On Wed, Jan 08, 2020 at 01:35:13PM +0100, Heinrich Schuchardt wrote:

On 11/21/19 1:11 AM, AKASHI Takahiro wrote:

...

In the next couple of commits, under new CONFIG_RSA_VERIFY_WITH_PKEY, rsa_verify() will be extended to be able to perform RSA decryption without additional RSA key properties from FIT image, i.e. rr and n0inv.

Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org Reviewed-by: Simon Glass sjg@chromium.org

The patch series does not build for some configurations.

...

---

lib/rsa/Kconfig | 14 ++++++++++++++ 1 file changed, 14 insertions(+)

diff --git a/lib/rsa/Kconfig b/lib/rsa/Kconfig index 03ffa2969048..71e4c06bf883 100644 --- a/lib/rsa/Kconfig +++ b/lib/rsa/Kconfig @@ -30,6 +30,20 @@ config RSA_VERIFY help Add RSA signature verification support.

+config RSA_VERIFY_WITH_PKEY

For CONFIG_RSA_VERIFY_WITH_PKEY=y and CONFIG_RSA_PUBLIC_KEY_PARSER=n I get an error:

This error is inevitable as both RSA_VERIFY_WITH_PKEY and RSA_PUBLIC_KEY_PARSER are "select"able configurations with visible prompts and then we should generally avoid potential illegal configurations; The one should NOT forcibly select the other as the kernel kconfig document suggests.

# Note: # select should be used with care. select will force # a symbol to a value without visiting the dependencies. # By abusing select you are able to select a symbol FOO even # if FOO depends on BAR that is not set. # In general use select only for non-visible symbols # (no prompts anywhere) and for symbols with no dependencies. # That will limit the usefulness but on the other hand avoid # the illegal configurations all over.

-Takahiro Akashi

lib/rsa/rsa-keyprop.c:669: undefined reference to `rsa_parse_pub_key'

RSA_PUBLIC_KEY_PARSER depends on ASYMMETRIC_KEY_TYPE [=n] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n]

Please, fix the dependencies.

Best regards

Heinrich

...

• bool "Execute RSA verification without key parameters from FDT"
• depends on RSA
• help

•  The standard RSA-signature verification code (FIT_SIGNATURE) uses
  

•  pre-calculated key properties, that are stored in fdt blob, in
  

•  decrypting a signature.
  

•  This does not suit the use case where there is no way defined to
  

•  provide such additional key properties in standardized form,
  

•  particularly UEFI secure boot.
  

•  This options enables RSA signature verification with a public key
  

•  directly specified in image_sign_info, where all the necessary
  

•  key properties will be calculated on the fly in verification code.
  

config RSA_SOFTWARE_EXP bool "Enable driver for RSA Modular Exponentiation in software" depends on DM

On Tue, Jan 14, 2020 at 12:43:40PM +0100, Heinrich Schuchardt wrote:

On 1/14/20 8:45 AM, AKASHI Takahiro wrote:

...

On Wed, Jan 08, 2020 at 01:35:13PM +0100, Heinrich Schuchardt wrote:

...

On 11/21/19 1:11 AM, AKASHI Takahiro wrote:

...

In the next couple of commits, under new CONFIG_RSA_VERIFY_WITH_PKEY, rsa_verify() will be extended to be able to perform RSA decryption without additional RSA key properties from FIT image, i.e. rr and n0inv.

Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org Reviewed-by: Simon Glass sjg@chromium.org

The patch series does not build for some configurations.

...

---

lib/rsa/Kconfig | 14 ++++++++++++++ 1 file changed, 14 insertions(+)

diff --git a/lib/rsa/Kconfig b/lib/rsa/Kconfig index 03ffa2969048..71e4c06bf883 100644 --- a/lib/rsa/Kconfig +++ b/lib/rsa/Kconfig @@ -30,6 +30,20 @@ config RSA_VERIFY help Add RSA signature verification support.

+config RSA_VERIFY_WITH_PKEY

For CONFIG_RSA_VERIFY_WITH_PKEY=y and CONFIG_RSA_PUBLIC_KEY_PARSER=n I get an error:

This error is inevitable as both RSA_VERIFY_WITH_PKEY and RSA_PUBLIC_KEY_PARSER are "select"able configurations with visible prompts and then

No, it is not inevitbable. Just ensure that in the Makefiles all modules are selected that you need for your configuration.

How? Can you please show me a simple solution?

Thanks, -Takahiro Akashi

...

we should generally avoid potential illegal configurations;

Yes, we want to avoid potentially illegal configurations everywhere. This is why we have a randconfig build target.

Best regards

Heinrich

...

The one should NOT forcibly select the other as the kernel kconfig document suggests.

# Note: # select should be used with care. select will force # a symbol to a value without visiting the dependencies. # By abusing select you are able to select a symbol FOO even # if FOO depends on BAR that is not set. # In general use select only for non-visible symbols # (no prompts anywhere) and for symbols with no dependencies. # That will limit the usefulness but on the other hand avoid # the illegal configurations all over.

-Takahiro Akashi

...

lib/rsa/rsa-keyprop.c:669: undefined reference to `rsa_parse_pub_key'

RSA_PUBLIC_KEY_PARSER depends on ASYMMETRIC_KEY_TYPE [=n] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n]

Please, fix the dependencies.

Best regards

Heinrich

...

• bool "Execute RSA verification without key parameters from FDT"
• depends on RSA
• help

•  The standard RSA-signature verification code (FIT_SIGNATURE) uses
  

•  pre-calculated key properties, that are stored in fdt blob, in
  

•  decrypting a signature.
  

•  This does not suit the use case where there is no way defined to
  

•  provide such additional key properties in standardized form,
  

•  particularly UEFI secure boot.
  

•  This options enables RSA signature verification with a public key
  

•  directly specified in image_sign_info, where all the necessary
  

•  key properties will be calculated on the fly in verification code.
  

config RSA_SOFTWARE_EXP bool "Enable driver for RSA Modular Exponentiation in software" depends on DM

Tom, Simon,

On Fri, Jan 17, 2020 at 06:59:44AM +0100, Heinrich Schuchardt wrote:

On 1/17/20 3:24 AM, AKASHI Takahiro wrote:

...

On Tue, Jan 14, 2020 at 12:43:40PM +0100, Heinrich Schuchardt wrote:

...

On 1/14/20 8:45 AM, AKASHI Takahiro wrote:

...

On Wed, Jan 08, 2020 at 01:35:13PM +0100, Heinrich Schuchardt wrote:

...

On 11/21/19 1:11 AM, AKASHI Takahiro wrote:

...

In the next couple of commits, under new CONFIG_RSA_VERIFY_WITH_PKEY, rsa_verify() will be extended to be able to perform RSA decryption without additional RSA key properties from FIT image, i.e. rr and n0inv.

Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org Reviewed-by: Simon Glass sjg@chromium.org

The patch series does not build for some configurations.

...

---

lib/rsa/Kconfig | 14 ++++++++++++++ 1 file changed, 14 insertions(+)

diff --git a/lib/rsa/Kconfig b/lib/rsa/Kconfig index 03ffa2969048..71e4c06bf883 100644 --- a/lib/rsa/Kconfig +++ b/lib/rsa/Kconfig @@ -30,6 +30,20 @@ config RSA_VERIFY help Add RSA signature verification support.

+config RSA_VERIFY_WITH_PKEY

For CONFIG_RSA_VERIFY_WITH_PKEY=y and CONFIG_RSA_PUBLIC_KEY_PARSER=n I get an error:

This error is inevitable as both RSA_VERIFY_WITH_PKEY and RSA_PUBLIC_KEY_PARSER are "select"able configurations with visible prompts and then

No, it is not inevitbable. Just ensure that in the Makefiles all modules are selected that you need for your configuration.

How? Can you please show me a simple solution?

Which is your choice as a maintainer/author of lib/rsa?

In my opinion,

ifneq($(CONFIG_RSA_VERIFY_WITH_PKEY)$(CONFIG_RSA_PUBLIC_KEY_PARSER),) obj-y += foo.o endif

I will take this by a process of elimination.

or

config RSA_VERIFY_WITH_PKEY depends on RSA_PUBLIC_KEY_PARSER

I normally use "depends on" to select a subset feature of the target.

or

config RSA_VERIFY_WITH_PKEY select RSA_PUBLIC_KEY_PARSER

Nak, as I said, because RSA_PUBLIC_KEY_PARSER is a visible configuration symbol.

Thanks, -Takahiro Akashi

Best regards

Heinrich

...

Thanks, -Takahiro Akashi

...

...

we should generally avoid potential illegal configurations;

Yes, we want to avoid potentially illegal configurations everywhere. This is why we have a randconfig build target.

Best regards

Heinrich

...

The one should NOT forcibly select the other as the kernel kconfig document suggests.

# Note: # select should be used with care. select will force # a symbol to a value without visiting the dependencies. # By abusing select you are able to select a symbol FOO even # if FOO depends on BAR that is not set. # In general use select only for non-visible symbols # (no prompts anywhere) and for symbols with no dependencies. # That will limit the usefulness but on the other hand avoid # the illegal configurations all over.

-Takahiro Akashi

...

lib/rsa/rsa-keyprop.c:669: undefined reference to `rsa_parse_pub_key'

RSA_PUBLIC_KEY_PARSER depends on ASYMMETRIC_KEY_TYPE [=n] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n]

Please, fix the dependencies.

Best regards

Heinrich

...

• bool "Execute RSA verification without key parameters from FDT"
• depends on RSA
• help

•  The standard RSA-signature verification code (FIT_SIGNATURE) uses
  

•  pre-calculated key properties, that are stored in fdt blob, in
  

•  decrypting a signature.
  

•  This does not suit the use case where there is no way defined to
  

•  provide such additional key properties in standardized form,
  

•  particularly UEFI secure boot.
  

•  This options enables RSA signature verification with a public key
  

•  directly specified in image_sign_info, where all the necessary
  

•  key properties will be calculated on the fly in verification code.
  

config RSA_SOFTWARE_EXP bool "Enable driver for RSA Modular Exponentiation in software" depends on DM

On 11/21/19 1:11 AM, AKASHI Takahiro wrote:

In the current implementation of FIT_SIGNATURE, five parameters for a RSA public key are required while only two of them are essential. (See rsa-mod-exp.h and uImage.FIT/signature.txt) This is a result of considering relatively limited computer power and resources on embedded systems, while such a assumption may not be quite practical for other use cases.

In this patch, added is a function, rsa_gen_key_prop(), which will generate additional parameters for other uses, in particular UEFI secure boot, on the fly.

Note: the current code uses some "big number" rouKtines from BearSSL for the calculation.

Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org

include/u-boot/rsa-mod-exp.h | 23 ++ lib/rsa/Kconfig | 1 + lib/rsa/Makefile | 1 + lib/rsa/rsa-keyprop.c | 725 +++++++++++++++++++++++++++++++++++ 4 files changed, 750 insertions(+) create mode 100644 lib/rsa/rsa-keyprop.c

diff --git a/include/u-boot/rsa-mod-exp.h b/include/u-boot/rsa-mod-exp.h index 8a428c4b6a1a..1da8af1bb83d 100644 --- a/include/u-boot/rsa-mod-exp.h +++ b/include/u-boot/rsa-mod-exp.h @@ -26,6 +26,29 @@ struct key_prop { uint32_t exp_len; /* Exponent length in number of uint8_t */ };

+/**

• • rsa_gen_key_prop() - Generate key properties of RSA public key
• • @key: Specifies key data in DER format
• • @keylen: Length of @key
• • @prop: Generated key property
• • This function takes a blob of encoded RSA public key data in DER
• • format, parse it and generate all the relevant properties
• • in key_prop structure.
• • Return a pointer to struct key_prop in @prop on success.
• • Return: 0 on success, negative on error
• */

+int rsa_gen_key_prop(const void *key, uint32_t keylen, struct key_prop **proc);

+/**

• • rsa_free_key_prop() - Free key properties
• • @prop: Pointer to struct key_prop
• • This function frees all the memories allocated by rsa_gen_key_prop().
• */

+void rsa_free_key_prop(struct key_prop *prop);

• /**
  • rsa_mod_exp_sw() - Perform RSA Modular Exponentiation in sw

diff --git a/lib/rsa/Kconfig b/lib/rsa/Kconfig index 71e4c06bf883..d1d6f6cf64a3 100644 --- a/lib/rsa/Kconfig +++ b/lib/rsa/Kconfig @@ -33,6 +33,7 @@ config RSA_VERIFY config RSA_VERIFY_WITH_PKEY bool "Execute RSA verification without key parameters from FDT" depends on RSA

• imply RSA_PUBLIC_KEY_PARSER

Do we really need RSA_PUBLIC_KEY_PARSER whenever we use CONFIG_RSA=y? E.g. on a system without the UEFI sub-system?

Otherwise simply let RSA_PUBLIC_KEY_PARSER depend on RSA.

help The standard RSA-signature verification code (FIT_SIGNATURE) uses pre-calculated key properties, that are stored in fdt blob, in diff --git a/lib/rsa/Makefile b/lib/rsa/Makefile index c07305188e0c..14ed3cb4012b 100644 --- a/lib/rsa/Makefile +++ b/lib/rsa/Makefile @@ -6,4 +6,5 @@ # Wolfgang Denk, DENX Software Engineering, wd@denx.de.

obj-$(CONFIG_$(SPL_)RSA_VERIFY) += rsa-verify.o rsa-checksum.o +obj-$(CONFIG_RSA_VERIFY_WITH_PKEY) += rsa-keyprop.o obj-$(CONFIG_RSA_SOFTWARE_EXP) += rsa-mod-exp.o diff --git a/lib/rsa/rsa-keyprop.c b/lib/rsa/rsa-keyprop.c new file mode 100644 index 000000000000..9464df009343 --- /dev/null +++ b/lib/rsa/rsa-keyprop.c @@ -0,0 +1,725 @@ +// SPDX-License-Identifier: GPL-2.0+ and MIT +/*

• • RSA library - generate parameters for a public key
• • Copyright (c) 2019 Linaro Limited
• • Author: AKASHI Takahiro
• • Big number routines in this file come from BearSSL:
• • Copyright (c) 2016 Thomas Pornin pornin@bolet.org
• */

+#include <common.h> +#include <image.h> +#include <malloc.h> +#include <asm/byteorder.h> +#include <crypto/internal/rsa.h> +#include <u-boot/rsa-mod-exp.h>

+/**

• • br_dec16be() - Convert 16-bit big-endian integer to native
• • @src: Pointer to data
• • Return: Native-endian integer
• */

+static unsigned br_dec16be(const void *src) +{

• return be16_to_cpup(src);

+}

+/**

• • br_dec32be() - Convert 32-bit big-endian integer to native
• • @src: Pointer to data
• • Return: Native-endian integer
• */

+static uint32_t br_dec32be(const void *src) +{

• return be32_to_cpup(src);

+}

+/**

• • br_enc32be() - Convert native 32-bit integer to big-endian
• • @dst: Pointer to buffer to store big-endian integer in
• • @x: Native 32-bit integer
• */

+static void br_enc32be(void *dst, uint32_t x) +{

• __be32 tmp;
• tmp = cpu_to_be32(x);
• memcpy(dst, &tmp, sizeof(tmp));

+}

+/* from BearSSL's src/inner.h */

+/*

• • Negate a boolean.
• */

+static uint32_t NOT(uint32_t ctl) +{

• return ctl ^ 1;

+}

+/*

• • Multiplexer: returns x if ctl == 1, y if ctl == 0.
• */

+static uint32_t MUX(uint32_t ctl, uint32_t x, uint32_t y) +{

• return y ^ (-ctl & (x ^ y));

+}

+/*

• • Equality check: returns 1 if x == y, 0 otherwise.
• */

+static uint32_t EQ(uint32_t x, uint32_t y) +{

• uint32_t q;
• q = x ^ y;
• return NOT((q | -q) >> 31);

+}

+/*

• • Inequality check: returns 1 if x != y, 0 otherwise.
• */

+static uint32_t NEQ(uint32_t x, uint32_t y) +{

• uint32_t q;
• q = x ^ y;
• return (q | -q) >> 31;

We want to minimize the code size of U-Boot.

So, please, review this code and remove all of this bogus.

Best regards

Heinrich

+}

+/*

• • Comparison: returns 1 if x > y, 0 otherwise.
• */

+static uint32_t GT(uint32_t x, uint32_t y) +{

• /*

• * If both x < 2^31 and y < 2^31, then y-x will have its high
  

• * bit set if x > y, cleared otherwise.
  

• *
  

• * If either x >= 2^31 or y >= 2^31 (but not both), then the
  

• * result is the high bit of x.
  

• *
  

• * If both x >= 2^31 and y >= 2^31, then we can virtually
  

• * subtract 2^31 from both, and we are back to the first case.
  

• * Since (y-2^31)-(x-2^31) = y-x, the subtraction is already
  

• * fine.
  

