Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-11 07:24:46 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

aes: Allow to store randomly generated IV in the FIT

Browse source 
When the initialisation vector is randomly generated, its value shall be
stored in the FIT together with the encrypted data. The changes allow to
store the IV in the FIT also in the case where the key is not stored in
the DTB but retrieved somewhere else at runtime.

Signed-off-by: Paul HENRYS <paul.henrys_ext@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Paul HENRYS 2024-11-25 18:47:15 +01:00 • committed by Tom Rini
parent 337bfdce5a
commit 79d7b11102
3 changed files with 23 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
include/image.h
View file

@ -1788,6 +1788,21 @@ struct cipher_algo {
const unsigned char *data, int data_len,
unsigned char **cipher, int *cipher_len);
/**
* add_cipher_data() - Add cipher data to the FIT and device tree
*
* This is used to add the ciphered data to the FIT and other cipher
* related information (key and initialization vector) to a device tree.
*
* @info: Pointer to image cipher information.
* @keydest: Pointer to a device tree where the key and IV can be
* stored. keydest can be NULL when the key is retrieved at
* runtime by another mean.
* @fit: Pointer to the FIT image.
* @node_noffset: Offset where the cipher information are stored in the
* FIT.
* return: 0 on success, a negative error code otherwise.
*/
int (*add_cipher_data)(struct image_cipher_info *info,
void *keydest, void *fit, int node_noffset);

7
lib/aes/aes-encrypt.c
View file

@ -84,6 +84,13 @@ int image_aes_add_cipher_data(struct image_cipher_info *info, void *keydest,
char name[128];
int ret = 0;
if (!keydest && !info->ivname) {
/* At least, store the IV in the FIT image */
ret = fdt_setprop(fit, node_noffset, "iv",
info->iv, info->cipher->iv_len);
goto done;
}
/* Either create or overwrite the named cipher node */
parent = fdt_subnode_offset(keydest, 0, FIT_CIPHER_NODENAME);
if (parent == -FDT_ERR_NOTFOUND) {

2
tools/image-host.c
View file

@ -535,7 +535,7 @@ fit_image_process_cipher(const char *keydir, void *keydest, void *fit,
* size values
* And, if needed, write the iv in the FIT file
*/
if (keydest) {
if (keydest || (!keydest && !info.ivname)) {
ret = info.cipher->add_cipher_data(&info, keydest, fit, node_noffset);
if (ret) {
fprintf(stderr,