BUILTIN_KEY)
Antonio de Angelis10529d32023-04-21 21:43:14 +010039fih_ret
40bootutil_verify_sig(uint8_t *hash, uint32_t hlen, uint8_t *sig, size_t slen,
41 uint8_t key_id)
42{
43 int rc;
44 bootutil_ecdsa_context ctx;
45 FIH_DECLARE(fih_rc, FIH_FAILURE);
46 uint8_t *pubkey;
47 uint8_t *end;
48
49 pubkey = (uint8_t *)bootutil_keys[key_id].key;
50 end = pubkey + *bootutil_keys[key_id].len;
51 bootutil_ecdsa_init(&ctx);
52
53 rc = bootutil_ecdsa_parse_public_key(&ctx, &pubkey, end);
54 if (rc) {
55 goto out;
56 }
57
58 rc = bootutil_ecdsa_verify(&ctx, pubkey, end-pubkey, hash, hlen, sig, slen);
59 fih_rc = fih_ret_encode_zero_equality(rc);
60 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
61 FIH_SET(fih_rc, FIH_FAILURE);
62 }
63
64out:
65 bootutil_ecdsa_drop(&ctx);
66
67 FIH_RET(fih_rc);
68}
David Vinczef06bc712024-04-03 12:38:34 +020069#else /* !MCUBOOT_BUILTIN_KEY */
70fih_ret
71bootutil_verify_sig(uint8_t *hash, uint32_t hlen, uint8_t *sig, size_t slen,
72 uint8_t key_id)
73{
74 int rc;
75 bootutil_ecdsa_context ctx;
76 FIH_DECLARE(fih_rc, FIH_FAILURE);
77
78 /* Use builtin key for image verification, no key parsing is required. */
79 ctx.key_id = key_id;
80 bootutil_ecdsa_init(&ctx);
81
82 /* The public key pointer and key size can be omitted. */
83 rc = bootutil_ecdsa_verify(&ctx, NULL, 0, hash, hlen, sig, slen);
84 fih_rc = fih_ret_encode_zero_equality(rc);
85 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
86 FIH_SET(fih_rc, FIH_FAILURE);
87 }
88
89 bootutil_ecdsa_drop(&ctx);
90
91 FIH_RET(fih_rc);
92}
93#endif /* MCUBOOT_BUILTIN_KEY */
Antonio de Angelis10529d32023-04-21 21:43:14 +010094
95#endif /* MCUBOOT_SIGN_EC256 || MCUBOOT_SIGN_EC384 */