• */
  

• uint32_t z;
• z = y - x;
• return (z ^ ((x ^ y) & (x ^ z))) >> 31;

+}

+/*

• • Compute the bit length of a 32-bit integer. Returned value is between 0
• • and 32 (inclusive).
• */

+static uint32_t BIT_LENGTH(uint32_t x) +{

• uint32_t k, c;
• k = NEQ(x, 0);
• c = GT(x, 0xFFFF); x = MUX(c, x >> 16, x); k += c << 4;
• c = GT(x, 0x00FF); x = MUX(c, x >> 8, x); k += c << 3;
• c = GT(x, 0x000F); x = MUX(c, x >> 4, x); k += c << 2;
• c = GT(x, 0x0003); x = MUX(c, x >> 2, x); k += c << 1;
• k += GT(x, 0x0001);
• return k;

+}

+#define GE(x, y) NOT(GT(y, x)) +#define LT(x, y) GT(y, x) +#define MUL(x, y) ((uint64_t)(x) * (uint64_t)(y))

+/*

• • Integers 'i32'

• • ---

• • The 'i32' functions implement computations on big integers using
• • an internal representation as an array of 32-bit integers. For
• • an array x[]:
• • -- x[0] contains the "announced bit length" of the integer
• • -- x[1], x[2]... contain the value in little-endian order (x[1]

• • contains the least significant 32 bits)
    

• • Multiplications rely on the elementary 32x32->64 multiplication.
• • The announced bit length specifies the number of bits that are
• • significant in the subsequent 32-bit words. Unused bits in the
• • last (most significant) word are set to 0; subsequent words are
• • uninitialized and need not exist at all.
• • The execution time and memory access patterns of all computations
• • depend on the announced bit length, but not on the actual word
• • values. For modular integers, the announced bit length of any integer
• • modulo n is equal to the actual bit length of n; thus, computations
• • on modular integers are "constant-time" (only the modulus length may
• • leak).
• */

+/*

• • Extract one word from an integer. The offset is counted in bits.
• • The word MUST entirely fit within the word elements corresponding
• • to the announced bit length of a[].
• */

+static uint32_t br_i32_word(const uint32_t *a, uint32_t off) +{

• size_t u;
• unsigned j;
• u = (size_t)(off >> 5) + 1;
• j = (unsigned)off & 31;
• if (j == 0) {

• return a[u];
  

• } else {

• return (a[u] >> j) | (a[u + 1] << (32 - j));
  

• }

+}

+/* from BearSSL's src/int/i32_bitlen.c */

+/*

• • Compute the actual bit length of an integer. The argument x should
• • point to the first (least significant) value word of the integer.
• • The len 'xlen' contains the number of 32-bit words to access.
• • CT: value or length of x does not leak.
• */

+static uint32_t br_i32_bit_length(uint32_t *x, size_t xlen) +{

• uint32_t tw, twk;
• tw = 0;
• twk = 0;
• while (xlen -- > 0) {

• uint32_t w, c;
  

• c = EQ(tw, 0);
  

• w = x[xlen];
  

• tw = MUX(c, w, tw);
  

• twk = MUX(c, (uint32_t)xlen, twk);
  

• }
• return (twk << 5) + BIT_LENGTH(tw);

+}

+/* from BearSSL's src/int/i32_decode.c */

+/*

• • Decode an integer from its big-endian unsigned representation. The
• • "true" bit length of the integer is computed, but all words of x[]
• • corresponding to the full 'len' bytes of the source are set.
• • CT: value or length of x does not leak.
• */

+static void br_i32_decode(uint32_t *x, const void *src, size_t len) +{

• const unsigned char *buf;
• size_t u, v;
• buf = src;
• u = len;
• v = 1;
• for (;;) {

• if (u < 4) {
  

• 	uint32_t w;
  

• 	if (u < 2) {
  

• 		if (u == 0) {
  

• 			break;
  

• 		} else {
  

• 			w = buf[0];
  

• 		}
  

• 	} else {
  

• 		if (u == 2) {
  

• 			w = br_dec16be(buf);
  

• 		} else {
  

• 			w = ((uint32_t)buf[0] << 16)
  

• 				| br_dec16be(buf + 1);
  

• 		}
  

• 	}
  

• 	x[v ++] = w;
  

• 	break;
  

• } else {
  

• 	u -= 4;
  

• 	x[v ++] = br_dec32be(buf + u);
  

• }
  

• }
• x[0] = br_i32_bit_length(x + 1, v - 1);

+}

+/* from BearSSL's src/int/i32_encode.c */

+/*

• • Encode an integer into its big-endian unsigned representation. The
• • output length in bytes is provided (parameter 'len'); if the length
• • is too short then the integer is appropriately truncated; if it is
• • too long then the extra bytes are set to 0.
• */

+static void br_i32_encode(void *dst, size_t len, const uint32_t *x) +{

• unsigned char *buf;
• size_t k;
• buf = dst;
• /*

• * Compute the announced size of x in bytes; extra bytes are
  

• * filled with zeros.
  

• */
  

• k = (x[0] + 7) >> 3;
• while (len > k) {

• *buf ++ = 0;
  

• len --;
  

• }
• /*

• * Now we use k as index within x[]. That index starts at 1;
  

• * we initialize it to the topmost complete word, and process
  

• * any remaining incomplete word.
  

• */
  

• k = (len + 3) >> 2;
• switch (len & 3) {
• case 3:

• *buf ++ = x[k] >> 16;
  

• /* fall through */
  

• case 2:

• *buf ++ = x[k] >> 8;
  

• /* fall through */
  

• case 1:

• *buf ++ = x[k];
  

• k --;
  

• }
• /*

• * Encode all complete words.
  

• */
  

• while (k > 0) {

• br_enc32be(buf, x[k]);
  

• k --;
  

• buf += 4;
  

• }

+}

+/* from BearSSL's src/int/i32_ninv32.c */

+/*

• • Compute -(1/x) mod 2^32. If x is even, then this function returns 0.
• */

+static uint32_t br_i32_ninv32(uint32_t x) +{

• uint32_t y;
• y = 2 - x;
• y *= 2 - y * x;
• y *= 2 - y * x;
• y *= 2 - y * x;
• y *= 2 - y * x;
• return MUX(x & 1, -y, 0);

+}

+/* from BearSSL's src/int/i32_add.c */

+/*

• • Add b[] to a[] and return the carry (0 or 1). If ctl is 0, then a[]
• • is unmodified, but the carry is still computed and returned. The
• • arrays a[] and b[] MUST have the same announced bit length.
• • a[] and b[] MAY be the same array, but partial overlap is not allowed.
• */

+static uint32_t br_i32_add(uint32_t *a, const uint32_t *b, uint32_t ctl) +{

• uint32_t cc;
• size_t u, m;
• cc = 0;
• m = (a[0] + 63) >> 5;
• for (u = 1; u < m; u ++) {

• uint32_t aw, bw, naw;
  

• aw = a[u];
  

• bw = b[u];
  

• naw = aw + bw + cc;
  

• /*
  

•  * Carry is 1 if naw < aw. Carry is also 1 if naw == aw
  

•  * AND the carry was already 1.
  

•  */
  

• cc = (cc & EQ(naw, aw)) | LT(naw, aw);
  

• a[u] = MUX(ctl, naw, aw);
  

• }
• return cc;

+}

+/* from BearSSL's src/int/i32_sub.c */

+/*

• • Subtract b[] from a[] and return the carry (0 or 1). If ctl is 0,
• • then a[] is unmodified, but the carry is still computed and returned.
• • The arrays a[] and b[] MUST have the same announced bit length.
• • a[] and b[] MAY be the same array, but partial overlap is not allowed.
• */

+static uint32_t br_i32_sub(uint32_t *a, const uint32_t *b, uint32_t ctl) +{

• uint32_t cc;
• size_t u, m;
• cc = 0;
• m = (a[0] + 63) >> 5;
• for (u = 1; u < m; u ++) {

• uint32_t aw, bw, naw;
  

• aw = a[u];
  

• bw = b[u];
  

• naw = aw - bw - cc;
  

• /*
  

•  * Carry is 1 if naw > aw. Carry is 1 also if naw == aw
  

•  * AND the carry was already 1.
  

•  */
  

• cc = (cc & EQ(naw, aw)) | GT(naw, aw);
  

• a[u] = MUX(ctl, naw, aw);
  

• }
• return cc;

+}

+/* from BearSSL's src/int/i32_div32.c */

+/*

• • Constant-time division. The dividend hi:lo is divided by the
• • divisor d; the quotient is returned and the remainder is written
• • in *r. If hi == d, then the quotient does not fit on 32 bits;
• • returned value is thus truncated. If hi > d, returned values are
• • indeterminate.
• */

+static uint32_t br_divrem(uint32_t hi, uint32_t lo, uint32_t d, uint32_t *r) +{

• /* TODO: optimize this */
• uint32_t q;
• uint32_t ch, cf;
• int k;
• q = 0;
• ch = EQ(hi, d);
• hi = MUX(ch, 0, hi);
• for (k = 31; k > 0; k --) {

• int j;
  

• uint32_t w, ctl, hi2, lo2;
  

• j = 32 - k;
  

• w = (hi << j) | (lo >> k);
  

• ctl = GE(w, d) | (hi >> k);
  

• hi2 = (w - d) >> j;
  

• lo2 = lo - (d << k);
  

• hi = MUX(ctl, hi2, hi);
  

• lo = MUX(ctl, lo2, lo);
  

• q |= ctl << k;
  

• }
• cf = GE(lo, d) | hi;
• q |= cf;
• *r = MUX(cf, lo - d, lo);
• return q;

+}

+/*

• • Wrapper for br_divrem(); the remainder is returned, and the quotient
• • is discarded.
• */

+static uint32_t br_rem(uint32_t hi, uint32_t lo, uint32_t d) +{

• uint32_t r;
• br_divrem(hi, lo, d, &r);
• return r;

+}

+/*

• • Wrapper for br_divrem(); the quotient is returned, and the remainder
• • is discarded.
• */

+static uint32_t br_div(uint32_t hi, uint32_t lo, uint32_t d) +{

• uint32_t r;
• return br_divrem(hi, lo, d, &r);

+}

+/* from BearSSL's src/int/i32_muladd.c */

+/*

• • Multiply x[] by 2^32 and then add integer z, modulo m[]. This
• • function assumes that x[] and m[] have the same announced bit
• • length, and the announced bit length of m[] matches its true
• • bit length.
• • x[] and m[] MUST be distinct arrays.
• • CT: only the common announced bit length of x and m leaks, not
• • the values of x, z or m.
• */

+static void br_i32_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m) +{

• uint32_t m_bitlen;
• size_t u, mlen;
• uint32_t a0, a1, b0, hi, g, q, tb;
• uint32_t chf, clow, under, over;
• uint64_t cc;
• /*

• * We can test on the modulus bit length since we accept to
  

• * leak that length.
  

• */
  

• m_bitlen = m[0];
• if (m_bitlen == 0) {

• return;
  

• }
• if (m_bitlen <= 32) {

• x[1] = br_rem(x[1], z, m[1]);
  

• return;
  

• }
• mlen = (m_bitlen + 31) >> 5;
• /*

• * Principle: we estimate the quotient (x*2^32+z)/m by
  

• * doing a 64/32 division with the high words.
  

• *
  

• * Let:
  

• *   w = 2^32
  

• *   a = (w*a0 + a1) * w^N + a2
  

• *   b = b0 * w^N + b2
  

• * such that:
  

• *   0 <= a0 < w
  

• *   0 <= a1 < w
  

• *   0 <= a2 < w^N
  

• *   w/2 <= b0 < w
  

• *   0 <= b2 < w^N
  

• *   a < w*b
  

• * I.e. the two top words of a are a0:a1, the top word of b is
  

• * b0, we ensured that b0 is "full" (high bit set), and a is
  

• * such that the quotient q = a/b fits on one word (0 <= q < w).
  

• *
  

• * If a = b*q + r (with 0 <= r < q), we can estimate q by
  

• * doing an Euclidean division on the top words:
  

• *   a0*w+a1 = b0*u + v  (with 0 <= v < w)
  

• * Then the following holds:
  

• *   0 <= u <= w
  

• *   u-2 <= q <= u
  

• */
  

• a0 = br_i32_word(x, m_bitlen - 32);
• hi = x[mlen];
• memmove(x + 2, x + 1, (mlen - 1) * sizeof *x);
• x[1] = z;
• a1 = br_i32_word(x, m_bitlen - 32);
• b0 = br_i32_word(m, m_bitlen - 32);
• /*

• * We estimate a divisor q. If the quotient returned by br_div()
  

• * is g:
  

• * -- If a0 == b0 then g == 0; we want q = 0xFFFFFFFF.
  

• * -- Otherwise:
  

• *    -- if g == 0 then we set q = 0;
  

• *    -- otherwise, we set q = g - 1.
  

• * The properties described above then ensure that the true
  

• * quotient is q-1, q or q+1.
  

• */
  

• g = br_div(a0, a1, b0);
• q = MUX(EQ(a0, b0), 0xFFFFFFFF, MUX(EQ(g, 0), 0, g - 1));
• /*

• * We subtract q*m from x (with the extra high word of value 'hi').
  

• * Since q may be off by 1 (in either direction), we may have to
  

• * add or subtract m afterwards.
  

• *
  

• * The 'tb' flag will be true (1) at the end of the loop if the
  

• * result is greater than or equal to the modulus (not counting
  

• * 'hi' or the carry).
  

• */
  

• cc = 0;
• tb = 1;
• for (u = 1; u <= mlen; u ++) {

• uint32_t mw, zw, xw, nxw;
  

• uint64_t zl;
  

• mw = m[u];
  

• zl = MUL(mw, q) + cc;
  

• cc = (uint32_t)(zl >> 32);
  

• zw = (uint32_t)zl;
  

• xw = x[u];
  

• nxw = xw - zw;
  

• cc += (uint64_t)GT(nxw, xw);
  

• x[u] = nxw;
  

• tb = MUX(EQ(nxw, mw), tb, GT(nxw, mw));
  

• }
• /*

• * If we underestimated q, then either cc < hi (one extra bit
  

• * beyond the top array word), or cc == hi and tb is true (no
  

• * extra bit, but the result is not lower than the modulus). In
  

• * these cases we must subtract m once.
  

• *
  

• * Otherwise, we may have overestimated, which will show as
  

• * cc > hi (thus a negative result). Correction is adding m once.
  

• */
  

• chf = (uint32_t)(cc >> 32);
• clow = (uint32_t)cc;
• over = chf | GT(clow, hi);
• under = ~over & (tb | (~chf & LT(clow, hi)));
• br_i32_add(x, m, over);
• br_i32_sub(x, m, under);

+}

+/* from BearSSL's src/int/i32_reduce.c */

+/*

• • Reduce an integer (a[]) modulo another (m[]). The result is written
• • in x[] and its announced bit length is set to be equal to that of m[].
• • x[] MUST be distinct from a[] and m[].
• • CT: only announced bit lengths leak, not values of x, a or m.
• */

+static void br_i32_reduce(uint32_t *x, const uint32_t *a, const uint32_t *m) +{

• uint32_t m_bitlen, a_bitlen;
• size_t mlen, alen, u;
• m_bitlen = m[0];
• mlen = (m_bitlen + 31) >> 5;
• x[0] = m_bitlen;
• if (m_bitlen == 0) {

• return;
  

• }
• /*

• * If the source is shorter, then simply copy all words from a[]
  

• * and zero out the upper words.
  

• */
  

• a_bitlen = a[0];
• alen = (a_bitlen + 31) >> 5;
• if (a_bitlen < m_bitlen) {

• memcpy(x + 1, a + 1, alen * sizeof *a);
  

• for (u = alen; u < mlen; u ++) {
  

• 	x[u + 1] = 0;
  

• }
  

• return;
  

• }
• /*

• * The source length is at least equal to that of the modulus.
  

• * We must thus copy N-1 words, and input the remaining words
  

• * one by one.
  

