1 /*
2  * SPDX-License-Identifier: Apache-2.0
3  *
4  * Copyright (c) 2016-2019 JUUL Labs
5  * Copyright (c) 2017 Linaro LTD
6  * Copyright (C) 2021-2024 Arm Limited
7  *
8  * Original license:
9  *
10  * Licensed to the Apache Software Foundation (ASF) under one
11  * or more contributor license agreements.  See the NOTICE file
12  * distributed with this work for additional information
13  * regarding copyright ownership.  The ASF licenses this file
14  * to you under the Apache License, Version 2.0 (the
15  * "License"); you may not use this file except in compliance
16  * with the License.  You may obtain a copy of the License at
17  *
18  *  http://www.apache.org/licenses/LICENSE-2.0
19  *
20  * Unless required by applicable law or agreed to in writing,
21  * software distributed under the License is distributed on an
22  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
23  * KIND, either express or implied.  See the License for the
24  * specific language governing permissions and limitations
25  * under the License.
26  */
27 
28 #include <string.h>
29 
30 #include "mcuboot_config/mcuboot_config.h"
31 
32 #if defined(MCUBOOT_SIGN_EC256) || defined(MCUBOOT_SIGN_EC384)
33 
34 #include "bootutil_priv.h"
35 #include "bootutil/fault_injection_hardening.h"
36 #include "bootutil/crypto/ecdsa.h"
37 
38 #if !defined(MCUBOOT_BUILTIN_KEY)
39 fih_ret
bootutil_verify_sig(uint8_t * hash,uint32_t hlen,uint8_t * sig,size_t slen,uint8_t key_id)40 bootutil_verify_sig(uint8_t *hash, uint32_t hlen, uint8_t *sig, size_t slen,
41                     uint8_t key_id)
42 {
43     int rc;
44     bootutil_ecdsa_context ctx;
45     FIH_DECLARE(fih_rc, FIH_FAILURE);
46     uint8_t *pubkey;
47     uint8_t *end;
48 
49     pubkey = (uint8_t *)bootutil_keys[key_id].key;
50     end = pubkey + *bootutil_keys[key_id].len;
51     bootutil_ecdsa_init(&ctx);
52 
53     rc = bootutil_ecdsa_parse_public_key(&ctx, &pubkey, end);
54     if (rc) {
55         goto out;
56     }
57 
58     rc = bootutil_ecdsa_verify(&ctx, pubkey, end-pubkey, hash, hlen, sig, slen);
59     fih_rc = fih_ret_encode_zero_equality(rc);
60     if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
61         FIH_SET(fih_rc, FIH_FAILURE);
62     }
63 
64 out:
65     bootutil_ecdsa_drop(&ctx);
66 
67     FIH_RET(fih_rc);
68 }
69 #else /* !MCUBOOT_BUILTIN_KEY */
70 fih_ret
bootutil_verify_sig(uint8_t * hash,uint32_t hlen,uint8_t * sig,size_t slen,uint8_t key_id)71 bootutil_verify_sig(uint8_t *hash, uint32_t hlen, uint8_t *sig, size_t slen,
72                     uint8_t key_id)
73 {
74     int rc;
75     bootutil_ecdsa_context ctx;
76     FIH_DECLARE(fih_rc, FIH_FAILURE);
77 
78     /* Use builtin key for image verification, no key parsing is required. */
79     ctx.key_id = key_id;
80     bootutil_ecdsa_init(&ctx);
81 
82     /* The public key pointer and key size can be omitted. */
83     rc = bootutil_ecdsa_verify(&ctx, NULL, 0, hash, hlen, sig, slen);
84     fih_rc = fih_ret_encode_zero_equality(rc);
85     if (FIH_NOT_EQ(fih_rc, FIH_SUCCESS)) {
86         FIH_SET(fih_rc, FIH_FAILURE);
87     }
88 
89     bootutil_ecdsa_drop(&ctx);
90 
91     FIH_RET(fih_rc);
92 }
93 #endif /* MCUBOOT_BUILTIN_KEY */
94 
95 #endif /* MCUBOOT_SIGN_EC256 || MCUBOOT_SIGN_EC384 */
96