From 9db9c65a112e6e3a0bb9588b8e30a22265cbfbaf Mon Sep 17 00:00:00 2001 From: Qixiang Xu Date: Thu, 24 Aug 2017 15:12:20 +0800 Subject: [PATCH] Add support for TBBR using ECDSA keys in ARM platforms - fixed compile error when KEY_ALG=ecdsa - add new option ecdsa for TF_MBEDTLS_KEY_ALG - add new option devel_ecdsa for ARM_ROTPK_LOCATION - add ecdsa key at plat/arm/board/common/rotpk/ - reduce the mbedtls heap memory size to 13k Change-Id: I3f7a6170af93fdbaaa7bf2fffb4680a9f6113c13 Signed-off-by: Qixiang Xu --- docs/user-guide.rst | 9 +++++++++ drivers/auth/mbedtls/mbedtls_common.c | 2 +- include/drivers/auth/mbedtls/mbedtls_config.h | 6 +++--- plat/arm/board/common/board_arm_trusted_boot.c | 13 +++++++++++-- plat/arm/board/common/board_common.mk | 6 +++++- plat/arm/board/common/rotpk/arm_rotpk_ecdsa.der | Bin 0 -> 91 bytes .../board/common/rotpk/arm_rotpk_ecdsa_sha256.bin | 1 + plat/arm/board/common/rotpk/arm_rotprivk_ecdsa.pem | 5 +++++ plat/arm/board/juno/platform.mk | 3 --- 9 files changed, 35 insertions(+), 10 deletions(-) create mode 100644 plat/arm/board/common/rotpk/arm_rotpk_ecdsa.der create mode 100644 plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin create mode 100644 plat/arm/board/common/rotpk/arm_rotprivk_ecdsa.pem diff --git a/docs/user-guide.rst b/docs/user-guide.rst index 1ff080d73..67af42562 100644 --- a/docs/user-guide.rst +++ b/docs/user-guide.rst @@ -643,6 +643,11 @@ ARM development platform specific build options ``arm_rotpk_rsa.der``, located in ``plat/arm/board/common/rotpk``. To use this option, ``arm_rotprivk_rsa.pem`` must be specified as ``ROT_KEY`` when creating the certificates. + - ``devel_ecdsa`` : return a development public key hash embedded in the BL1 + and BL2 binaries. This hash has been obtained from the ECDSA public key + ``arm_rotpk_ecdsa.der``, located in ``plat/arm/board/common/rotpk``. To use + this option, ``arm_rotprivk_ecdsa.pem`` must be specified as ``ROT_KEY`` + when creating the certificates. - ``ARM_TSP_RAM_LOCATION``: location of the TSP binary. Options: @@ -990,6 +995,10 @@ images with support for these features: in the ARM platform port. The private/public RSA key pair may be found in ``plat/arm/board/common/rotpk``. + - ``ARM_ROTPK_LOCATION=devel_ecdsa``: use the ROTPK hash that is hardcoded + in the ARM platform port. The private/public ECDSA key pair may be + found in ``plat/arm/board/common/rotpk``. + Example of command line using RSA development keys: :: diff --git a/drivers/auth/mbedtls/mbedtls_common.c b/drivers/auth/mbedtls/mbedtls_common.c index e9aa409b5..cc57af39d 100644 --- a/drivers/auth/mbedtls/mbedtls_common.c +++ b/drivers/auth/mbedtls/mbedtls_common.c @@ -15,7 +15,7 @@ * mbed TLS heap */ #if (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA) -#define MBEDTLS_HEAP_SIZE (14*1024) +#define MBEDTLS_HEAP_SIZE (13*1024) #elif (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA) #define MBEDTLS_HEAP_SIZE (7*1024) #endif diff --git a/include/drivers/auth/mbedtls/mbedtls_config.h b/include/drivers/auth/mbedtls/mbedtls_config.h index fdeb52bb6..7aa4dee10 100644 --- a/include/drivers/auth/mbedtls/mbedtls_config.h +++ b/include/drivers/auth/mbedtls/mbedtls_config.h @@ -9,8 +9,8 @@ /* * Key algorithms currently supported on mbed TLS libraries */ -#define TF_MBEDTLS_RSA 1 -#define TF_MBEDTLS_ECDSA 2 +#define TF_MBEDTLS_RSA 1 +#define TF_MBEDTLS_ECDSA 2 /* * Configuration file to build mbed TLS with the required features for @@ -30,7 +30,6 @@ #define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION #define MBEDTLS_X509_CHECK_KEY_USAGE #define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE -#define MBEDTLS_X509_RSASSA_PSS_SUPPORT #define MBEDTLS_ASN1_PARSE_C #define MBEDTLS_ASN1_WRITE_C @@ -56,6 +55,7 @@ #define MBEDTLS_ECP_DP_SECP256R1_ENABLED #elif (TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA) #define MBEDTLS_RSA_C +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT #endif #define MBEDTLS_SHA256_C diff --git a/plat/arm/board/common/board_arm_trusted_boot.c b/plat/arm/board/common/board_arm_trusted_boot.c index 5d36d1780..6c03c91b5 100644 --- a/plat/arm/board/common/board_arm_trusted_boot.c +++ b/plat/arm/board/common/board_arm_trusted_boot.c @@ -18,6 +18,7 @@ /* ROTPK locations */ #define ARM_ROTPK_REGS_ID 1 #define ARM_ROTPK_DEVEL_RSA_ID 2 +#define ARM_ROTPK_DEVEL_ECDSA_ID 3 static const unsigned char rotpk_hash_hdr[] = \ "\x30\x31\x30\x0D\x06\x09\x60\x86\x48" \ @@ -41,6 +42,12 @@ static const unsigned char arm_devel_rotpk_hash[] = \ "\x37\x7A\x72\x47\x1B\xEC\x32\x73" \ "\xE9\x92\x32\xE2\x49\x59\xF6\x5E" \ "\x8B\x4A\x4A\x46\xD8\x22\x9A\xDA"; +#elif (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_ECDSA_ID) +static const unsigned char arm_devel_rotpk_hash[] = \ + "\x2E\x40\xBF\x6E\xF9\x12\xBB\x98" \ + "\x31\x71\x09\x0E\x1E\x15\x3D\x0B" \ + "\xFD\xD1\xCC\x69\x4A\x98\xEB\x8B" \ + "\xA0\xB0\x20\x86\x4E\x6C\x07\x17"; #endif /* @@ -69,7 +76,8 @@ int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len, memcpy(rotpk_hash_der, rotpk_hash_hdr, rotpk_hash_hdr_len); dst = (uint8_t *)&rotpk_hash_der[rotpk_hash_hdr_len]; -#if (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_RSA_ID) +#if (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_RSA_ID) \ + || (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_ECDSA_ID) memcpy(dst, arm_devel_rotpk_hash, SHA256_BYTES); #elif (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_REGS_ID) uint32_t *src, tmp; @@ -121,7 +129,8 @@ int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len, *dst++ = (uint8_t)((tmp >> 8) & 0xFF); *dst++ = (uint8_t)(tmp & 0xFF); } -#endif /* (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_RSA_ID) */ +#endif /* (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_RSA_ID) \ + || (ARM_ROTPK_LOCATION_ID == ARM_ROTPK_DEVEL_ECDSA_ID) */ *key_ptr = (void *)rotpk_hash_der; *key_len = (unsigned int)sizeof(rotpk_hash_der); diff --git a/plat/arm/board/common/board_common.mk b/plat/arm/board/common/board_common.mk index 46672982c..643047ce7 100644 --- a/plat/arm/board/common/board_common.mk +++ b/plat/arm/board/common/board_common.mk @@ -1,5 +1,5 @@ # -# Copyright (c) 2015-2016, ARM Limited and Contributors. All rights reserved. +# Copyright (c) 2015-2017, ARM Limited and Contributors. All rights reserved. # # SPDX-License-Identifier: BSD-3-Clause # @@ -22,7 +22,11 @@ ifneq (${TRUSTED_BOARD_BOOT},0) ifeq (${ARM_ROTPK_LOCATION}, regs) ARM_ROTPK_LOCATION_ID = ARM_ROTPK_REGS_ID else ifeq (${ARM_ROTPK_LOCATION}, devel_rsa) + KEY_ALG := rsa ARM_ROTPK_LOCATION_ID = ARM_ROTPK_DEVEL_RSA_ID + else ifeq (${ARM_ROTPK_LOCATION}, devel_ecdsa) + KEY_ALG := ecdsa + ARM_ROTPK_LOCATION_ID = ARM_ROTPK_DEVEL_ECDSA_ID else $(error "Unsupported ARM_ROTPK_LOCATION value") endif diff --git a/plat/arm/board/common/rotpk/arm_rotpk_ecdsa.der b/plat/arm/board/common/rotpk/arm_rotpk_ecdsa.der new file mode 100644 index 0000000000000000000000000000000000000000..254787720cfd07278a7dd446f9feec5e06f1d431 GIT binary patch literal 91 zcmXqrG!SNE*J|@PXUoLM#sOw9GqN)~F|f>j=CRkr;^Cqtp9>y_?AG59<;C;=Q2Xrz vzZ+lv{5iF@ZUIj{*OdoJUQ^=V1l77EpO~Nc>)7eK?BKOJN2l;gwM_&7S+Xee literal 0 HcmV?d00001 diff --git a/plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin b/plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin new file mode 100644 index 000000000..c5e123abb --- /dev/null +++ b/plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin @@ -0,0 +1 @@ +.@¿nù»˜1q = ýÑÌiJ˜ë‹ ° †Nl \ No newline at end of file diff --git a/plat/arm/board/common/rotpk/arm_rotprivk_ecdsa.pem b/plat/arm/board/common/rotpk/arm_rotprivk_ecdsa.pem new file mode 100644 index 000000000..fb328e3cd --- /dev/null +++ b/plat/arm/board/common/rotpk/arm_rotprivk_ecdsa.pem @@ -0,0 +1,5 @@ +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEINSaX6nvzS3teiBJA7WlTLRKJOajpy29o2cArLbUXoZBoAoGCCqGSM49 +AwEHoUQDQgAEm+ZIvTQ44aKk83DhVLsvsFpKDP/Ch9vA+4Hp+fmVfX6gDH8K1OBi +SpRf7FJ9RGPIn2H6xst+a1OtLMWUDRqGkQ== +-----END EC PRIVATE KEY----- diff --git a/plat/arm/board/juno/platform.mk b/plat/arm/board/juno/platform.mk index 79916cdad..5cd125bff 100644 --- a/plat/arm/board/juno/platform.mk +++ b/plat/arm/board/juno/platform.mk @@ -91,6 +91,3 @@ include plat/arm/common/arm_common.mk include plat/arm/soc/common/soc_css.mk include plat/arm/css/common/css_common.mk -ifeq (${KEY_ALG},ecdsa) - $(error "ECDSA key algorithm is not fully supported on Juno.") -endif