blackbeard420/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf synced 2025-03-10 01:29:21 -04:00
Code Issues Projects Releases Wiki Activity

Merge branch 'bugfix/secure_boot_ecdsa_config' into 'master'

Browse Source 
secure boot: Ensure mbedTLS enables ECDSA if signatures are checked in app

See merge request espressif/esp-idf!5960
This commit is contained in:
Angus Gratton 2019-09-02 08:31:18 +08:00
commit eca4b855d9
3 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
components/bootloader/Kconfig.projbuild
View File

@ -281,12 +281,15 @@ menu "Security features"
config SECURE_SIGNED_ON_UPDATE
bool
default y
select MBEDTLS_ECP_DP_SECP256R1_ENABLED
depends on SECURE_BOOT_ENABLED || SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
config SECURE_SIGNED_APPS
bool
default y
select MBEDTLS_ECP_DP_SECP256R1_ENABLED
select MBEDTLS_ECP_C
select MBEDTLS_ECDH_C
select MBEDTLS_ECDSA_C
depends on SECURE_SIGNED_ON_BOOT || SECURE_SIGNED_ON_UPDATE

5
components/bootloader_support/src/idf/secure_boot_signatures.c
View File

@ -56,6 +56,10 @@ esp_err_t esp_secure_boot_verify_signature(uint32_t src_addr, uint32_t length)
esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest)
{
#if !(defined(CONFIG_MBEDTLS_ECDSA_C) && defined(CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED))
ESP_LOGE(TAG, "Signature verification requires ECDSA & SECP256R1 curve enabled");
return ESP_ERR_NOT_SUPPORTED;
#else
ptrdiff_t keylen;
keylen = signature_verification_key_end - signature_verification_key_start;
@ -117,4 +121,5 @@ cleanup:
mbedtls_mpi_free(&s);
mbedtls_ecdsa_free(&ecdsa_context);
return ret == 0 ? ESP_OK : ESP_ERR_IMAGE_INVALID;
#endif // CONFIG_MBEDTLS_ECDSA_C && CONFIG_MBEDTLS_ECP_DP_SECP256R1_ENABLED
}

2
components/mbedtls/Kconfig
View File

@ -241,7 +241,7 @@ menu "mbedTLS"
config MBEDTLS_KEY_EXCHANGE_ECDHE_PSK
bool "Enable ECDHE-PSK based ciphersuite modes"
depends on MBEDTLS_PSK_MODES
depends on MBEDTLS_PSK_MODES && MBEDTLS_ECDH_C
default y
help
Enable to support Elliptic-Curve-Diffie-Hellman PSK (pre-shared-key) TLS authentication modes.