Rsa pss

.github/workflows/test-sunnyday-simulator.yml

@@ -218,6 +218,66 @@ jobs:
         run: |
           tools/scripts/sim-sunnyday-update.sh
 
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS2048)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS3072)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS4096)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
       # 32 Bit simulator, FASTMATH
       #
       - name: make clean
@@ -348,6 +408,66 @@ jobs:
         run: |
           tools/scripts/sim-sunnyday-update.sh
 
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
 
       # 64 Bit simulator, SP_MATH
       #
@@ -479,6 +599,66 @@ jobs:
         run: |
           tools/scripts/sim-sunnyday-update.sh
 
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS2048)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS3072)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS4096)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
       # 64 Bit simulator, FASTMATH
       #
       - name: make clean
@@ -609,6 +789,66 @@ jobs:
         run: |
           tools/scripts/sim-sunnyday-update.sh
 
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Cleanup to change key type
+        run: |
+          make keysclean
+
+      - name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
+      - name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
+        run: |
+          make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0
+
+      - name: Run sunny day update test
+        run: |
+          tools/scripts/sim-sunnyday-update.sh
+
       - name: Run sunny day LMS update test
         run: |
           tools/scripts/sim-pq-sunnyday-update.sh config/examples/sim-lms.config

config/examples/sim-rsapss2048.config

@@ -0,0 +1,21 @@
+ARCH=sim
+TARGET=sim
+SIGN?=RSAPSS2048
+HASH?=SHA256
+WOLFBOOT_SMALL_STACK?=0
+SPI_FLASH=0
+DEBUG=1
+
+# sizes should be multiple of system page size
+WOLFBOOT_PARTITION_SIZE=0x40000
+WOLFBOOT_SECTOR_SIZE=0x1000
+WOLFBOOT_PARTITION_BOOT_ADDRESS=0x80000
+# if on external flash, it should be multiple of system page size
+WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x100000
+WOLFBOOT_PARTITION_SWAP_ADDRESS=0x180000
+
+# required for keytools
+WOLFBOOT_FIXED_PARTITIONS=1
+
+# For debugging XMALLOC/XFREE
+#CFLAGS_EXTRA+=-DWOLFBOOT_DEBUG_MALLOC

include/image.h

@@ -68,6 +68,11 @@ extern "C" {
     defined (WOLFBOOT_SIGN_RSA4096ENC)
 #define wolfBoot_verify_signature_primary wolfBoot_verify_signature_rsa
 #endif
+#if defined (WOLFBOOT_SIGN_RSAPSS2048) || \
+    defined (WOLFBOOT_SIGN_RSAPSS3072) || \
+    defined (WOLFBOOT_SIGN_RSAPSS4096)
+#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_rsa_pss
+#endif
 #if defined (WOLFBOOT_SIGN_ECC256) || \
         defined (WOLFBOOT_SIGN_ECC384) || \
         defined (WOLFBOOT_SIGN_ECC521)
@@ -97,6 +102,11 @@ extern "C" {
     defined (WOLFBOOT_SIGN_SECONDARY_RSA4096ENC)
 #define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_rsa
 #endif
+#if defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS2048) || \
+    defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS3072) || \
+    defined (WOLFBOOT_SIGN_SECONDARY_RSAPSS4096)
+#define wolfBoot_verify_signature_secondary wolfBoot_verify_signature_rsa_pss
+#endif
 #if defined (WOLFBOOT_SIGN_SECONDARY_ECC256) || \
         defined (WOLFBOOT_SIGN_SECONDARY_ECC384) || \
         defined (WOLFBOOT_SIGN_SECONDARY_ECC521)
@@ -468,6 +478,67 @@ static void __attribute__((noinline)) wolfBoot_image_clear_signature_ok(
         asm volatile("nop"); \
     }
 
+/**
+ * Second part of RSA-PSS verification.
+ *
+ * Call wc_RsaPSS_CheckPadding twice, then confirm via
+ * wolfBoot_image_confirm_signature_ok();
+ */
+#define RSA_PSS_VERIFY_HASH(img, pss_data, pss_data_sz, hash_type) \
+    { \
+        volatile int pss_res; \
+        if (!img || !pss_data)    \
+            asm volatile("b pnope"); \
+        /* Redundant set of r0=50*/ \
+        asm volatile("mov r0, #50":::"r0"); \
+        asm volatile("mov r0, #50":::"r0"); \
+        asm volatile("mov r0, #50":::"r0"); \
+        pss_res = wc_RsaPSS_CheckPadding(img->sha_hash, WOLFBOOT_SHA_DIGEST_SIZE, \
+            pss_data, pss_data_sz, hash_type); \
+        /* Redundant checks that ensure the function actually returned 0 */ \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("bne pnope":::"cc"); \
+        asm volatile("cmp r0, #0"); \
+        asm volatile("cmp r0, #0"); \
+        asm volatile("cmp r0, #0"); \
+        asm volatile("bne pnope":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("bne pnope"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("bne pnope"); \
+        /* Repeat wc_RsaPSS_CheckPadding call */ \
+        pss_res = wc_RsaPSS_CheckPadding(img->sha_hash, WOLFBOOT_SHA_DIGEST_SIZE, \
+            pss_data, pss_data_sz, hash_type); \
+        pss_res; \
+        /* Redundant checks that ensure the function actually returned 0 */ \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("bne pnope"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("bne pnope"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("bne pnope"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("cmp r0, #0":::"cc"); \
+        asm volatile("bne pnope"); \
+        /* Confirm that the signature is OK */ \
+        wolfBoot_image_confirm_signature_ok(img); \
+        asm volatile("pnope:"); \
+        asm volatile("nop"); \
+    }
+
 /**
  * ECC / Ed / PQ signature verification.
  * Those verify functions set an additional value 'p_res'
@@ -1237,6 +1308,11 @@ static void UNUSEDFUNCTION wolfBoot_image_clear_signature_ok(
     if (XMEMCMP(img->sha_hash, digest, WOLFBOOT_SHA_DIGEST_SIZE) == 0) \
         wolfBoot_image_confirm_signature_ok(img);
 
+#define RSA_PSS_VERIFY_HASH(img, pss_data, pss_data_sz, hash_type) \
+    if (wc_RsaPSS_CheckPadding(img->sha_hash, WOLFBOOT_SHA_DIGEST_SIZE, \
+            pss_data, pss_data_sz, hash_type) == 0) \
+        wolfBoot_image_confirm_signature_ok(img);
+
 #define PART_SANITY_CHECK(p) \
     if (((p)->hdr_ok != 1) || ((p)->sha_ok != 1) || ((p)->signature_ok != 1)) \
         wolfBoot_panic()