Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

imgtool: Add --pure switch to allow calculating signatures over entire images #2063

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

imgtool: Add --pure switch to allow calculating signatures over entire images #2063

wants to merge 1 commit into from
+78 −20

Conversation

de-nordic
Copy link
Collaborator

@de-nordic de-nordic commented Sep 13, 2024 •
edited
Loading

The PR adds --pure switch to imgtool that allows to run ED25519 over entire image calculating the PureEdDSA signature.

The imgtool will add SIG_PURE TLV as indicator that whatever signature is used is calculated directly over image.
The PR also provides different output for signature verification, where there is signature reported on verification, rather than digest as digest is no longer available, but will provide digest if key is not provided during verification.

Depends on #2029 -- that reserves the SIG_PURE in MCUboot code
Based on #2048

@de-nordic de-nordic mentioned this pull request Sep 13, 2024
Merged
@de-nordic
Copy link
Collaborator Author

May be interesting for you @taltenbach

de-nordic added a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 1, 2024
@de-nordic
[nrf fromlist] imgtool: Add pure signature support
aaea94a 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
@de-nordic de-nordic mentioned this pull request Oct 1, 2024
Merged
@de-nordic de-nordic mentioned this pull request Oct 2, 2024
Open
de-nordic added a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 2, 2024
@de-nordic
[nrf fromlist] imgtool: Add pure signature support
59fa129 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
de-nordic added a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 3, 2024
@de-nordic
[nrf fromlist] imgtool: Add pure signature support
5322612 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
@de-nordic de-nordic force-pushed the support-for-pure-signatures branch 2 times, most recently from 10b5d01 to e872745 Compare October 4, 2024 17:09
de-nordic added a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 4, 2024
@de-nordic
[nrf fromlist] imgtool: Add pure signature support
5857311 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
de-nordic added a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 8, 2024
@de-nordic
[nrf fromlist] imgtool: Add pure signature support
b840331 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
de-nordic
de-nordic commented Oct 10, 2024
View reviewed changes
scripts/imgtool/image.py
message = digest
tlv.add(hash_tlv, digest)
else:
# Note that when Pure signature is used, hash TLV is not present.
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nordicjm @nvlsianpu I am bypassing addition of hash TLV in case when signature is pure; pure signature is not using it, but maybe the hash may be useful for something else is worth leaving it as it is?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@de-nordic Yes, it might be usefull: Hash is for check the integrity of the image, while the signature is for checking authenticity of the image. Usually HASH calculation is faster and doesn't require any key. I can expect that some cases might require just integrity calculation.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now the TLV sha is there, planning, for the future - not here, to add switch to not include it.

de-nordic added a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 10, 2024
@de-nordic
[nrf fromlist] imgtool: Add pure signature support
03bb20b 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
de-nordic added a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 10, 2024
@de-nordic
[nrf fromlist] imgtool: Add pure signature support
5416016 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
de-nordic added a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 10, 2024
@de-nordic
[nrf fromlist] imgtool: Add pure signature support
7a8be46 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
@nvlsianpu
Copy link
Collaborator

@de-nordic I would merge that. Any obstacles?

nvlsianpu pushed a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 17, 2024
@de-nordic @nvlsianpu
[nrf fromlist] imgtool: Add pure signature support
d4491da 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>
nvlsianpu pushed a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 18, 2024
@de-nordic @nvlsianpu
[nrf fromlist] imgtool: Add pure signature support
5c29840 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>
nvlsianpu pushed a commit to de-nordic/sdk-mcuboot that referenced this pull request Oct 19, 2024
@de-nordic @nvlsianpu
[nrf fromlist] imgtool: Add pure signature support
07ee100 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>
nvlsianpu
nvlsianpu reviewed Oct 19, 2024
View reviewed changes
scripts/imgtool/image.py
tlv.add(hash_tlv, digest)
self.image_hash = digest
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

self.image_hash is used externally

nvlsianpu pushed a commit to nrfconnect/sdk-mcuboot that referenced this pull request Oct 19, 2024
@de-nordic @nvlsianpu
[nrf fromlist] imgtool: Add pure signature support
32a6e8c 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>
rlubos pushed a commit to rlubos/fw-nrfconnect-mcuboot that referenced this pull request Oct 22, 2024
@de-nordic @rlubos
[nrf fromlist] imgtool: Add pure signature support
4691523 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>
(cherry picked from commit 32a6e8c)
rlubos pushed a commit to rlubos/fw-nrfconnect-mcuboot that referenced this pull request Oct 22, 2024
@de-nordic @rlubos
[nrf fromlist] imgtool: Add pure signature support
a5786cd 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Upstream PR: mcu-tools/mcuboot#2063

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
Signed-off-by: Andrzej Puzdrowski <andrzej.puzdrowski@nordicsemi.no>
(cherry picked from commit 32a6e8c)
@de-nordic
imgtool: Add pure signature support
5ca314d 
Adds PureEdDSA signature support.

The change includes implementation of SIG_PURE TLV that, when present,
indicates the signature that is present is Pure type.

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
@nvlsianpu
Copy link
Collaborator

@de-nordic Should we proceed with this patch?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nvlsianpu nvlsianpu nvlsianpu approved these changes

@d3zd3z d3zd3z Awaiting requested review from d3zd3z d3zd3z is a code owner

@michalek-no michalek-no Awaiting requested review from michalek-no

@nordicjm nordicjm Awaiting requested review from nordicjm

@gchwier gchwier Awaiting requested review from gchwier

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@de-nordic @nvlsianpu