boot: bootutil: fixes for image encryption support with PSA crypto - #2790
boot: bootutil: fixes for image encryption support with PSA crypto#2790tpambor wants to merge 4 commits into
Conversation
| # psa_generate_random() instead of the legacy mbedTLS entropy + CTR-DRBG | ||
| # APIs that were removed in tf-psa-crypto 1.0. | ||
| if(CONFIG_BOOT_USE_PSA_CRYPTO) | ||
| if(MCUBOOT_USE_PSA_CRYPTO) |
There was a problem hiding this comment.
I see that MCUBOOT_USE_PSA_CRYPTO is set when MCUboot is built from TF-M, but CONFIG_BOOT_USE_PSA_CRYPTO could be set when building from Zephyr (in case TF-M is not enabled in the build). Shouldn't we OR the condition here, so something like:
if(MCUBOOT_USE_PSA_CRYPTO || CONFIG_BOOT_USE_PSA_CRYPTO)
?
There was a problem hiding this comment.
This CMakeLists.txt isn't used by Zephyr. Zephyr selects it here:
mcuboot/boot/zephyr/CMakeLists.txt
Lines 133 to 137 in 7ad6710
with
CONFIG_BOOT_USE_PSA_CRYPTO
There was a problem hiding this comment.
Oh ok, sorry for the noise.
Replace the zephyr-specific CONFIG_BOOT_USE_PSA_CRYPTO option with the more generic MCUBOOT_USE_PSA_CRYPTO option. This allows to use the PSA crypto backend for fault injection hardening in non-zephyr builds. E.g. compiling Trusted Firmware-M with MCUBOOT_USE_PSA_CRYPTO set, will now correctly use the PSA crypto backend for fault injection hardening. Signed-off-by: Tim Pambor <tim.pambor@codewrights.de>
When the bootloader uses PSA Crypto (MCUBOOT_USE_PSA_CRYPTO), include encrypted_psa.c in addition to encrypted.c, which still provides the common encrypted image support, when using the PSA Crypto APIs. Signed-off-by: Tim Pambor <tim.pambor@codewrights.de>
Trusted Firmware-M starting with v2.3.0 always defines MCUBOOT_USE_PSA_CRYPTO, while MCUBOOT_USE_MBED_TLS remained defined until 11e9f28. This causes compile errors when image encryption (MCUBOOT_ENC_IMAGES) is enabled, as only one backend is allowed. Relax this requirement, similar to RSA and ECDSA, and allow both MCUBOOT_USE_PSA_CRYPTO and MCUBOOT_USE_MBED_TLS to be defined at the same time. In this case, the PSA_CRYPTO backend will take precedence over MBED_TLS. Signed-off-by: Tim Pambor <tim.pambor@codewrights.de>
boot_decrypt_key() is only utilized when decrypting an image that was encrypted with ECIES-P256/ECIES-X25519. Guard the code to only include it when the feature is enabled. Additionally, conditionally include bootutil/crypto/common.h only when EC256/X25519 encryption is enabled, since only these algorithms depend on mbedTLS for ASN1 parsing. Other algorithms, e.g., AES-KW, have no mbedTLS dependency, so this change enables building with a pure PSA API implementation without requiring mbedTLS headers. Signed-off-by: Tim Pambor <tim.pambor@codewrights.de>
|
@nordicjm @d3zd3z @de-nordic Could you please take a look as these changes are required for image encryption support with TF-M/BL2 in zephyr. |
Needs @d3zd3z approval mostly |
|
Maybe @davidvincze can take a look |
4 participants
Trusted Firmware-M (TF-M) starting with v2.3.0 is utilizing purely the PSA crypto API. This PR contains fixes for the image encryption support (MCUBOOT_ENC_IMAGES) that have been discovered while working with TF-M v2.3.0+.
bootutil: crypto: aes_ctr: allow PSA_CRYPTO together with MBED_TLSis included to maintain support for older TF-M versions which utilize a mixture of PSA crypto and mbedtls.For details, see the commit messages of the individual commits.