• */
  

• memcpy(x + 1, a + 2 + (alen - mlen), (mlen - 1) * sizeof *a);
• x[mlen] = 0;
• for (u = 1 + alen - mlen; u > 0; u --) {

• br_i32_muladd_small(x, a[u], m);
  

• }

+}

+/**

• • rsa_free_key_prop() - Free key properties
• • @prop: Pointer to struct key_prop
• • This function frees all the memories allocated by rsa_gen_key_prop().
• */

+void rsa_free_key_prop(struct key_prop *prop) +{

• if (!prop)

• return;
  

• free((void *)prop->modulus);
• free((void *)prop->public_exponent);
• free((void *)prop->rr);
• free(prop);

+}

+/**

• • rsa_gen_key_prop() - Generate key properties of RSA public key
• • @key: Specifies key data in DER format
• • @keylen: Length of @key
• • @prop: Generated key property
• • This function takes a blob of encoded RSA public key data in DER
• • format, parse it and generate all the relevant properties
• • in key_prop structure.
• • Return a pointer to struct key_prop in @prop on success.
• • Return: 0 on success, negative on error
• */

+int rsa_gen_key_prop(const void *key, uint32_t keylen, struct key_prop **prop) +{

• struct rsa_key rsa_key;
• uint32_t *n = NULL, *rr = NULL, *rrtmp = NULL;
• const int max_rsa_size = 4096;
• int rlen, i, ret;
• *prop = calloc(sizeof(**prop), 1);
• n = calloc(sizeof(uint32_t), 1 + (max_rsa_size >> 5));
• rr = calloc(sizeof(uint32_t), 1 + (max_rsa_size >> 5));
• rrtmp = calloc(sizeof(uint32_t), 1 + (max_rsa_size >> 5));
• if (!(*prop) || !n || !rr || !rrtmp) {

• ret = -ENOMEM;
  

• goto err;
  

• }
• ret = rsa_parse_pub_key(&rsa_key, key, keylen);
• if (ret)

• goto err;
  

• /* modulus */
• /* removing leading 0's */
• for (i = 0; i < rsa_key.n_sz && !rsa_key.n[i]; i++)

• ;
  

• (*prop)->num_bits = (rsa_key.n_sz - i) * 8;
• (*prop)->modulus = malloc(rsa_key.n_sz - i);
• if (!(*prop)->modulus) {

• ret = -ENOMEM;
  

• goto err;
  

• }
• memcpy((void *)(*prop)->modulus, &rsa_key.n[i], rsa_key.n_sz - i);
• /* exponent */
• (*prop)->public_exponent = calloc(1, sizeof(uint64_t));
• if (!(*prop)->public_exponent) {

• ret = -ENOMEM;
  

• goto err;
  

• }
• memcpy((void *)(*prop)->public_exponent + sizeof(uint64_t)

• 				- rsa_key.e_sz,
  

•       rsa_key.e, rsa_key.e_sz);
  

• (*prop)->exp_len = rsa_key.e_sz;
• /* n0 inverse */
• br_i32_decode(n, &rsa_key.n[i], rsa_key.n_sz - i);
• (*prop)->n0inv = br_i32_ninv32(n[1]);
• /* R^2 mod n; R = 2^(num_bits) */
• rlen = (*prop)->num_bits * 2; /* #bits of R^2 = (2^num_bits)^2 */
• rr[0] = 0;
• *(uint8_t *)&rr[0] = (1 << (rlen % 8));
• for (i = 1; i < (((rlen + 31) >> 5) + 1); i++)

• rr[i] = 0;
  

• br_i32_decode(rrtmp, rr, ((rlen + 7) >> 3) + 1);
• br_i32_reduce(rr, rrtmp, n);
• rlen = ((*prop)->num_bits + 7) >> 3; /* #bytes of R^2 mod n */
• (*prop)->rr = malloc(rlen);
• if (!(*prop)->rr) {

• ret = -ENOMEM;
  

• goto err;
  

• }
• br_i32_encode((void *)(*prop)->rr, rlen, rr);
• return 0;

+err:

• free(n);
• free(rr);
• free(rrtmp);
• rsa_free_key_prop(*prop);
• return ret;

+}

On Wed, Jan 08, 2020 at 07:07:01PM +0100, Heinrich Schuchardt wrote:

On 11/21/19 1:11 AM, AKASHI Takahiro wrote:

...

In the current implementation of FIT_SIGNATURE, five parameters for a RSA public key are required while only two of them are essential. (See rsa-mod-exp.h and uImage.FIT/signature.txt) This is a result of considering relatively limited computer power and resources on embedded systems, while such a assumption may not be quite practical for other use cases.

In this patch, added is a function, rsa_gen_key_prop(), which will generate additional parameters for other uses, in particular UEFI secure boot, on the fly.

Note: the current code uses some "big number" rouKtines from BearSSL for the calculation.

Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org

include/u-boot/rsa-mod-exp.h | 23 ++ lib/rsa/Kconfig | 1 + lib/rsa/Makefile | 1 + lib/rsa/rsa-keyprop.c | 725 +++++++++++++++++++++++++++++++++++ 4 files changed, 750 insertions(+) create mode 100644 lib/rsa/rsa-keyprop.c

diff --git a/include/u-boot/rsa-mod-exp.h b/include/u-boot/rsa-mod-exp.h index 8a428c4b6a1a..1da8af1bb83d 100644 --- a/include/u-boot/rsa-mod-exp.h +++ b/include/u-boot/rsa-mod-exp.h @@ -26,6 +26,29 @@ struct key_prop { uint32_t exp_len; /* Exponent length in number of uint8_t */ };

+/**

• • rsa_gen_key_prop() - Generate key properties of RSA public key
• • @key: Specifies key data in DER format
• • @keylen: Length of @key
• • @prop: Generated key property
• • This function takes a blob of encoded RSA public key data in DER
• • format, parse it and generate all the relevant properties
• • in key_prop structure.
• • Return a pointer to struct key_prop in @prop on success.
• • Return: 0 on success, negative on error
• */

+int rsa_gen_key_prop(const void *key, uint32_t keylen, struct key_prop **proc);

+/**

• • rsa_free_key_prop() - Free key properties
• • @prop: Pointer to struct key_prop
• • This function frees all the memories allocated by rsa_gen_key_prop().
• */

+void rsa_free_key_prop(struct key_prop *prop);

/**

• rsa_mod_exp_sw() - Perform RSA Modular Exponentiation in sw

diff --git a/lib/rsa/Kconfig b/lib/rsa/Kconfig index 71e4c06bf883..d1d6f6cf64a3 100644 --- a/lib/rsa/Kconfig +++ b/lib/rsa/Kconfig @@ -33,6 +33,7 @@ config RSA_VERIFY config RSA_VERIFY_WITH_PKEY bool "Execute RSA verification without key parameters from FDT" depends on RSA

• imply RSA_PUBLIC_KEY_PARSER

Do we really need RSA_PUBLIC_KEY_PARSER whenever we use CONFIG_RSA=y?

??? RSA_PUBLIC_KEY_PARSER will be selected only if RSA_VERIFY_WITH_PKEY is enabled. I avoided to use 'select' here because RSA_PUBLIC_KEY_PARSER is also 'selectable.'

E.g. on a system without the UEFI sub-system?

Otherwise simply let RSA_PUBLIC_KEY_PARSER depend on RSA.

Such a dependency sounds odd to me.

...

help The standard RSA-signature verification code (FIT_SIGNATURE) uses pre-calculated key properties, that are stored in fdt blob, in diff --git a/lib/rsa/Makefile b/lib/rsa/Makefile index c07305188e0c..14ed3cb4012b 100644 --- a/lib/rsa/Makefile +++ b/lib/rsa/Makefile @@ -6,4 +6,5 @@ # Wolfgang Denk, DENX Software Engineering, wd@denx.de.

obj-$(CONFIG_$(SPL_)RSA_VERIFY) += rsa-verify.o rsa-checksum.o +obj-$(CONFIG_RSA_VERIFY_WITH_PKEY) += rsa-keyprop.o obj-$(CONFIG_RSA_SOFTWARE_EXP) += rsa-mod-exp.o diff --git a/lib/rsa/rsa-keyprop.c b/lib/rsa/rsa-keyprop.c new file mode 100644 index 000000000000..9464df009343 --- /dev/null +++ b/lib/rsa/rsa-keyprop.c @@ -0,0 +1,725 @@ +// SPDX-License-Identifier: GPL-2.0+ and MIT +/*

• • RSA library - generate parameters for a public key
• • Copyright (c) 2019 Linaro Limited
• • Author: AKASHI Takahiro
• • Big number routines in this file come from BearSSL:
• • Copyright (c) 2016 Thomas Pornin pornin@bolet.org
• */

+#include <common.h> +#include <image.h> +#include <malloc.h> +#include <asm/byteorder.h> +#include <crypto/internal/rsa.h> +#include <u-boot/rsa-mod-exp.h>

+/**

• • br_dec16be() - Convert 16-bit big-endian integer to native
• • @src: Pointer to data
• • Return: Native-endian integer
• */

+static unsigned br_dec16be(const void *src) +{

• return be16_to_cpup(src);

+}

+/**

• • br_dec32be() - Convert 32-bit big-endian integer to native
• • @src: Pointer to data
• • Return: Native-endian integer
• */

+static uint32_t br_dec32be(const void *src) +{

• return be32_to_cpup(src);

+}

+/**

• • br_enc32be() - Convert native 32-bit integer to big-endian
• • @dst: Pointer to buffer to store big-endian integer in
• • @x: Native 32-bit integer
• */

+static void br_enc32be(void *dst, uint32_t x) +{

• __be32 tmp;
• tmp = cpu_to_be32(x);
• memcpy(dst, &tmp, sizeof(tmp));

+}

+/* from BearSSL's src/inner.h */

+/*

• • Negate a boolean.
• */

+static uint32_t NOT(uint32_t ctl) +{

• return ctl ^ 1;

+}

+/*

• • Multiplexer: returns x if ctl == 1, y if ctl == 0.
• */

+static uint32_t MUX(uint32_t ctl, uint32_t x, uint32_t y) +{

• return y ^ (-ctl & (x ^ y));

+}

+/*

• • Equality check: returns 1 if x == y, 0 otherwise.
• */

+static uint32_t EQ(uint32_t x, uint32_t y) +{

• uint32_t q;
• q = x ^ y;
• return NOT((q | -q) >> 31);

+}

+/*

• • Inequality check: returns 1 if x != y, 0 otherwise.
• */

+static uint32_t NEQ(uint32_t x, uint32_t y) +{

• uint32_t q;
• q = x ^ y;
• return (q | -q) >> 31;

We want to minimize the code size of U-Boot.

I don't get your point. Please elaborate your concern.

So, please, review this code and remove all of this bogus.

Which part of the code do you mention as 'bogus'?

Thanks, -Takahiro Akashi

Best regards

Heinrich

...

+}

+/*

• • Comparison: returns 1 if x > y, 0 otherwise.
• */

+static uint32_t GT(uint32_t x, uint32_t y) +{

• /*

• * If both x < 2^31 and y < 2^31, then y-x will have its high
  

• * bit set if x > y, cleared otherwise.
  

• *
  

• * If either x >= 2^31 or y >= 2^31 (but not both), then the
  

• * result is the high bit of x.
  

• *
  

• * If both x >= 2^31 and y >= 2^31, then we can virtually
  

• * subtract 2^31 from both, and we are back to the first case.
  

• * Since (y-2^31)-(x-2^31) = y-x, the subtraction is already
  

• * fine.
  

• */
  

• uint32_t z;
• z = y - x;
• return (z ^ ((x ^ y) & (x ^ z))) >> 31;

+}

+/*

• • Compute the bit length of a 32-bit integer. Returned value is between 0
• • and 32 (inclusive).
• */

+static uint32_t BIT_LENGTH(uint32_t x) +{

• uint32_t k, c;
• k = NEQ(x, 0);
• c = GT(x, 0xFFFF); x = MUX(c, x >> 16, x); k += c << 4;
• c = GT(x, 0x00FF); x = MUX(c, x >> 8, x); k += c << 3;
• c = GT(x, 0x000F); x = MUX(c, x >> 4, x); k += c << 2;
• c = GT(x, 0x0003); x = MUX(c, x >> 2, x); k += c << 1;
• k += GT(x, 0x0001);
• return k;

+}

+#define GE(x, y) NOT(GT(y, x)) +#define LT(x, y) GT(y, x) +#define MUL(x, y) ((uint64_t)(x) * (uint64_t)(y))

+/*

• • Integers 'i32'

• • ---

• • The 'i32' functions implement computations on big integers using
• • an internal representation as an array of 32-bit integers. For
• • an array x[]:
• • -- x[0] contains the "announced bit length" of the integer
• • -- x[1], x[2]... contain the value in little-endian order (x[1]

• • contains the least significant 32 bits)
    

• • Multiplications rely on the elementary 32x32->64 multiplication.
• • The announced bit length specifies the number of bits that are
• • significant in the subsequent 32-bit words. Unused bits in the
• • last (most significant) word are set to 0; subsequent words are
• • uninitialized and need not exist at all.
• • The execution time and memory access patterns of all computations
• • depend on the announced bit length, but not on the actual word
• • values. For modular integers, the announced bit length of any integer
• • modulo n is equal to the actual bit length of n; thus, computations
• • on modular integers are "constant-time" (only the modulus length may
• • leak).
• */

+/*

• • Extract one word from an integer. The offset is counted in bits.
• • The word MUST entirely fit within the word elements corresponding
• • to the announced bit length of a[].
• */

+static uint32_t br_i32_word(const uint32_t *a, uint32_t off) +{

• size_t u;
• unsigned j;
• u = (size_t)(off >> 5) + 1;
• j = (unsigned)off & 31;
• if (j == 0) {

• return a[u];
  

• } else {

• return (a[u] >> j) | (a[u + 1] << (32 - j));
  

• }

+}

+/* from BearSSL's src/int/i32_bitlen.c */

+/*

• • Compute the actual bit length of an integer. The argument x should
• • point to the first (least significant) value word of the integer.
• • The len 'xlen' contains the number of 32-bit words to access.
• • CT: value or length of x does not leak.
• */

+static uint32_t br_i32_bit_length(uint32_t *x, size_t xlen) +{

• uint32_t tw, twk;
• tw = 0;
• twk = 0;
• while (xlen -- > 0) {

• uint32_t w, c;
  

• c = EQ(tw, 0);
  

• w = x[xlen];
  

• tw = MUX(c, w, tw);
  

• twk = MUX(c, (uint32_t)xlen, twk);
  

• }
• return (twk << 5) + BIT_LENGTH(tw);

+}

+/* from BearSSL's src/int/i32_decode.c */

+/*

• • Decode an integer from its big-endian unsigned representation. The
• • "true" bit length of the integer is computed, but all words of x[]
• • corresponding to the full 'len' bytes of the source are set.
• • CT: value or length of x does not leak.
• */

+static void br_i32_decode(uint32_t *x, const void *src, size_t len) +{

• const unsigned char *buf;
• size_t u, v;
• buf = src;
• u = len;
• v = 1;
• for (;;) {

• if (u < 4) {
  

• 	uint32_t w;
  

• 	if (u < 2) {
  

• 		if (u == 0) {
  

• 			break;
  

• 		} else {
  

• 			w = buf[0];
  

• 		}
  

• 	} else {
  

• 		if (u == 2) {
  

• 			w = br_dec16be(buf);
  

• 		} else {
  

• 			w = ((uint32_t)buf[0] << 16)
  

• 				| br_dec16be(buf + 1);
  

• 		}
  

• 	}
  

• 	x[v ++] = w;
  

• 	break;
  

• } else {
  

• 	u -= 4;
  

• 	x[v ++] = br_dec32be(buf + u);
  

• }
  

• }
• x[0] = br_i32_bit_length(x + 1, v - 1);

+}

+/* from BearSSL's src/int/i32_encode.c */

+/*

• • Encode an integer into its big-endian unsigned representation. The
• • output length in bytes is provided (parameter 'len'); if the length
• • is too short then the integer is appropriately truncated; if it is
• • too long then the extra bytes are set to 0.
• */

+static void br_i32_encode(void *dst, size_t len, const uint32_t *x) +{

• unsigned char *buf;
• size_t k;
• buf = dst;
• /*

• * Compute the announced size of x in bytes; extra bytes are
  

• * filled with zeros.
  

• */
  

• k = (x[0] + 7) >> 3;
• while (len > k) {

• *buf ++ = 0;
  

• len --;
  

• }
• /*

• * Now we use k as index within x[]. That index starts at 1;
  

• * we initialize it to the topmost complete word, and process
  

• * any remaining incomplete word.
  

• */
  

• k = (len + 3) >> 2;
• switch (len & 3) {
• case 3:

• *buf ++ = x[k] >> 16;
  

• /* fall through */
  

• case 2:

• *buf ++ = x[k] >> 8;
  

• /* fall through */
  

• case 1:

• *buf ++ = x[k];
  

• k --;
  

• }
• /*

• * Encode all complete words.
  

• */
  

• while (k > 0) {

• br_enc32be(buf, x[k]);
  

• k --;
  

• buf += 4;
  

• }

+}

+/* from BearSSL's src/int/i32_ninv32.c */

+/*

• • Compute -(1/x) mod 2^32. If x is even, then this function returns 0.
• */

+static uint32_t br_i32_ninv32(uint32_t x) +{

• uint32_t y;
• y = 2 - x;
• y *= 2 - y * x;
• y *= 2 - y * x;
• y *= 2 - y * x;
• y *= 2 - y * x;
• return MUX(x & 1, -y, 0);

+}

+/* from BearSSL's src/int/i32_add.c */

+/*

• • Add b[] to a[] and return the carry (0 or 1). If ctl is 0, then a[]
• • is unmodified, but the carry is still computed and returned. The
• • arrays a[] and b[] MUST have the same announced bit length.
• • a[] and b[] MAY be the same array, but partial overlap is not allowed.
• */

+static uint32_t br_i32_add(uint32_t *a, const uint32_t *b, uint32_t ctl) +{

• uint32_t cc;
• size_t u, m;
• cc = 0;
• m = (a[0] + 63) >> 5;
• for (u = 1; u < m; u ++) {

• uint32_t aw, bw, naw;
  

• aw = a[u];
  

• bw = b[u];
  

• naw = aw + bw + cc;
  

• /*
  

•  * Carry is 1 if naw < aw. Carry is also 1 if naw == aw
  

•  * AND the carry was already 1.
  

