u-boot.git/lib/rsa, branch v2021.10

image: rsa: Move padding_algos to linker lists

2021-09-14T15:46:48Z

We are not guaranteed to have the padding_pkcs_15_verify symbol since commit 92c960bc1d ("lib: rsa: Remove #ifdefs from rsa.h"), and commit 61416fe9df ("Kconfig: FIT_SIGNATURE should not select RSA_VERIFY") The padding_algos only make sense with RSA verification, which can now be disabled in lieu of ECDSA. In fact this will lead to build failures because of the missing symbol mentioned earlier. To resolve this, move the padding_algos to a linker list, with declarations moved to rsa_verify.c. This is consistent with commit 6909edb4ce ("image: rsa: Move verification algorithm to a linker list") One could argue that the added #ifdef USE_HOSTCC is ugly, and should be hidden within the U_BOOT_PADDING_ALGO() macro. However, this would be inconsistent with the "cryptos" list. This logic for was not previously explored: Without knowledge of the U_BOOT_PADDING_ALGO() macro, its use is similar to something being declared. However, should #ifndef USE_HOSTCC be part of the macro, it would not be obvious that it behaves differently on host code and target code. Having the #ifndef outside the macro makes this obvious. Also, the #ifdef is not always necessary. For example ecda-verify makes use of U_BOOT_CRYPTO_ALGO() without any accompanying #ifdefs. The fundamental issue is a lack of separation of host and target code in rsa_verify. Therefore, the declaration of a padding algo with the external #ifdef is more readable and consistent. Signed-off-by: Alexandru Gagniuc

lib/rsa: don't use NULL as key_id

2021-09-14T13:07:18Z

If keydir is not provided but name is we want to use name as key_id. But with the current coding name is only used on its own if it is NULL and keydir is provided which never occurs. Fixes: 824ee745fbca ("lib/rsa: Use the 'keyfile' argument from mkimage") Signed-off-by: Heinrich Schuchardt Reviewed-by: Simon Glass

mkimage: use environment variable MKIMAGE_SIGN_PIN to set pin for OpenSSL Engine

2021-07-29T00:46:34Z

This patch adds the possibility to pass the PIN the OpenSSL Engine used during signing via the environment variable MKIMAGE_SIGN_PIN. This follows the approach used during kernel module signing ("KBUILD_SIGN_PIN") or UBIFS image signing ("MKIMAGE_SIGN_PIN"). Signed-off-by: Marc Kleine-Budde

lib: rsa: rsa-sign: Minor bug in debug message

2021-07-29T00:46:34Z

*sig_size isn't set until later so use the correct variables. Signed-off-by: Donald Chan Reviewed-by: Simon Glass

lib: rsa: rsa-verify: Fix a typo in a debug message

2021-07-29T00:46:34Z

Signed-off-by: Thomas Perrot

image: rsa: Move verification algorithm to a linker list

2021-07-16T19:38:49Z

Move the RSA verification crytpo_algo structure out of the crypto_algos array, and into a linker list. Although it appears we are adding an #ifdef to rsa-verify.c, the gains outweigh this small inconvenience. This is because rsa_verify() is defined differently based on #ifdefs. This change allows us to have a single definition of rsa_verify(). Signed-off-by: Alexandru Gagniuc Reviewed-by: Simon Glass

image: Rename CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT

2021-07-16T16:58:55Z

Drop the ENABLE and SUPPORT parts of this, which are redundant. Signed-off-by: Simon Glass Reviewed-by: Alexandru Gagniuc Signed-off-by: Alexandru Gagniuc

lib/rsa: Use EVP_PKEY instead of RSA

2021-04-14T21:45:04Z

Most modern OpenSSL engines have methods overridden at the EVP level rather than at RSA level, to make these engines work properly with mkimage, the RSA signing code needs to switch to using EVP_* APIs as much as possible. Signed-off-by: Donald Chan [trini: Rebase on top of keyfile changes] Signed-off-by: Tom Rini

lib/rsa: Use the 'keyfile' argument from mkimage

2021-04-14T19:23:01Z

Keys can be derived from keydir, and the "key-name-hint" property of the FIT. They can also be specified ad-literam via 'keyfile'. Update the RSA signing path to use the appropriate one. Signed-off-by: Alexandru Gagniuc Reviewed-by: Simon Glass

lib/rsa: Make fdt_add_bignum() available outside of RSA code

2021-04-14T19:06:08Z

fdt_add_bignum() is useful for algorithms other than just RSA. To allow its use for ECDSA, move it to a common file under lib/. The new file is suffixed with '-libcrypto' because it has a direct dependency on openssl. This is due to the use of the "BIGNUM *" type. Signed-off-by: Alexandru Gagniuc Reviewed-by: Simon Glass