1 /*
2 * SPDX-License-Identifier: Apache-2.0
3 *
4 * Copyright (c) 2016-2019 JUUL Labs
5 * Copyright (c) 2017 Linaro LTD
6 * Copyright (C) 2021-2024 Arm Limited
7 *
8 * Original license:
9 *
10 * Licensed to the Apache Software Foundation (ASF) under one
11 * or more contributor license agreements. See the NOTICE file
12 * distributed with this work for additional information
13 * regarding copyright ownership. The ASF licenses this file
14 * to you under the Apache License, Version 2.0 (the
15 * "License"); you may not use this file except in compliance
16 * with the License. You may obtain a copy of the License at
17 *
18 * http://www.apache.org/licenses/LICENSE-2.0
19 *
20 * Unless required by applicable law or agreed to in writing,
21 * software distributed under the License is distributed on an
22 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
23 * KIND, either express or implied. See the License for the
24 * specific language governing permissions and limitations
25 * under the License.
26 */
27
28 #include <string.h>
29
30 #include "mcuboot_config/mcuboot_config.h"
31
32 #if defined(MCUBOOT_SIGN_EC256) || defined(MCUBOOT_SIGN_EC384)
33
34 #include "bootutil_priv.h"
35 #include "bootutil/fault_injection_hardening.h"
36 #include "bootutil/crypto/ecdsa.h"
37
38 #if !defined(MCUBOOT_BUILTIN_KEY)
39 fih_ret
bootutil_verify_sig(uint8_t * hash,uint32_t hlen,uint8_t * sig,size_t slen,uint8_t key_id)40 bootutil_verify_sig(uint8_t *hash, uint32_t hlen, uint8_t *sig, size_t slen,
41 uint8_t key_id)
42 {
43 int rc;
44 bootutil_ecdsa_context ctx;
45 FIH_DECLARE(fih_rc, FIH_FAILURE);
46 uint8_t *pubkey;
47 uint8_t *end;
48
49 pubkey = (uint8_t *)bootutil_keys[key_id].key;
50 end = pubkey + *bootutil_keys[key_id].len;
51 bootutil_ecdsa_init(&ctx);
52
53 rc = bootutil_ecdsa_parse_public_key(&ctx, &pubkey, end);
54 if (rc) {
55 goto out;
56 }
57
58 rc = bootutil_ecdsa_verify(&ctx, pubkey, end-pubkey, hash, hlen, sig, slen);
59 fih_rc = fih_ret_encode_zero_equality(rc);
60 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
61 FIH_SET(fih_rc, FIH_FAILURE);
62 }
63
64 out:
65 bootutil_ecdsa_drop(&ctx);
66
67 FIH_RET(fih_rc);
68 }
69 #else /* !MCUBOOT_BUILTIN_KEY */
70 fih_ret
bootutil_verify_sig(uint8_t * hash,uint32_t hlen,uint8_t * sig,size_t slen,uint8_t key_id)71 bootutil_verify_sig(uint8_t *hash, uint32_t hlen, uint8_t *sig, size_t slen,
72 uint8_t key_id)
73 {
74 int rc;
75 bootutil_ecdsa_context ctx;
76 FIH_DECLARE(fih_rc, FIH_FAILURE);
77
78 /* Use builtin key for image verification, no key parsing is required. */
79 ctx.key_id = key_id;
80 bootutil_ecdsa_init(&ctx);
81
82 /* The public key pointer and key size can be omitted. */
83 rc = bootutil_ecdsa_verify(&ctx, NULL, 0, hash, hlen, sig, slen);
84 fih_rc = fih_ret_encode_zero_equality(rc);
85 if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
86 FIH_SET(fih_rc, FIH_FAILURE);
87 }
88
89 bootutil_ecdsa_drop(&ctx);
90
91 FIH_RET(fih_rc);
92 }
93 #endif /* MCUBOOT_BUILTIN_KEY */
94
95 #endif /* MCUBOOT_SIGN_EC256 || MCUBOOT_SIGN_EC384 */
96