•  */
  

• cc = (cc & EQ(naw, aw)) | LT(naw, aw);
  

• a[u] = MUX(ctl, naw, aw);
  

• }
• return cc;

+}

+/* from BearSSL's src/int/i32_sub.c */

+/*

• • Subtract b[] from a[] and return the carry (0 or 1). If ctl is 0,
• • then a[] is unmodified, but the carry is still computed and returned.
• • The arrays a[] and b[] MUST have the same announced bit length.
• • a[] and b[] MAY be the same array, but partial overlap is not allowed.
• */

+static uint32_t br_i32_sub(uint32_t *a, const uint32_t *b, uint32_t ctl) +{

• uint32_t cc;
• size_t u, m;
• cc = 0;
• m = (a[0] + 63) >> 5;
• for (u = 1; u < m; u ++) {

• uint32_t aw, bw, naw;
  

• aw = a[u];
  

• bw = b[u];
  

• naw = aw - bw - cc;
  

• /*
  

•  * Carry is 1 if naw > aw. Carry is 1 also if naw == aw
  

•  * AND the carry was already 1.
  

•  */
  

• cc = (cc & EQ(naw, aw)) | GT(naw, aw);
  

• a[u] = MUX(ctl, naw, aw);
  

• }
• return cc;

+}

+/* from BearSSL's src/int/i32_div32.c */

+/*

• • Constant-time division. The dividend hi:lo is divided by the
• • divisor d; the quotient is returned and the remainder is written
• • in *r. If hi == d, then the quotient does not fit on 32 bits;
• • returned value is thus truncated. If hi > d, returned values are
• • indeterminate.
• */

+static uint32_t br_divrem(uint32_t hi, uint32_t lo, uint32_t d, uint32_t *r) +{

• /* TODO: optimize this */
• uint32_t q;
• uint32_t ch, cf;
• int k;
• q = 0;
• ch = EQ(hi, d);
• hi = MUX(ch, 0, hi);
• for (k = 31; k > 0; k --) {

• int j;
  

• uint32_t w, ctl, hi2, lo2;
  

• j = 32 - k;
  

• w = (hi << j) | (lo >> k);
  

• ctl = GE(w, d) | (hi >> k);
  

• hi2 = (w - d) >> j;
  

• lo2 = lo - (d << k);
  

• hi = MUX(ctl, hi2, hi);
  

• lo = MUX(ctl, lo2, lo);
  

• q |= ctl << k;
  

• }
• cf = GE(lo, d) | hi;
• q |= cf;
• *r = MUX(cf, lo - d, lo);
• return q;

+}

+/*

• • Wrapper for br_divrem(); the remainder is returned, and the quotient
• • is discarded.
• */

+static uint32_t br_rem(uint32_t hi, uint32_t lo, uint32_t d) +{

• uint32_t r;
• br_divrem(hi, lo, d, &r);
• return r;

+}

+/*

• • Wrapper for br_divrem(); the quotient is returned, and the remainder
• • is discarded.
• */

+static uint32_t br_div(uint32_t hi, uint32_t lo, uint32_t d) +{

• uint32_t r;
• return br_divrem(hi, lo, d, &r);

+}

+/* from BearSSL's src/int/i32_muladd.c */

+/*

• • Multiply x[] by 2^32 and then add integer z, modulo m[]. This
• • function assumes that x[] and m[] have the same announced bit
• • length, and the announced bit length of m[] matches its true
• • bit length.
• • x[] and m[] MUST be distinct arrays.
• • CT: only the common announced bit length of x and m leaks, not
• • the values of x, z or m.
• */

+static void br_i32_muladd_small(uint32_t *x, uint32_t z, const uint32_t *m) +{

• uint32_t m_bitlen;
• size_t u, mlen;
• uint32_t a0, a1, b0, hi, g, q, tb;
• uint32_t chf, clow, under, over;
• uint64_t cc;
• /*

• * We can test on the modulus bit length since we accept to
  

• * leak that length.
  

• */
  

• m_bitlen = m[0];
• if (m_bitlen == 0) {

• return;
  

• }
• if (m_bitlen <= 32) {

• x[1] = br_rem(x[1], z, m[1]);
  

• return;
  

• }
• mlen = (m_bitlen + 31) >> 5;
• /*

• * Principle: we estimate the quotient (x*2^32+z)/m by
  

• * doing a 64/32 division with the high words.
  

• *
  

• * Let:
  

• *   w = 2^32
  

• *   a = (w*a0 + a1) * w^N + a2
  

• *   b = b0 * w^N + b2
  

• * such that:
  

• *   0 <= a0 < w
  

• *   0 <= a1 < w
  

• *   0 <= a2 < w^N
  

• *   w/2 <= b0 < w
  

• *   0 <= b2 < w^N
  

• *   a < w*b
  

• * I.e. the two top words of a are a0:a1, the top word of b is
  

• * b0, we ensured that b0 is "full" (high bit set), and a is
  

• * such that the quotient q = a/b fits on one word (0 <= q < w).
  

• *
  

• * If a = b*q + r (with 0 <= r < q), we can estimate q by
  

• * doing an Euclidean division on the top words:
  

• *   a0*w+a1 = b0*u + v  (with 0 <= v < w)
  

• * Then the following holds:
  

• *   0 <= u <= w
  

• *   u-2 <= q <= u
  

• */
  

• a0 = br_i32_word(x, m_bitlen - 32);
• hi = x[mlen];
• memmove(x + 2, x + 1, (mlen - 1) * sizeof *x);
• x[1] = z;
• a1 = br_i32_word(x, m_bitlen - 32);
• b0 = br_i32_word(m, m_bitlen - 32);
• /*

• * We estimate a divisor q. If the quotient returned by br_div()
  

• * is g:
  

• * -- If a0 == b0 then g == 0; we want q = 0xFFFFFFFF.
  

• * -- Otherwise:
  

• *    -- if g == 0 then we set q = 0;
  

• *    -- otherwise, we set q = g - 1.
  

• * The properties described above then ensure that the true
  

• * quotient is q-1, q or q+1.
  

• */
  

• g = br_div(a0, a1, b0);
• q = MUX(EQ(a0, b0), 0xFFFFFFFF, MUX(EQ(g, 0), 0, g - 1));
• /*

• * We subtract q*m from x (with the extra high word of value 'hi').
  

• * Since q may be off by 1 (in either direction), we may have to
  

• * add or subtract m afterwards.
  

• *
  

• * The 'tb' flag will be true (1) at the end of the loop if the
  

• * result is greater than or equal to the modulus (not counting
  

• * 'hi' or the carry).
  

• */
  

• cc = 0;
• tb = 1;
• for (u = 1; u <= mlen; u ++) {

• uint32_t mw, zw, xw, nxw;
  

• uint64_t zl;
  

• mw = m[u];
  

• zl = MUL(mw, q) + cc;
  

• cc = (uint32_t)(zl >> 32);
  

• zw = (uint32_t)zl;
  

• xw = x[u];
  

• nxw = xw - zw;
  

• cc += (uint64_t)GT(nxw, xw);
  

• x[u] = nxw;
  

• tb = MUX(EQ(nxw, mw), tb, GT(nxw, mw));
  

• }
• /*

• * If we underestimated q, then either cc < hi (one extra bit
  

• * beyond the top array word), or cc == hi and tb is true (no
  

• * extra bit, but the result is not lower than the modulus). In
  

• * these cases we must subtract m once.
  

• *
  

• * Otherwise, we may have overestimated, which will show as
  

• * cc > hi (thus a negative result). Correction is adding m once.
  

• */
  

• chf = (uint32_t)(cc >> 32);
• clow = (uint32_t)cc;
• over = chf | GT(clow, hi);
• under = ~over & (tb | (~chf & LT(clow, hi)));
• br_i32_add(x, m, over);
• br_i32_sub(x, m, under);

+}

+/* from BearSSL's src/int/i32_reduce.c */

+/*

• • Reduce an integer (a[]) modulo another (m[]). The result is written
• • in x[] and its announced bit length is set to be equal to that of m[].
• • x[] MUST be distinct from a[] and m[].
• • CT: only announced bit lengths leak, not values of x, a or m.
• */

+static void br_i32_reduce(uint32_t *x, const uint32_t *a, const uint32_t *m) +{

• uint32_t m_bitlen, a_bitlen;
• size_t mlen, alen, u;
• m_bitlen = m[0];
• mlen = (m_bitlen + 31) >> 5;
• x[0] = m_bitlen;
• if (m_bitlen == 0) {

• return;
  

• }
• /*

• * If the source is shorter, then simply copy all words from a[]
  

• * and zero out the upper words.
  

• */
  

• a_bitlen = a[0];
• alen = (a_bitlen + 31) >> 5;
• if (a_bitlen < m_bitlen) {

• memcpy(x + 1, a + 1, alen * sizeof *a);
  

• for (u = alen; u < mlen; u ++) {
  

• 	x[u + 1] = 0;
  

• }
  

• return;
  

• }
• /*

• * The source length is at least equal to that of the modulus.
  

• * We must thus copy N-1 words, and input the remaining words
  

• * one by one.
  

• */
  

• memcpy(x + 1, a + 2 + (alen - mlen), (mlen - 1) * sizeof *a);
• x[mlen] = 0;
• for (u = 1 + alen - mlen; u > 0; u --) {

• br_i32_muladd_small(x, a[u], m);
  

• }

+}

+/**

• • rsa_free_key_prop() - Free key properties
• • @prop: Pointer to struct key_prop
• • This function frees all the memories allocated by rsa_gen_key_prop().
• */

+void rsa_free_key_prop(struct key_prop *prop) +{

• if (!prop)

• return;
  

• free((void *)prop->modulus);
• free((void *)prop->public_exponent);
• free((void *)prop->rr);
• free(prop);

+}

+/**

• • rsa_gen_key_prop() - Generate key properties of RSA public key
• • @key: Specifies key data in DER format
• • @keylen: Length of @key
• • @prop: Generated key property
• • This function takes a blob of encoded RSA public key data in DER
• • format, parse it and generate all the relevant properties
• • in key_prop structure.
• • Return a pointer to struct key_prop in @prop on success.
• • Return: 0 on success, negative on error
• */

+int rsa_gen_key_prop(const void *key, uint32_t keylen, struct key_prop **prop) +{

• struct rsa_key rsa_key;
• uint32_t *n = NULL, *rr = NULL, *rrtmp = NULL;
• const int max_rsa_size = 4096;
• int rlen, i, ret;
• *prop = calloc(sizeof(**prop), 1);
• n = calloc(sizeof(uint32_t), 1 + (max_rsa_size >> 5));
• rr = calloc(sizeof(uint32_t), 1 + (max_rsa_size >> 5));
• rrtmp = calloc(sizeof(uint32_t), 1 + (max_rsa_size >> 5));
• if (!(*prop) || !n || !rr || !rrtmp) {

• ret = -ENOMEM;
  

• goto err;
  

• }
• ret = rsa_parse_pub_key(&rsa_key, key, keylen);
• if (ret)

• goto err;
  

• /* modulus */
• /* removing leading 0's */
• for (i = 0; i < rsa_key.n_sz && !rsa_key.n[i]; i++)

• ;
  

• (*prop)->num_bits = (rsa_key.n_sz - i) * 8;
• (*prop)->modulus = malloc(rsa_key.n_sz - i);
• if (!(*prop)->modulus) {

• ret = -ENOMEM;
  

• goto err;
  

• }
• memcpy((void *)(*prop)->modulus, &rsa_key.n[i], rsa_key.n_sz - i);
• /* exponent */
• (*prop)->public_exponent = calloc(1, sizeof(uint64_t));
• if (!(*prop)->public_exponent) {

• ret = -ENOMEM;
  

• goto err;
  

• }
• memcpy((void *)(*prop)->public_exponent + sizeof(uint64_t)

• 				- rsa_key.e_sz,
  

•       rsa_key.e, rsa_key.e_sz);
  

• (*prop)->exp_len = rsa_key.e_sz;
• /* n0 inverse */
• br_i32_decode(n, &rsa_key.n[i], rsa_key.n_sz - i);
• (*prop)->n0inv = br_i32_ninv32(n[1]);
• /* R^2 mod n; R = 2^(num_bits) */
• rlen = (*prop)->num_bits * 2; /* #bits of R^2 = (2^num_bits)^2 */
• rr[0] = 0;
• *(uint8_t *)&rr[0] = (1 << (rlen % 8));
• for (i = 1; i < (((rlen + 31) >> 5) + 1); i++)

• rr[i] = 0;
  

• br_i32_decode(rrtmp, rr, ((rlen + 7) >> 3) + 1);
• br_i32_reduce(rr, rrtmp, n);
• rlen = ((*prop)->num_bits + 7) >> 3; /* #bytes of R^2 mod n */
• (*prop)->rr = malloc(rlen);
• if (!(*prop)->rr) {

• ret = -ENOMEM;
  

• goto err;
  

• }
• br_i32_encode((void *)(*prop)->rr, rlen, rr);
• return 0;

+err:

• free(n);
• free(rr);
• free(rrtmp);
• rsa_free_key_prop(*prop);
• return ret;

+}

On 1/8/20 6:43 PM, Heinrich Schuchardt wrote:

On 11/21/19 1:11 AM, AKASHI Takahiro wrote:

...

In this patch, a very simple test is added to verify that rsa_verify() using rsa_verify_with_pkey() work correctly.

To keep the code simple, all the test data, either public key and verified binary data, are embedded in the source.

Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org

test/Kconfig      |  12 +++   test/lib/Makefile |   1 +   test/lib/rsa.c    | 206 ++++++++++++++++++++++++++++++++++++++++++++++   3 files changed, 219 insertions(+)   create mode 100644 test/lib/rsa.c

diff --git a/test/Kconfig b/test/Kconfig index cb7954041eda..64d76c3b20a5 100644 --- a/test/Kconfig +++ b/test/Kconfig @@ -28,6 +28,18 @@ config UT_LIB_ASN1         Enables a test which exercises asn1 compiler and decoder function         via various parsers.

+config UT_LIB_RSA +    bool "Unit test for rsa_verify() function" +    imply RSA +    imply ASYMMETRIC_KEY_TYPE +    imply ASYMMETRIC_PUBLIC_KEY_SUBTYPE +    imply RSA_PUBLIC_KEY_PARSER +    imply RSA_VERIFY_WITH_PKEY

This test should depend on RSA_VERIFY_WITH_PKEY because is cannot be executed otherwise.

When on qemu_arm64_defconfig I select all of the above mentioned configs I get a build error:

aarch64-linux-gnu-ld.bfd: common/built-in.o:(.data.checksum_algos+0x10): undefined reference to `sha1_der_prefix' aarch64-linux-gnu-ld.bfd: common/built-in.o:(.data.checksum_algos+0x30): undefined reference to `sha256_der_prefix'

Best regards

Heinrich

Best regards

Heinrich

...

+    default y +    help +      Enables rsa_verify() test, currently rsa_verify_with_pkey only() +      only, at the 'ut lib' command.

endif

config UT_TIME diff --git a/test/lib/Makefile b/test/lib/Makefile index 72d2ec74b5f4..2bf6ef3935bb 100644 --- a/test/lib/Makefile +++ b/test/lib/Makefile @@ -8,3 +8,4 @@ obj-y += lmb.o   obj-y += string.o   obj-$(CONFIG_ERRNO_STR) += test_errno_str.o   obj-$(CONFIG_UT_LIB_ASN1) += asn1.o +obj-$(CONFIG_UT_LIB_RSA) += rsa.o diff --git a/test/lib/rsa.c b/test/lib/rsa.c new file mode 100644 index 000000000000..44f8ade226f4 --- /dev/null +++ b/test/lib/rsa.c @@ -0,0 +1,206 @@ +// SPDX-License-Identifier: GPL-2.0+ +/*

• • Copyright (c) 2019 Linaro Limited
• • Author: AKASHI Takahiro
• • Unit test for rsa_verify() function
• */

+#include <common.h> +#include <command.h> +#include <image.h> +#include <test/lib.h> +#include <test/test.h> +#include <test/ut.h> +#include <u-boot/rsa.h>

+#ifdef CONFIG_RSA_VERIFY_WITH_PKEY

Please, remove this ifdef. Simply do not build this module if CONFIG_RSA_VERIFY_WITH_PKEY is not defined.

...

+/*

• • openssl genrsa 2048 -out private.pem
• • openssl rsa -in private.pem -pubout -outform der -out public.der
• • dd if=public.der of=public.raw bs=24 skip=1
• */

+static unsigned char public_key[] = { +    0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xca, 0x25, 0x23, +    0xe0, 0x0a, 0x4d, 0x8f, 0x56, 0xfc, 0xc9, 0x06, 0x4c, 0xcc, 0x94, 0x43, +    0xe0, 0x56, 0x44, 0x6e, 0x37, 0x54, 0x87, 0x12, 0x84, 0xf9, 0x07, 0x4f, +    0xe4, 0x23, 0x40, 0xc3, 0x43, 0x84, 0x37, 0x86, 0xd3, 0x9d, 0x95, 0x1c, +    0xe4, 0x8a, 0x66, 0x02, 0x09, 0xe2, 0x3d, 0xce, 0x2c, 0xc6, 0x02, 0x6a, +    0xd4, 0x65, 0x61, 0xff, 0x85, 0x6f, 0x88, 0x63, 0xba, 0x31, 0x62, 0x1e, +    0xb7, 0x95, 0xe9, 0x08, 0x3c, 0xe9, 0x35, 0xde, 0xfd, 0x65, 0x92, 0xb8, +    0x9e, 0x71, 0xa4, 0xcd, 0x47, 0xfd, 0x04, 0x26, 0xb9, 0x78, 0xbf, 0x05, +    0x0d, 0xfc, 0x00, 0x84, 0x08, 0xfc, 0xc4, 0x4b, 0xea, 0xf5, 0x97, 0x68, +    0x0d, 0x97, 0xd7, 0xff, 0x4f, 0x92, 0x82, 0xd7, 0xbb, 0xef, 0xb7, 0x67, +    0x8e, 0x72, 0x54, 0xe8, 0xc5, 0x9e, 0xfd, 0xd8, 0x38, 0xe9, 0xbe, 0x19, +    0x37, 0x5b, 0x36, 0x8b, 0xbf, 0x49, 0xa1, 0x59, 0x3a, 0x9d, 0xad, 0x92, +    0x08, 0x0b, 0xe3, 0xa4, 0xa4, 0x7d, 0xd3, 0x70, 0xc0, 0xb8, 0xfb, 0xc7, +    0xda, 0xd3, 0x19, 0x86, 0x37, 0x9a, 0xcd, 0xab, 0x30, 0x96, 0xab, 0xa4, +    0xa2, 0x31, 0xa0, 0x38, 0xfb, 0xbf, 0x85, 0xd3, 0x24, 0x39, 0xed, 0xbf, +    0xe1, 0x31, 0xed, 0x6c, 0x39, 0xc1, 0xe5, 0x05, 0x2e, 0x12, 0x30, 0x36, +    0x73, 0x5d, 0x62, 0xf3, 0x82, 0xaf, 0x38, 0xc8, 0xca, 0xfa, 0xa1, 0x99, +    0x57, 0x3c, 0xe1, 0xc1, 0x7b, 0x05, 0x0b, 0xcc, 0x2e, 0xa9, 0x10, 0xc8, +    0x68, 0xbd, 0x27, 0xb6, 0x19, 0x9c, 0xd2, 0xad, 0xb3, 0x1f, 0xca, 0x35, +    0x6e, 0x84, 0x23, 0xa1, 0xe9, 0xa4, 0x4c, 0xab, 0x19, 0x09, 0x79, 0x6e, +    0x3c, 0x7b, 0x74, 0xfc, 0x33, 0x05, 0xcf, 0xa4, 0x2e, 0xeb, 0x55, 0x60, +    0x05, 0xc7, 0xcf, 0x3f, 0x92, 0xac, 0x2d, 0x69, 0x0b, 0x19, 0x16, 0x79, +    0x75, 0x02, 0x03, 0x01, 0x00, 0x01 +};

+static unsigned int public_key_len = 270;

+/*

• • dd if=/dev/urandom of=data.raw bs=512 count=1
• */

+static unsigned char data_raw[] = { +    0x3e, 0x48, 0x6e, 0xef, 0x83, 0xd1, 0x4c, 0xfd, 0x92, 0x47, 0x92, 0xd7, +    0xf6, 0x16, 0x25, 0x0a, 0xdf, 0xe2, 0xb6, 0x6c, 0xe7, 0xe0, 0x55, 0xb2, +    0x70, 0x66, 0xf0, 0xe5, 0xdc, 0xaf, 0xd3, 0x2e, 0xc1, 0x3e, 0x5c, 0x4b, +    0xb5, 0xa7, 0x23, 0x1f, 0x2c, 0xce, 0xf8, 0x83, 0x00, 0x6d, 0xeb, 0xdd, +    0x19, 0x71, 0x13, 0xb4, 0xae, 0x5c, 0xa8, 0xae, 0x52, 0xc8, 0xe1, 0x77, +    0x9e, 0x98, 0x75, 0xbc, 0xef, 0x36, 0x9f, 0x0c, 0x14, 0xed, 0x1a, 0x0a, +    0x4f, 0x6c, 0xa4, 0xb1, 0xbb, 0x0e, 0x43, 0x93, 0x12, 0xfc, 0x2e, 0x82, +    0x93, 0x4e, 0xcb, 0xa2, 0xcd, 0x59, 0x3f, 0xc5, 0x11, 0x38, 0x3a, 0x88, +    0xc3, 0xcf, 0xf9, 0x61, 0xa8, 0x9e, 0x96, 0xb6, 0xbf, 0xa6, 0x5b, 0x0d, +    0xd9, 0xbd, 0x05, 0x4c, 0xbe, 0xed, 0x86, 0xca, 0x10, 0x63, 0x72, 0x75, +    0x4b, 0xbd, 0x86, 0x42, 0x30, 0x9d, 0x54, 0x4e, 0x12, 0xda, 0xf4, 0xb4, +    0xfd, 0xd9, 0x54, 0x95, 0x8f, 0x83, 0xc2, 0x63, 0x44, 0xdd, 0x96, 0x1a, +    0xd0, 0x7c, 0xcf, 0xcb, 0x16, 0xd6, 0xff, 0xa3, 0xbb, 0xeb, 0x24, 0x06, +    0xbf, 0x81, 0xd0, 0x29, 0x76, 0x19, 0x66, 0x84, 0xfc, 0x49, 0xde, 0x7b, +    0x5d, 0xd2, 0x27, 0x58, 0x21, 0x7b, 0xff, 0x4d, 0x64, 0xf3, 0x89, 0xe3, +    0xea, 0xb6, 0x54, 0x4e, 0xb1, 0x62, 0x52, 0x89, 0xe3, 0x22, 0xf2, 0x26, +    0x3e, 0x4f, 0x43, 0x58, 0x78, 0x91, 0x55, 0xbc, 0x1e, 0xd6, 0x97, 0xfc, +    0x0b, 0x85, 0x4c, 0x92, 0x9c, 0xbf, 0xc4, 0xb1, 0x62, 0x93, 0x27, 0xa9, +    0xb2, 0xf4, 0xb4, 0x7a, 0xfb, 0x56, 0xe5, 0x8f, 0xe1, 0x94, 0x4d, 0xfd, +    0xe4, 0x72, 0x8d, 0xa9, 0x71, 0x65, 0xcb, 0x2e, 0x6d, 0x39, 0xd5, 0x95, +    0xe7, 0x3f, 0xab, 0xaa, 0x7a, 0x74, 0x84, 0x25, 0x4b, 0x42, 0x1e, 0xd3, +    0x86, 0xca, 0x47, 0x4a, 0xf0, 0x24, 0x81, 0x24, 0xb0, 0xe1, 0xbb, 0x6c, +    0x3f, 0x2a, 0xa0, 0xb8, 0xeb, 0xd6, 0x01, 0xce, 0x63, 0x51, 0xe1, 0x81, +    0xd2, 0x32, 0x43, 0x56, 0x44, 0x4a, 0x6b, 0x51, 0x24, 0xa2, 0xc7, 0x39, +    0x7c, 0x54, 0xda, 0xf8, 0xd4, 0x93, 0x7c, 0x8e, 0x4e, 0x9d, 0x15, 0x08, +    0xce, 0x27, 0xd8, 0x28, 0xb0, 0x5b, 0x75, 0x32, 0x43, 0xe8, 0xd6, 0xbf, +    0x12, 0xd5, 0xc5, 0x12, 0x8e, 0xeb, 0x77, 0x8f, 0x00, 0xde, 0x45, 0x1e, +    0xdd, 0xf3, 0xef, 0x43, 0x99, 0x79, 0x86, 0xea, 0x01, 0xce, 0xf2, 0x4d, +    0xa0, 0xfe, 0x5a, 0x55, 0xc0, 0x1f, 0xce, 0xe8, 0xbe, 0xc2, 0x66, 0xdb, +    0xcb, 0x3f, 0xa5, 0x48, 0xa1, 0xe2, 0x49, 0xa1, 0x29, 0x65, 0x5b, 0x62, +    0x39, 0xcc, 0xef, 0xbe, 0x86, 0xb7, 0xe3, 0x44, 0x67, 0x04, 0x04, 0xb1, +    0xec, 0xd8, 0xb2, 0xb2, 0x38, 0xbc, 0x10, 0xea, 0x7a, 0x0e, 0xa4, 0xa4, +    0xcb, 0x21, 0xd9, 0xc7, 0xb4, 0x0b, 0xb8, 0x39, 0xb4, 0x07, 0x53, 0x3f, +    0xb9, 0x55, 0x55, 0xa1, 0x6f, 0x11, 0x49, 0xc0, 0x94, 0x77, 0xaf, 0x76, +    0x97, 0x7f, 0x31, 0x08, 0xdd, 0x72, 0x48, 0x72, 0xf8, 0x11, 0x4f, 0x69, +    0x10, 0xef, 0x23, 0x06, 0xf3, 0x34, 0xac, 0xee, 0x97, 0x89, 0x41, 0x1c, +    0x36, 0x38, 0xb1, 0x80, 0x96, 0x7a, 0x9e, 0x72, 0xab, 0x25, 0xeb, 0xce, +    0x7b, 0xb8, 0x5d, 0xc8, 0xef, 0xa4, 0x73, 0xa1, 0xa6, 0x8f, 0x01, 0x54, +    0xce, 0x58, 0x19, 0xe5, 0x7e, 0xfa, 0x77, 0x08, 0x9d, 0x53, 0xc1, 0xcc, +    0x08, 0xe8, 0x1d, 0xe0, 0x82, 0x5e, 0xe1, 0xe6, 0xbd, 0xbb, 0x59, 0x7e, +    0x12, 0x9c, 0x39, 0x60, 0x23, 0xf7, 0xbe, 0x0a, 0x7c, 0x48, 0x12, 0xa0, +    0x84, 0x04, 0x3f, 0xa1, 0x6e, 0x92, 0xcd, 0xa0, 0xac, 0xee, 0x0b, 0xbc, +    0x18, 0x30, 0x28, 0xbd, 0xf5, 0xfa, 0x3a, 0x35 +};

+static unsigned int data_raw_len = 512;

+/*

• • openssl dgst -sha256 -sign private.key -out data.enc data.raw
• */

+unsigned char data_enc[] = { +    0xa7, 0x4a, 0x12, 0x8f, 0xee, 0x65, 0x4b, 0xcd, 0x88, 0xca, 0x4d, 0xed, +    0xe3, 0x04, 0xe7, 0x7c, 0x59, 0xbf, 0x2f, 0xad, 0x95, 0x73, 0x5b, 0x2c, +    0x4e, 0xb5, 0xda, 0x5e, 0x3a, 0x6d, 0xb4, 0xc5, 0x84, 0x0c, 0xd2, 0x4a, +    0x62, 0x0d, 0x5f, 0xba, 0x10, 0xee, 0xb1, 0x2a, 0xe1, 0xfe, 0x50, 0x18, +    0x97, 0xcc, 0xea, 0x26, 0x62, 0x33, 0x5a, 0x1d, 0x51, 0x38, 0x52, 0x89, +    0x4d, 0xa7, 0x18, 0xff, 0xa6, 0xc8, 0xd4, 0x7a, 0xc0, 0xa6, 0x22, 0xdf, +    0x41, 0x89, 0x93, 0x9b, 0xe7, 0x9e, 0xc1, 0xc8, 0x80, 0xda, 0x1a, 0x3f, +    0xa4, 0x7a, 0xd0, 0x07, 0xcb, 0x5c, 0xa4, 0x75, 0x12, 0x54, 0x78, 0x67, +    0xbf, 0xe6, 0xae, 0x1e, 0x56, 0x33, 0x9e, 0xe0, 0x6e, 0x33, 0xa7, 0x58, +    0xb0, 0x47, 0x49, 0xa8, 0x37, 0xdb, 0x82, 0x4b, 0xbd, 0x32, 0x9c, 0xdc, +    0xf4, 0x67, 0x17, 0x24, 0x55, 0xfd, 0x83, 0x1e, 0xc8, 0xb4, 0x5c, 0xf9, +    0x15, 0x6c, 0x5e, 0xaa, 0x72, 0x03, 0x9e, 0x7c, 0x17, 0xf5, 0x7c, 0x37, +    0x96, 0x00, 0xb0, 0xd8, 0xaa, 0x05, 0xfa, 0xaa, 0xa1, 0x78, 0x77, 0xd5, +    0x09, 0xdd, 0x05, 0xc7, 0xe2, 0x9f, 0x68, 0xc7, 0xf8, 0xfb, 0x0b, 0x6f, +    0x18, 0x1e, 0xcc, 0x93, 0xd3, 0x3f, 0xc9, 0x26, 0x29, 0x64, 0xe7, 0x15, +    0xdc, 0xb8, 0x19, 0x10, 0x24, 0x55, 0x55, 0x3b, 0x79, 0xa1, 0x65, 0x12, +    0xe0, 0x0b, 0x88, 0x44, 0x4c, 0xea, 0x85, 0x5a, 0x6b, 0x2d, 0x45, 0x6e, +    0xe7, 0x83, 0x6f, 0x3a, 0xaa, 0x1e, 0xf1, 0x9c, 0x8f, 0xdc, 0xb9, 0x37, +    0xa2, 0x15, 0x61, 0x93, 0x06, 0x23, 0xf5, 0xfe, 0xf0, 0xf8, 0x2b, 0xf7, +    0xc0, 0x68, 0x67, 0xf6, 0x4e, 0x08, 0x0d, 0x0d, 0x08, 0xbe, 0xfb, 0x2c, +    0x4c, 0xe7, 0xd7, 0x1a, 0xad, 0xd9, 0x98, 0xa1, 0x8d, 0x94, 0x1c, 0xd1, +    0x89, 0x06, 0xc9, 0x3a +};

+static unsigned int data_enc_len = 256;

+/**

• • lib_rsa_verify_valid() - unit test for rsa_verify()
• • Test rsa_verify() with valid hash
• • @uts:    unit test state
• • Return:    0 = success, 1 = failure
• */

+static int lib_rsa_verify_valid(struct unit_test_state *uts) +{ +    struct image_sign_info info; +    struct image_region reg; +    int ret;

+    memset(&info, '\0', sizeof(info)); +    info.name = "sha256,rsa2048"; +    info.padding = image_get_padding_algo("pkcs-1.5"); +    info.checksum = image_get_checksum_algo("sha256,rsa2048"); +    info.crypto = image_get_crypto_algo(info.name);

+    info.key = public_key; +    info.keylen = public_key_len;

+    reg.data = data_raw; +    reg.size = data_raw_len; +    ret = rsa_verify(&info, &reg, 1, data_enc, data_enc_len); +    ut_assertf(ret == 0, "verification unexpectedly failed (%d)\n", ret);

+    return CMD_RET_SUCCESS; +}

+LIB_TEST(lib_rsa_verify_valid, 0);

+/**

• • lib_rsa_verify_invalid() - unit test for rsa_verify()
• • Test rsa_verify() with invalid hash
• • @uts:    unit test state
• • Return:    0 = success, 1 = failure
• */

+static int lib_rsa_verify_invalid(struct unit_test_state *uts) +{ +    struct image_sign_info info; +    struct image_region reg; +    unsigned char ctmp; +    int ret;

+    memset(&info, '\0', sizeof(info)); +    info.name = "sha256,rsa2048"; +    info.padding = image_get_padding_algo("pkcs-1.5"); +    info.checksum = image_get_checksum_algo("sha256,rsa2048"); +    info.crypto = image_get_crypto_algo(info.name);

+    info.key = public_key; +    info.keylen = public_key_len;

+    /* randomly corrupt enc'ed data */ +    ctmp = data_enc[data_enc_len - 10]; +    data_enc[data_enc_len - 10] = 0x12;

+    reg.data = data_raw; +    reg.size = data_raw_len; +    ret = rsa_verify(&info, &reg, 1, data_enc, data_enc_len);

+    /* revert a change */ +    data_enc[data_enc_len - 10] = ctmp;

+    ut_assertf(ret != 0, "verification unexpectedly succeeded\n");

+    return CMD_RET_SUCCESS; +}

+LIB_TEST(lib_rsa_verify_invalid, 0); +#endif /* RSA_VERIFY_WITH_PKEY */

On 1/14/20 8:33 AM, AKASHI Takahiro wrote:

On Wed, Jan 08, 2020 at 06:43:51PM +0100, Heinrich Schuchardt wrote:

...

On 11/21/19 1:11 AM, AKASHI Takahiro wrote:

...

In this patch, a very simple test is added to verify that rsa_verify() using rsa_verify_with_pkey() work correctly.

To keep the code simple, all the test data, either public key and verified binary data, are embedded in the source.

Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org

test/Kconfig | 12 +++ test/lib/Makefile | 1 + test/lib/rsa.c | 206 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 219 insertions(+) create mode 100644 test/lib/rsa.c

diff --git a/test/Kconfig b/test/Kconfig index cb7954041eda..64d76c3b20a5 100644 --- a/test/Kconfig +++ b/test/Kconfig @@ -28,6 +28,18 @@ config UT_LIB_ASN1 Enables a test which exercises asn1 compiler and decoder function via various parsers.

+config UT_LIB_RSA

• bool "Unit test for rsa_verify() function"
• imply RSA
• imply ASYMMETRIC_KEY_TYPE
• imply ASYMMETRIC_PUBLIC_KEY_SUBTYPE
• imply RSA_PUBLIC_KEY_PARSER
• imply RSA_VERIFY_WITH_PKEY

This test should depend on RSA_VERIFY_WITH_PKEY because is cannot be executed otherwise.

See below.

...

Best regards

Heinrich

...

• default y

• help

•  Enables rsa_verify() test, currently rsa_verify_with_pkey only()
  

•  only, at the 'ut lib' command.
  

• endif

  config UT_TIME

diff --git a/test/lib/Makefile b/test/lib/Makefile index 72d2ec74b5f4..2bf6ef3935bb 100644 --- a/test/lib/Makefile +++ b/test/lib/Makefile @@ -8,3 +8,4 @@ obj-y += lmb.o obj-y += string.o obj-$(CONFIG_ERRNO_STR) += test_errno_str.o obj-$(CONFIG_UT_LIB_ASN1) += asn1.o +obj-$(CONFIG_UT_LIB_RSA) += rsa.o diff --git a/test/lib/rsa.c b/test/lib/rsa.c new file mode 100644 index 000000000000..44f8ade226f4 --- /dev/null +++ b/test/lib/rsa.c @@ -0,0 +1,206 @@ +// SPDX-License-Identifier: GPL-2.0+ +/*

• • Copyright (c) 2019 Linaro Limited
• • Author: AKASHI Takahiro
• • Unit test for rsa_verify() function
• */

+#include <common.h> +#include <command.h> +#include <image.h> +#include <test/lib.h> +#include <test/test.h> +#include <test/ut.h> +#include <u-boot/rsa.h>

+#ifdef CONFIG_RSA_VERIFY_WITH_PKEY

Please, remove this ifdef. Simply do not build this module if CONFIG_RSA_VERIFY_WITH_PKEY is not defined.

That is why I added this #ifdef here to avoid a build error. I think it is a good idea to make test code as generic as possible to easily add more test cases.

It is preferable to move configuration dependencies to the Makefile.

You can create a new C file if you have tests needing a different configuration.

test/lib/rsa_verify.c might be a better name for the file.

In test/Kconfig, please, replace

config UT_LIB_RSA         bool "Unit test for rsa_verify() function"         imply RSA

by

config UT_LIB_RSA bool "Unit test for rsa_verify() function" default y depends on RSA

We run all unit tests in Gitlab CI. This requires default=y.

'imply' gives you no guarantee that RSA is selected. See the build errors I reported for your other patches in the series.

Best regards

Heinrich

I believe that the original RSA helper functions (w/o WITH_PKEY) should also be exercised in a unit test. Otherwise, the code will only be exercised indirectly through FIT image verification and such a situation will contradict what Tom (or Heinrich?) demanded against my RSA patch.

-Takahiro Akashi

...

...

+/*

• • openssl genrsa 2048 -out private.pem
• • openssl rsa -in private.pem -pubout -outform der -out public.der
• • dd if=public.der of=public.raw bs=24 skip=1
• */

+static unsigned char public_key[] = {

• 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xca, 0x25, 0x23,
• 0xe0, 0x0a, 0x4d, 0x8f, 0x56, 0xfc, 0xc9, 0x06, 0x4c, 0xcc, 0x94, 0x43,
• 0xe0, 0x56, 0x44, 0x6e, 0x37, 0x54, 0x87, 0x12, 0x84, 0xf9, 0x07, 0x4f,
• 0xe4, 0x23, 0x40, 0xc3, 0x43, 0x84, 0x37, 0x86, 0xd3, 0x9d, 0x95, 0x1c,
• 0xe4, 0x8a, 0x66, 0x02, 0x09, 0xe2, 0x3d, 0xce, 0x2c, 0xc6, 0x02, 0x6a,
• 0xd4, 0x65, 0x61, 0xff, 0x85, 0x6f, 0x88, 0x63, 0xba, 0x31, 0x62, 0x1e,
• 0xb7, 0x95, 0xe9, 0x08, 0x3c, 0xe9, 0x35, 0xde, 0xfd, 0x65, 0x92, 0xb8,
• 0x9e, 0x71, 0xa4, 0xcd, 0x47, 0xfd, 0x04, 0x26, 0xb9, 0x78, 0xbf, 0x05,
• 0x0d, 0xfc, 0x00, 0x84, 0x08, 0xfc, 0xc4, 0x4b, 0xea, 0xf5, 0x97, 0x68,
• 0x0d, 0x97, 0xd7, 0xff, 0x4f, 0x92, 0x82, 0xd7, 0xbb, 0xef, 0xb7, 0x67,
• 0x8e, 0x72, 0x54, 0xe8, 0xc5, 0x9e, 0xfd, 0xd8, 0x38, 0xe9, 0xbe, 0x19,
• 0x37, 0x5b, 0x36, 0x8b, 0xbf, 0x49, 0xa1, 0x59, 0x3a, 0x9d, 0xad, 0x92,
• 0x08, 0x0b, 0xe3, 0xa4, 0xa4, 0x7d, 0xd3, 0x70, 0xc0, 0xb8, 0xfb, 0xc7,
• 0xda, 0xd3, 0x19, 0x86, 0x37, 0x9a, 0xcd, 0xab, 0x30, 0x96, 0xab, 0xa4,
• 0xa2, 0x31, 0xa0, 0x38, 0xfb, 0xbf, 0x85, 0xd3, 0x24, 0x39, 0xed, 0xbf,
• 0xe1, 0x31, 0xed, 0x6c, 0x39, 0xc1, 0xe5, 0x05, 0x2e, 0x12, 0x30, 0x36,
• 0x73, 0x5d, 0x62, 0xf3, 0x82, 0xaf, 0x38, 0xc8, 0xca, 0xfa, 0xa1, 0x99,
• 0x57, 0x3c, 0xe1, 0xc1, 0x7b, 0x05, 0x0b, 0xcc, 0x2e, 0xa9, 0x10, 0xc8,
• 0x68, 0xbd, 0x27, 0xb6, 0x19, 0x9c, 0xd2, 0xad, 0xb3, 0x1f, 0xca, 0x35,
• 0x6e, 0x84, 0x23, 0xa1, 0xe9, 0xa4, 0x4c, 0xab, 0x19, 0x09, 0x79, 0x6e,
• 0x3c, 0x7b, 0x74, 0xfc, 0x33, 0x05, 0xcf, 0xa4, 0x2e, 0xeb, 0x55, 0x60,
• 0x05, 0xc7, 0xcf, 0x3f, 0x92, 0xac, 0x2d, 0x69, 0x0b, 0x19, 0x16, 0x79,
• 0x75, 0x02, 0x03, 0x01, 0x00, 0x01

+};

+static unsigned int public_key_len = 270;

+/*

• • dd if=/dev/urandom of=data.raw bs=512 count=1
• */

+static unsigned char data_raw[] = {

• 0x3e, 0x48, 0x6e, 0xef, 0x83, 0xd1, 0x4c, 0xfd, 0x92, 0x47, 0x92, 0xd7,
• 0xf6, 0x16, 0x25, 0x0a, 0xdf, 0xe2, 0xb6, 0x6c, 0xe7, 0xe0, 0x55, 0xb2,
• 0x70, 0x66, 0xf0, 0xe5, 0xdc, 0xaf, 0xd3, 0x2e, 0xc1, 0x3e, 0x5c, 0x4b,
• 0xb5, 0xa7, 0x23, 0x1f, 0x2c, 0xce, 0xf8, 0x83, 0x00, 0x6d, 0xeb, 0xdd,
• 0x19, 0x71, 0x13, 0xb4, 0xae, 0x5c, 0xa8, 0xae, 0x52, 0xc8, 0xe1, 0x77,
• 0x9e, 0x98, 0x75, 0xbc, 0xef, 0x36, 0x9f, 0x0c, 0x14, 0xed, 0x1a, 0x0a,
• 0x4f, 0x6c, 0xa4, 0xb1, 0xbb, 0x0e, 0x43, 0x93, 0x12, 0xfc, 0x2e, 0x82,
• 0x93, 0x4e, 0xcb, 0xa2, 0xcd, 0x59, 0x3f, 0xc5, 0x11, 0x38, 0x3a, 0x88,
• 0xc3, 0xcf, 0xf9, 0x61, 0xa8, 0x9e, 0x96, 0xb6, 0xbf, 0xa6, 0x5b, 0x0d,
• 0xd9, 0xbd, 0x05, 0x4c, 0xbe, 0xed, 0x86, 0xca, 0x10, 0x63, 0x72, 0x75,
• 0x4b, 0xbd, 0x86, 0x42, 0x30, 0x9d, 0x54, 0x4e, 0x12, 0xda, 0xf4, 0xb4,
• 0xfd, 0xd9, 0x54, 0x95, 0x8f, 0x83, 0xc2, 0x63, 0x44, 0xdd, 0x96, 0x1a,
• 0xd0, 0x7c, 0xcf, 0xcb, 0x16, 0xd6, 0xff, 0xa3, 0xbb, 0xeb, 0x24, 0x06,
• 0xbf, 0x81, 0xd0, 0x29, 0x76, 0x19, 0x66, 0x84, 0xfc, 0x49, 0xde, 0x7b,
• 0x5d, 0xd2, 0x27, 0x58, 0x21, 0x7b, 0xff, 0x4d, 0x64, 0xf3, 0x89, 0xe3,
• 0xea, 0xb6, 0x54, 0x4e, 0xb1, 0x62, 0x52, 0x89, 0xe3, 0x22, 0xf2, 0x26,
• 0x3e, 0x4f, 0x43, 0x58, 0x78, 0x91, 0x55, 0xbc, 0x1e, 0xd6, 0x97, 0xfc,
• 0x0b, 0x85, 0x4c, 0x92, 0x9c, 0xbf, 0xc4, 0xb1, 0x62, 0x93, 0x27, 0xa9,
• 0xb2, 0xf4, 0xb4, 0x7a, 0xfb, 0x56, 0xe5, 0x8f, 0xe1, 0x94, 0x4d, 0xfd,
• 0xe4, 0x72, 0x8d, 0xa9, 0x71, 0x65, 0xcb, 0x2e, 0x6d, 0x39, 0xd5, 0x95,
• 0xe7, 0x3f, 0xab, 0xaa, 0x7a, 0x74, 0x84, 0x25, 0x4b, 0x42, 0x1e, 0xd3,
• 0x86, 0xca, 0x47, 0x4a, 0xf0, 0x24, 0x81, 0x24, 0xb0, 0xe1, 0xbb, 0x6c,
• 0x3f, 0x2a, 0xa0, 0xb8, 0xeb, 0xd6, 0x01, 0xce, 0x63, 0x51, 0xe1, 0x81,
• 0xd2, 0x32, 0x43, 0x56, 0x44, 0x4a, 0x6b, 0x51, 0x24, 0xa2, 0xc7, 0x39,
• 0x7c, 0x54, 0xda, 0xf8, 0xd4, 0x93, 0x7c, 0x8e, 0x4e, 0x9d, 0x15, 0x08,
• 0xce, 0x27, 0xd8, 0x28, 0xb0, 0x5b, 0x75, 0x32, 0x43, 0xe8, 0xd6, 0xbf,
• 0x12, 0xd5, 0xc5, 0x12, 0x8e, 0xeb, 0x77, 0x8f, 0x00, 0xde, 0x45, 0x1e,
• 0xdd, 0xf3, 0xef, 0x43, 0x99, 0x79, 0x86, 0xea, 0x01, 0xce, 0xf2, 0x4d,
• 0xa0, 0xfe, 0x5a, 0x55, 0xc0, 0x1f, 0xce, 0xe8, 0xbe, 0xc2, 0x66, 0xdb,
• 0xcb, 0x3f, 0xa5, 0x48, 0xa1, 0xe2, 0x49, 0xa1, 0x29, 0x65, 0x5b, 0x62,
• 0x39, 0xcc, 0xef, 0xbe, 0x86, 0xb7, 0xe3, 0x44, 0x67, 0x04, 0x04, 0xb1,
• 0xec, 0xd8, 0xb2, 0xb2, 0x38, 0xbc, 0x10, 0xea, 0x7a, 0x0e, 0xa4, 0xa4,
• 0xcb, 0x21, 0xd9, 0xc7, 0xb4, 0x0b, 0xb8, 0x39, 0xb4, 0x07, 0x53, 0x3f,
• 0xb9, 0x55, 0x55, 0xa1, 0x6f, 0x11, 0x49, 0xc0, 0x94, 0x77, 0xaf, 0x76,
• 0x97, 0x7f, 0x31, 0x08, 0xdd, 0x72, 0x48, 0x72, 0xf8, 0x11, 0x4f, 0x69,
• 0x10, 0xef, 0x23, 0x06, 0xf3, 0x34, 0xac, 0xee, 0x97, 0x89, 0x41, 0x1c,
• 0x36, 0x38, 0xb1, 0x80, 0x96, 0x7a, 0x9e, 0x72, 0xab, 0x25, 0xeb, 0xce,
• 0x7b, 0xb8, 0x5d, 0xc8, 0xef, 0xa4, 0x73, 0xa1, 0xa6, 0x8f, 0x01, 0x54,
• 0xce, 0x58, 0x19, 0xe5, 0x7e, 0xfa, 0x77, 0x08, 0x9d, 0x53, 0xc1, 0xcc,
• 0x08, 0xe8, 0x1d, 0xe0, 0x82, 0x5e, 0xe1, 0xe6, 0xbd, 0xbb, 0x59, 0x7e,
• 0x12, 0x9c, 0x39, 0x60, 0x23, 0xf7, 0xbe, 0x0a, 0x7c, 0x48, 0x12, 0xa0,
• 0x84, 0x04, 0x3f, 0xa1, 0x6e, 0x92, 0xcd, 0xa0, 0xac, 0xee, 0x0b, 0xbc,
• 0x18, 0x30, 0x28, 0xbd, 0xf5, 0xfa, 0x3a, 0x35

+};

+static unsigned int data_raw_len = 512;

+/*

• • openssl dgst -sha256 -sign private.key -out data.enc data.raw
• */

+unsigned char data_enc[] = {

• 0xa7, 0x4a, 0x12, 0x8f, 0xee, 0x65, 0x4b, 0xcd, 0x88, 0xca, 0x4d, 0xed,
• 0xe3, 0x04, 0xe7, 0x7c, 0x59, 0xbf, 0x2f, 0xad, 0x95, 0x73, 0x5b, 0x2c,
• 0x4e, 0xb5, 0xda, 0x5e, 0x3a, 0x6d, 0xb4, 0xc5, 0x84, 0x0c, 0xd2, 0x4a,
• 0x62, 0x0d, 0x5f, 0xba, 0x10, 0xee, 0xb1, 0x2a, 0xe1, 0xfe, 0x50, 0x18,
• 0x97, 0xcc, 0xea, 0x26, 0x62, 0x33, 0x5a, 0x1d, 0x51, 0x38, 0x52, 0x89,
• 0x4d, 0xa7, 0x18, 0xff, 0xa6, 0xc8, 0xd4, 0x7a, 0xc0, 0xa6, 0x22, 0xdf,
• 0x41, 0x89, 0x93, 0x9b, 0xe7, 0x9e, 0xc1, 0xc8, 0x80, 0xda, 0x1a, 0x3f,
• 0xa4, 0x7a, 0xd0, 0x07, 0xcb, 0x5c, 0xa4, 0x75, 0x12, 0x54, 0x78, 0x67,
• 0xbf, 0xe6, 0xae, 0x1e, 0x56, 0x33, 0x9e, 0xe0, 0x6e, 0x33, 0xa7, 0x58,
• 0xb0, 0x47, 0x49, 0xa8, 0x37, 0xdb, 0x82, 0x4b, 0xbd, 0x32, 0x9c, 0xdc,
• 0xf4, 0x67, 0x17, 0x24, 0x55, 0xfd, 0x83, 0x1e, 0xc8, 0xb4, 0x5c, 0xf9,
• 0x15, 0x6c, 0x5e, 0xaa, 0x72, 0x03, 0x9e, 0x7c, 0x17, 0xf5, 0x7c, 0x37,
• 0x96, 0x00, 0xb0, 0xd8, 0xaa, 0x05, 0xfa, 0xaa, 0xa1, 0x78, 0x77, 0xd5,
• 0x09, 0xdd, 0x05, 0xc7, 0xe2, 0x9f, 0x68, 0xc7, 0xf8, 0xfb, 0x0b, 0x6f,
• 0x18, 0x1e, 0xcc, 0x93, 0xd3, 0x3f, 0xc9, 0x26, 0x29, 0x64, 0xe7, 0x15,
• 0xdc, 0xb8, 0x19, 0x10, 0x24, 0x55, 0x55, 0x3b, 0x79, 0xa1, 0x65, 0x12,
• 0xe0, 0x0b, 0x88, 0x44, 0x4c, 0xea, 0x85, 0x5a, 0x6b, 0x2d, 0x45, 0x6e,
• 0xe7, 0x83, 0x6f, 0x3a, 0xaa, 0x1e, 0xf1, 0x9c, 0x8f, 0xdc, 0xb9, 0x37,
• 0xa2, 0x15, 0x61, 0x93, 0x06, 0x23, 0xf5, 0xfe, 0xf0, 0xf8, 0x2b, 0xf7,
• 0xc0, 0x68, 0x67, 0xf6, 0x4e, 0x08, 0x0d, 0x0d, 0x08, 0xbe, 0xfb, 0x2c,
• 0x4c, 0xe7, 0xd7, 0x1a, 0xad, 0xd9, 0x98, 0xa1, 0x8d, 0x94, 0x1c, 0xd1,
• 0x89, 0x06, 0xc9, 0x3a

+};

+static unsigned int data_enc_len = 256;

+/**

• • lib_rsa_verify_valid() - unit test for rsa_verify()
• • Test rsa_verify() with valid hash
• • @uts: unit test state
• • Return: 0 = success, 1 = failure
• */

+static int lib_rsa_verify_valid(struct unit_test_state *uts) +{

• struct image_sign_info info;
• struct image_region reg;
• int ret;
• memset(&info, '\0', sizeof(info));
• info.name = "sha256,rsa2048";
• info.padding = image_get_padding_algo("pkcs-1.5");
• info.checksum = image_get_checksum_algo("sha256,rsa2048");
• info.crypto = image_get_crypto_algo(info.name);
• info.key = public_key;
• info.keylen = public_key_len;
• reg.data = data_raw;
• reg.size = data_raw_len;
• ret = rsa_verify(&info, &reg, 1, data_enc, data_enc_len);
• ut_assertf(ret == 0, "verification unexpectedly failed (%d)\n", ret);
• return CMD_RET_SUCCESS;

+}

+LIB_TEST(lib_rsa_verify_valid, 0);

+/**

• • lib_rsa_verify_invalid() - unit test for rsa_verify()
• • Test rsa_verify() with invalid hash
• • @uts: unit test state
• • Return: 0 = success, 1 = failure
• */

+static int lib_rsa_verify_invalid(struct unit_test_state *uts) +{

• struct image_sign_info info;
• struct image_region reg;
• unsigned char ctmp;
• int ret;
• memset(&info, '\0', sizeof(info));
• info.name = "sha256,rsa2048";
• info.padding = image_get_padding_algo("pkcs-1.5");
• info.checksum = image_get_checksum_algo("sha256,rsa2048");
• info.crypto = image_get_crypto_algo(info.name);
• info.key = public_key;
• info.keylen = public_key_len;
• /* randomly corrupt enc'ed data */
• ctmp = data_enc[data_enc_len - 10];
• data_enc[data_enc_len - 10] = 0x12;
• reg.data = data_raw;
• reg.size = data_raw_len;
• ret = rsa_verify(&info, &reg, 1, data_enc, data_enc_len);
• /* revert a change */
• data_enc[data_enc_len - 10] = ctmp;
• ut_assertf(ret != 0, "verification unexpectedly succeeded\n");
• return CMD_RET_SUCCESS;

+}

+LIB_TEST(lib_rsa_verify_invalid, 0); +#endif /* RSA_VERIFY_WITH_PKEY */

On 1/17/20 2:53 AM, AKASHI Takahiro wrote:

On Tue, Jan 14, 2020 at 01:04:58PM +0100, Heinrich Schuchardt wrote:

...

On 1/14/20 8:33 AM, AKASHI Takahiro wrote:

...

On Wed, Jan 08, 2020 at 06:43:51PM +0100, Heinrich Schuchardt wrote:

...

On 11/21/19 1:11 AM, AKASHI Takahiro wrote:

...

In this patch, a very simple test is added to verify that rsa_verify() using rsa_verify_with_pkey() work correctly.

To keep the code simple, all the test data, either public key and verified binary data, are embedded in the source.

Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org

test/Kconfig | 12 +++ test/lib/Makefile | 1 + test/lib/rsa.c | 206 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 219 insertions(+) create mode 100644 test/lib/rsa.c

diff --git a/test/Kconfig b/test/Kconfig index cb7954041eda..64d76c3b20a5 100644 --- a/test/Kconfig +++ b/test/Kconfig @@ -28,6 +28,18 @@ config UT_LIB_ASN1 Enables a test which exercises asn1 compiler and decoder function via various parsers.

+config UT_LIB_RSA

• bool "Unit test for rsa_verify() function"
• imply RSA
• imply ASYMMETRIC_KEY_TYPE
• imply ASYMMETRIC_PUBLIC_KEY_SUBTYPE
• imply RSA_PUBLIC_KEY_PARSER
• imply RSA_VERIFY_WITH_PKEY

This test should depend on RSA_VERIFY_WITH_PKEY because is cannot be executed otherwise.

See below.

...

Best regards

Heinrich

...

• default y

• help

•  Enables rsa_verify() test, currently rsa_verify_with_pkey only()
  

•  only, at the 'ut lib' command.
  

• endif

  config UT_TIME

diff --git a/test/lib/Makefile b/test/lib/Makefile index 72d2ec74b5f4..2bf6ef3935bb 100644 --- a/test/lib/Makefile +++ b/test/lib/Makefile @@ -8,3 +8,4 @@ obj-y += lmb.o obj-y += string.o obj-$(CONFIG_ERRNO_STR) += test_errno_str.o obj-$(CONFIG_UT_LIB_ASN1) += asn1.o +obj-$(CONFIG_UT_LIB_RSA) += rsa.o diff --git a/test/lib/rsa.c b/test/lib/rsa.c new file mode 100644 index 000000000000..44f8ade226f4 --- /dev/null +++ b/test/lib/rsa.c @@ -0,0 +1,206 @@ +// SPDX-License-Identifier: GPL-2.0+ +/*

• • Copyright (c) 2019 Linaro Limited
• • Author: AKASHI Takahiro
• • Unit test for rsa_verify() function
• */

+#include <common.h> +#include <command.h> +#include <image.h> +#include <test/lib.h> +#include <test/test.h> +#include <test/ut.h> +#include <u-boot/rsa.h>

+#ifdef CONFIG_RSA_VERIFY_WITH_PKEY

Please, remove this ifdef. Simply do not build this module if CONFIG_RSA_VERIFY_WITH_PKEY is not defined.

That is why I added this #ifdef here to avoid a build error. I think it is a good idea to make test code as generic as possible to easily add more test cases.

It is preferable to move configuration dependencies to the Makefile.

You can create a new C file if you have tests needing a different configuration.

test/lib/rsa_verify.c might be a better name for the file.

In test/Kconfig, please, replace

config UT_LIB_RSA         bool "Unit test for rsa_verify() function"         imply RSA

by

config UT_LIB_RSA bool "Unit test for rsa_verify() function" default y depends on RSA

Initially in my development code, I did the exact same thing, but I didn't adopt this approach.

If we follow your proposal, UT_LIB_RSA won't be selected unless RSA is enabled. So UT_LIB_RSA won't be executed under most existing configurations in the current CI. This was not what I wanted.

What I wanted here is that, if UT (and UT_LIB) is selected, all the configurations needed for enabling all the test cases be also selected *automatically*.

What I want is that if I run 'make menuconfig' and select CONFIG_UT manually I end up with a configuration that compiles and that does what I have configured.

Just try:

make wandboard_config make menuconfig # set CONFIG_UT=y # set CONFIG_UT_LIB_RSA=y

This results in

CONFIG_RSA=n

because 'imply RSA' does not switch on CONFIG_RSA in this case.

You end up with a configuration where the test is selected in .config but cannot be executed.

Please, change your patches such that it is guaranteed that if a test is activated in the configuration it is executed by the 'ut all' command.

Best regards

Heinrich

I think that this is what Tom implied in his comment.

Thanks, -Takahiro Akashi

...

We run all unit tests in Gitlab CI. This requires default=y.

'imply' gives you no guarantee that RSA is selected. See the build errors I reported for your other patches in the series.

Best regards

Heinrich

...

I believe that the original RSA helper functions (w/o WITH_PKEY) should also be exercised in a unit test. Otherwise, the code will only be exercised indirectly through FIT image verification and such a situation will contradict what Tom (or Heinrich?) demanded against my RSA patch.

-Takahiro Akashi

...

...

+/*

• • openssl genrsa 2048 -out private.pem
• • openssl rsa -in private.pem -pubout -outform der -out public.der
• • dd if=public.der of=public.raw bs=24 skip=1
• */

+static unsigned char public_key[] = {

• 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xca, 0x25, 0x23,
• 0xe0, 0x0a, 0x4d, 0x8f, 0x56, 0xfc, 0xc9, 0x06, 0x4c, 0xcc, 0x94, 0x43,
• 0xe0, 0x56, 0x44, 0x6e, 0x37, 0x54, 0x87, 0x12, 0x84, 0xf9, 0x07, 0x4f,
• 0xe4, 0x23, 0x40, 0xc3, 0x43, 0x84, 0x37, 0x86, 0xd3, 0x9d, 0x95, 0x1c,
• 0xe4, 0x8a, 0x66, 0x02, 0x09, 0xe2, 0x3d, 0xce, 0x2c, 0xc6, 0x02, 0x6a,
• 0xd4, 0x65, 0x61, 0xff, 0x85, 0x6f, 0x88, 0x63, 0xba, 0x31, 0x62, 0x1e,
• 0xb7, 0x95, 0xe9, 0x08, 0x3c, 0xe9, 0x35, 0xde, 0xfd, 0x65, 0x92, 0xb8,
• 0x9e, 0x71, 0xa4, 0xcd, 0x47, 0xfd, 0x04, 0x26, 0xb9, 0x78, 0xbf, 0x05,
• 0x0d, 0xfc, 0x00, 0x84, 0x08, 0xfc, 0xc4, 0x4b, 0xea, 0xf5, 0x97, 0x68,
• 0x0d, 0x97, 0xd7, 0xff, 0x4f, 0x92, 0x82, 0xd7, 0xbb, 0xef, 0xb7, 0x67,
• 0x8e, 0x72, 0x54, 0xe8, 0xc5, 0x9e, 0xfd, 0xd8, 0x38, 0xe9, 0xbe, 0x19,
• 0x37, 0x5b, 0x36, 0x8b, 0xbf, 0x49, 0xa1, 0x59, 0x3a, 0x9d, 0xad, 0x92,
• 0x08, 0x0b, 0xe3, 0xa4, 0xa4, 0x7d, 0xd3, 0x70, 0xc0, 0xb8, 0xfb, 0xc7,
• 0xda, 0xd3, 0x19, 0x86, 0x37, 0x9a, 0xcd, 0xab, 0x30, 0x96, 0xab, 0xa4,
• 0xa2, 0x31, 0xa0, 0x38, 0xfb, 0xbf, 0x85, 0xd3, 0x24, 0x39, 0xed, 0xbf,
• 0xe1, 0x31, 0xed, 0x6c, 0x39, 0xc1, 0xe5, 0x05, 0x2e, 0x12, 0x30, 0x36,
• 0x73, 0x5d, 0x62, 0xf3, 0x82, 0xaf, 0x38, 0xc8, 0xca, 0xfa, 0xa1, 0x99,
• 0x57, 0x3c, 0xe1, 0xc1, 0x7b, 0x05, 0x0b, 0xcc, 0x2e, 0xa9, 0x10, 0xc8,
• 0x68, 0xbd, 0x27, 0xb6, 0x19, 0x9c, 0xd2, 0xad, 0xb3, 0x1f, 0xca, 0x35,
• 0x6e, 0x84, 0x23, 0xa1, 0xe9, 0xa4, 0x4c, 0xab, 0x19, 0x09, 0x79, 0x6e,
• 0x3c, 0x7b, 0x74, 0xfc, 0x33, 0x05, 0xcf, 0xa4, 0x2e, 0xeb, 0x55, 0x60,
• 0x05, 0xc7, 0xcf, 0x3f, 0x92, 0xac, 0x2d, 0x69, 0x0b, 0x19, 0x16, 0x79,
• 0x75, 0x02, 0x03, 0x01, 0x00, 0x01

+};

+static unsigned int public_key_len = 270;

+/*

• • dd if=/dev/urandom of=data.raw bs=512 count=1
• */

+static unsigned char data_raw[] = {

• 0x3e, 0x48, 0x6e, 0xef, 0x83, 0xd1, 0x4c, 0xfd, 0x92, 0x47, 0x92, 0xd7,
• 0xf6, 0x16, 0x25, 0x0a, 0xdf, 0xe2, 0xb6, 0x6c, 0xe7, 0xe0, 0x55, 0xb2,
• 0x70, 0x66, 0xf0, 0xe5, 0xdc, 0xaf, 0xd3, 0x2e, 0xc1, 0x3e, 0x5c, 0x4b,
• 0xb5, 0xa7, 0x23, 0x1f, 0x2c, 0xce, 0xf8, 0x83, 0x00, 0x6d, 0xeb, 0xdd,
• 0x19, 0x71, 0x13, 0xb4, 0xae, 0x5c, 0xa8, 0xae, 0x52, 0xc8, 0xe1, 0x77,
• 0x9e, 0x98, 0x75, 0xbc, 0xef, 0x36, 0x9f, 0x0c, 0x14, 0xed, 0x1a, 0x0a,
• 0x4f, 0x6c, 0xa4, 0xb1, 0xbb, 0x0e, 0x43, 0x93, 0x12, 0xfc, 0x2e, 0x82,
• 0x93, 0x4e, 0xcb, 0xa2, 0xcd, 0x59, 0x3f, 0xc5, 0x11, 0x38, 0x3a, 0x88,
• 0xc3, 0xcf, 0xf9, 0x61, 0xa8, 0x9e, 0x96, 0xb6, 0xbf, 0xa6, 0x5b, 0x0d,
• 0xd9, 0xbd, 0x05, 0x4c, 0xbe, 0xed, 0x86, 0xca, 0x10, 0x63, 0x72, 0x75,
• 0x4b, 0xbd, 0x86, 0x42, 0x30, 0x9d, 0x54, 0x4e, 0x12, 0xda, 0xf4, 0xb4,
• 0xfd, 0xd9, 0x54, 0x95, 0x8f, 0x83, 0xc2, 0x63, 0x44, 0xdd, 0x96, 0x1a,
• 0xd0, 0x7c, 0xcf, 0xcb, 0x16, 0xd6, 0xff, 0xa3, 0xbb, 0xeb, 0x24, 0x06,
• 0xbf, 0x81, 0xd0, 0x29, 0x76, 0x19, 0x66, 0x84, 0xfc, 0x49, 0xde, 0x7b,
• 0x5d, 0xd2, 0x27, 0x58, 0x21, 0x7b, 0xff, 0x4d, 0x64, 0xf3, 0x89, 0xe3,
• 0xea, 0xb6, 0x54, 0x4e, 0xb1, 0x62, 0x52, 0x89, 0xe3, 0x22, 0xf2, 0x26,
• 0x3e, 0x4f, 0x43, 0x58, 0x78, 0x91, 0x55, 0xbc, 0x1e, 0xd6, 0x97, 0xfc,
• 0x0b, 0x85, 0x4c, 0x92, 0x9c, 0xbf, 0xc4, 0xb1, 0x62, 0x93, 0x27, 0xa9,
• 0xb2, 0xf4, 0xb4, 0x7a, 0xfb, 0x56, 0xe5, 0x8f, 0xe1, 0x94, 0x4d, 0xfd,
• 0xe4, 0x72, 0x8d, 0xa9, 0x71, 0x65, 0xcb, 0x2e, 0x6d, 0x39, 0xd5, 0x95,
• 0xe7, 0x3f, 0xab, 0xaa, 0x7a, 0x74, 0x84, 0x25, 0x4b, 0x42, 0x1e, 0xd3,
• 0x86, 0xca, 0x47, 0x4a, 0xf0, 0x24, 0x81, 0x24, 0xb0, 0xe1, 0xbb, 0x6c,
• 0x3f, 0x2a, 0xa0, 0xb8, 0xeb, 0xd6, 0x01, 0xce, 0x63, 0x51, 0xe1, 0x81,
• 0xd2, 0x32, 0x43, 0x56, 0x44, 0x4a, 0x6b, 0x51, 0x24, 0xa2, 0xc7, 0x39,
• 0x7c, 0x54, 0xda, 0xf8, 0xd4, 0x93, 0x7c, 0x8e, 0x4e, 0x9d, 0x15, 0x08,
• 0xce, 0x27, 0xd8, 0x28, 0xb0, 0x5b, 0x75, 0x32, 0x43, 0xe8, 0xd6, 0xbf,
• 0x12, 0xd5, 0xc5, 0x12, 0x8e, 0xeb, 0x77, 0x8f, 0x00, 0xde, 0x45, 0x1e,
• 0xdd, 0xf3, 0xef, 0x43, 0x99, 0x79, 0x86, 0xea, 0x01, 0xce, 0xf2, 0x4d,
• 0xa0, 0xfe, 0x5a, 0x55, 0xc0, 0x1f, 0xce, 0xe8, 0xbe, 0xc2, 0x66, 0xdb,
• 0xcb, 0x3f, 0xa5, 0x48, 0xa1, 0xe2, 0x49, 0xa1, 0x29, 0x65, 0x5b, 0x62,
• 0x39, 0xcc, 0xef, 0xbe, 0x86, 0xb7, 0xe3, 0x44, 0x67, 0x04, 0x04, 0xb1,
• 0xec, 0xd8, 0xb2, 0xb2, 0x38, 0xbc, 0x10, 0xea, 0x7a, 0x0e, 0xa4, 0xa4,
• 0xcb, 0x21, 0xd9, 0xc7, 0xb4, 0x0b, 0xb8, 0x39, 0xb4, 0x07, 0x53, 0x3f,
• 0xb9, 0x55, 0x55, 0xa1, 0x6f, 0x11, 0x49, 0xc0, 0x94, 0x77, 0xaf, 0x76,
• 0x97, 0x7f, 0x31, 0x08, 0xdd, 0x72, 0x48, 0x72, 0xf8, 0x11, 0x4f, 0x69,
• 0x10, 0xef, 0x23, 0x06, 0xf3, 0x34, 0xac, 0xee, 0x97, 0x89, 0x41, 0x1c,
• 0x36, 0x38, 0xb1, 0x80, 0x96, 0x7a, 0x9e, 0x72, 0xab, 0x25, 0xeb, 0xce,
• 0x7b, 0xb8, 0x5d, 0xc8, 0xef, 0xa4, 0x73, 0xa1, 0xa6, 0x8f, 0x01, 0x54,
• 0xce, 0x58, 0x19, 0xe5, 0x7e, 0xfa, 0x77, 0x08, 0x9d, 0x53, 0xc1, 0xcc,
• 0x08, 0xe8, 0x1d, 0xe0, 0x82, 0x5e, 0xe1, 0xe6, 0xbd, 0xbb, 0x59, 0x7e,
• 0x12, 0x9c, 0x39, 0x60, 0x23, 0xf7, 0xbe, 0x0a, 0x7c, 0x48, 0x12, 0xa0,
• 0x84, 0x04, 0x3f, 0xa1, 0x6e, 0x92, 0xcd, 0xa0, 0xac, 0xee, 0x0b, 0xbc,
• 0x18, 0x30, 0x28, 0xbd, 0xf5, 0xfa, 0x3a, 0x35

+};

+static unsigned int data_raw_len = 512;

+/*

• • openssl dgst -sha256 -sign private.key -out data.enc data.raw
• */

+unsigned char data_enc[] = {

• 0xa7, 0x4a, 0x12, 0x8f, 0xee, 0x65, 0x4b, 0xcd, 0x88, 0xca, 0x4d, 0xed,
• 0xe3, 0x04, 0xe7, 0x7c, 0x59, 0xbf, 0x2f, 0xad, 0x95, 0x73, 0x5b, 0x2c,
• 0x4e, 0xb5, 0xda, 0x5e, 0x3a, 0x6d, 0xb4, 0xc5, 0x84, 0x0c, 0xd2, 0x4a,
• 0x62, 0x0d, 0x5f, 0xba, 0x10, 0xee, 0xb1, 0x2a, 0xe1, 0xfe, 0x50, 0x18,
• 0x97, 0xcc, 0xea, 0x26, 0x62, 0x33, 0x5a, 0x1d, 0x51, 0x38, 0x52, 0x89,
• 0x4d, 0xa7, 0x18, 0xff, 0xa6, 0xc8, 0xd4, 0x7a, 0xc0, 0xa6, 0x22, 0xdf,
• 0x41, 0x89, 0x93, 0x9b, 0xe7, 0x9e, 0xc1, 0xc8, 0x80, 0xda, 0x1a, 0x3f,
• 0xa4, 0x7a, 0xd0, 0x07, 0xcb, 0x5c, 0xa4, 0x75, 0x12, 0x54, 0x78, 0x67,
• 0xbf, 0xe6, 0xae, 0x1e, 0x56, 0x33, 0x9e, 0xe0, 0x6e, 0x33, 0xa7, 0x58,
• 0xb0, 0x47, 0x49, 0xa8, 0x37, 0xdb, 0x82, 0x4b, 0xbd, 0x32, 0x9c, 0xdc,
• 0xf4, 0x67, 0x17, 0x24, 0x55, 0xfd, 0x83, 0x1e, 0xc8, 0xb4, 0x5c, 0xf9,
• 0x15, 0x6c, 0x5e, 0xaa, 0x72, 0x03, 0x9e, 0x7c, 0x17, 0xf5, 0x7c, 0x37,
• 0x96, 0x00, 0xb0, 0xd8, 0xaa, 0x05, 0xfa, 0xaa, 0xa1, 0x78, 0x77, 0xd5,
• 0x09, 0xdd, 0x05, 0xc7, 0xe2, 0x9f, 0x68, 0xc7, 0xf8, 0xfb, 0x0b, 0x6f,
• 0x18, 0x1e, 0xcc, 0x93, 0xd3, 0x3f, 0xc9, 0x26, 0x29, 0x64, 0xe7, 0x15,
• 0xdc, 0xb8, 0x19, 0x10, 0x24, 0x55, 0x55, 0x3b, 0x79, 0xa1, 0x65, 0x12,
• 0xe0, 0x0b, 0x88, 0x44, 0x4c, 0xea, 0x85, 0x5a, 0x6b, 0x2d, 0x45, 0x6e,
• 0xe7, 0x83, 0x6f, 0x3a, 0xaa, 0x1e, 0xf1, 0x9c, 0x8f, 0xdc, 0xb9, 0x37,
• 0xa2, 0x15, 0x61, 0x93, 0x06, 0x23, 0xf5, 0xfe, 0xf0, 0xf8, 0x2b, 0xf7,
• 0xc0, 0x68, 0x67, 0xf6, 0x4e, 0x08, 0x0d, 0x0d, 0x08, 0xbe, 0xfb, 0x2c,
• 0x4c, 0xe7, 0xd7, 0x1a, 0xad, 0xd9, 0x98, 0xa1, 0x8d, 0x94, 0x1c, 0xd1,
• 0x89, 0x06, 0xc9, 0x3a

+};

+static unsigned int data_enc_len = 256;

+/**

• • lib_rsa_verify_valid() - unit test for rsa_verify()
• • Test rsa_verify() with valid hash
• • @uts: unit test state
• • Return: 0 = success, 1 = failure
• */

+static int lib_rsa_verify_valid(struct unit_test_state *uts) +{

• struct image_sign_info info;
• struct image_region reg;
• int ret;
• memset(&info, '\0', sizeof(info));
• info.name = "sha256,rsa2048";
• info.padding = image_get_padding_algo("pkcs-1.5");
• info.checksum = image_get_checksum_algo("sha256,rsa2048");
• info.crypto = image_get_crypto_algo(info.name);
• info.key = public_key;
• info.keylen = public_key_len;
• reg.data = data_raw;
• reg.size = data_raw_len;
• ret = rsa_verify(&info, &reg, 1, data_enc, data_enc_len);
• ut_assertf(ret == 0, "verification unexpectedly failed (%d)\n", ret);
• return CMD_RET_SUCCESS;

+}

+LIB_TEST(lib_rsa_verify_valid, 0);

+/**

• • lib_rsa_verify_invalid() - unit test for rsa_verify()
• • Test rsa_verify() with invalid hash
• • @uts: unit test state
• • Return: 0 = success, 1 = failure
• */

+static int lib_rsa_verify_invalid(struct unit_test_state *uts) +{

• struct image_sign_info info;
• struct image_region reg;
• unsigned char ctmp;
• int ret;
• memset(&info, '\0', sizeof(info));
• info.name = "sha256,rsa2048";
• info.padding = image_get_padding_algo("pkcs-1.5");
• info.checksum = image_get_checksum_algo("sha256,rsa2048");
• info.crypto = image_get_crypto_algo(info.name);
• info.key = public_key;
• info.keylen = public_key_len;
• /* randomly corrupt enc'ed data */
• ctmp = data_enc[data_enc_len - 10];
• data_enc[data_enc_len - 10] = 0x12;
• reg.data = data_raw;
• reg.size = data_raw_len;
• ret = rsa_verify(&info, &reg, 1, data_enc, data_enc_len);
• /* revert a change */
• data_enc[data_enc_len - 10] = ctmp;
• ut_assertf(ret != 0, "verification unexpectedly succeeded\n");
• return CMD_RET_SUCCESS;

+}

+LIB_TEST(lib_rsa_verify_invalid, 0); +#endif /* RSA_VERIFY_WITH_PKEY */

On Tue, Jan 21, 2020 at 02:48:52PM +0900, AKASHI Takahiro wrote:

On Fri, Jan 17, 2020 at 06:26:34AM +0100, Heinrich Schuchardt wrote:

...

On 1/17/20 2:53 AM, AKASHI Takahiro wrote:

...

On Tue, Jan 14, 2020 at 01:04:58PM +0100, Heinrich Schuchardt wrote:

...

On 1/14/20 8:33 AM, AKASHI Takahiro wrote:

...

On Wed, Jan 08, 2020 at 06:43:51PM +0100, Heinrich Schuchardt wrote:

...

On 11/21/19 1:11 AM, AKASHI Takahiro wrote: >In this patch, a very simple test is added to verify that rsa_verify() >using rsa_verify_with_pkey() work correctly. > >To keep the code simple, all the test data, either public key and >verified binary data, are embedded in the source. > >Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org >--- > test/Kconfig | 12 +++ > test/lib/Makefile | 1 + > test/lib/rsa.c | 206 ++++++++++++++++++++++++++++++++++++++++++++++ > 3 files changed, 219 insertions(+) > create mode 100644 test/lib/rsa.c > >diff --git a/test/Kconfig b/test/Kconfig >index cb7954041eda..64d76c3b20a5 100644 >--- a/test/Kconfig >+++ b/test/Kconfig >@@ -28,6 +28,18 @@ config UT_LIB_ASN1 > Enables a test which exercises asn1 compiler and decoder function > via various parsers. > >+config UT_LIB_RSA >+ bool "Unit test for rsa_verify() function" >+ imply RSA >+ imply ASYMMETRIC_KEY_TYPE >+ imply ASYMMETRIC_PUBLIC_KEY_SUBTYPE >+ imply RSA_PUBLIC_KEY_PARSER >+ imply RSA_VERIFY_WITH_PKEY

This test should depend on RSA_VERIFY_WITH_PKEY because is cannot be executed otherwise.

See below.

...

Best regards

Heinrich

>+ default y >+ help >+ Enables rsa_verify() test, currently rsa_verify_with_pkey only() >+ only, at the 'ut lib' command. >+ > endif > > config UT_TIME >diff --git a/test/lib/Makefile b/test/lib/Makefile >index 72d2ec74b5f4..2bf6ef3935bb 100644 >--- a/test/lib/Makefile >+++ b/test/lib/Makefile >@@ -8,3 +8,4 @@ obj-y += lmb.o > obj-y += string.o > obj-$(CONFIG_ERRNO_STR) += test_errno_str.o > obj-$(CONFIG_UT_LIB_ASN1) += asn1.o >+obj-$(CONFIG_UT_LIB_RSA) += rsa.o >diff --git a/test/lib/rsa.c b/test/lib/rsa.c >new file mode 100644 >index 000000000000..44f8ade226f4 >--- /dev/null >+++ b/test/lib/rsa.c >@@ -0,0 +1,206 @@ >+// SPDX-License-Identifier: GPL-2.0+ >+/* >+ * Copyright (c) 2019 Linaro Limited >+ * Author: AKASHI Takahiro >+ * >+ * Unit test for rsa_verify() function >+ */ >+ >+#include <common.h> >+#include <command.h> >+#include <image.h> >+#include <test/lib.h> >+#include <test/test.h> >+#include <test/ut.h> >+#include <u-boot/rsa.h> >+ >+#ifdef CONFIG_RSA_VERIFY_WITH_PKEY

Please, remove this ifdef. Simply do not build this module if CONFIG_RSA_VERIFY_WITH_PKEY is not defined.

That is why I added this #ifdef here to avoid a build error. I think it is a good idea to make test code as generic as possible to easily add more test cases.

It is preferable to move configuration dependencies to the Makefile.

You can create a new C file if you have tests needing a different configuration.

test/lib/rsa_verify.c might be a better name for the file.

In test/Kconfig, please, replace

config UT_LIB_RSA         bool "Unit test for rsa_verify() function"         imply RSA

by

config UT_LIB_RSA bool "Unit test for rsa_verify() function" default y depends on RSA

Initially in my development code, I did the exact same thing, but I didn't adopt this approach.

If we follow your proposal, UT_LIB_RSA won't be selected unless RSA is enabled. So UT_LIB_RSA won't be executed under most existing configurations in the current CI. This was not what I wanted.

What I wanted here is that, if UT (and UT_LIB) is selected, all the configurations needed for enabling all the test cases be also selected *automatically*.

What I want is that if I run 'make menuconfig' and select CONFIG_UT manually I end up with a configuration that compiles and that does what I have configured.

Hmm, that is what I intend to do here, but the code doesn't work as I expected. It works only if CONFIG_UT_LIB_RSA is on in *defconfig.

So I have no option other than changing reverse dependencies as follows, CONFIG_UT_LIB_RSA select IMAGE_SIGN_INFO select RSA imply RSA_VERIFY_WITH_PKEY

Using 'select' is still safe as CONFIG_RSA has no dependency. (Please note we can still use 'imply' for VERIFY_WITH_PKEY here.)

Tom, do you agree to this change?

OK, my fault for not spotting it before. Using imply (as we do today on UT_LIB_ASN1) is wrong. All of the tests should "depends on" what they need in order to function. Thanks!

On Wed, Jan 22, 2020 at 09:22:42AM +0900, AKASHI Takahiro wrote:

On Tue, Jan 21, 2020 at 10:40:23AM -0500, Tom Rini wrote:

...

On Tue, Jan 21, 2020 at 02:48:52PM +0900, AKASHI Takahiro wrote:

...

On Fri, Jan 17, 2020 at 06:26:34AM +0100, Heinrich Schuchardt wrote:

...

On 1/17/20 2:53 AM, AKASHI Takahiro wrote:

...

On Tue, Jan 14, 2020 at 01:04:58PM +0100, Heinrich Schuchardt wrote:

...

On 1/14/20 8:33 AM, AKASHI Takahiro wrote: >On Wed, Jan 08, 2020 at 06:43:51PM +0100, Heinrich Schuchardt wrote: >> >> >>On 11/21/19 1:11 AM, AKASHI Takahiro wrote: >>>In this patch, a very simple test is added to verify that rsa_verify() >>>using rsa_verify_with_pkey() work correctly. >>> >>>To keep the code simple, all the test data, either public key and >>>verified binary data, are embedded in the source. >>> >>>Signed-off-by: AKASHI Takahiro takahiro.akashi@linaro.org >>>--- >>> test/Kconfig | 12 +++ >>> test/lib/Makefile | 1 + >>> test/lib/rsa.c | 206 ++++++++++++++++++++++++++++++++++++++++++++++ >>> 3 files changed, 219 insertions(+) >>> create mode 100644 test/lib/rsa.c >>> >>>diff --git a/test/Kconfig b/test/Kconfig >>>index cb7954041eda..64d76c3b20a5 100644 >>>--- a/test/Kconfig >>>+++ b/test/Kconfig >>>@@ -28,6 +28,18 @@ config UT_LIB_ASN1 >>> Enables a test which exercises asn1 compiler and decoder function >>> via various parsers. >>> >>>+config UT_LIB_RSA >>>+ bool "Unit test for rsa_verify() function" >>>+ imply RSA >>>+ imply ASYMMETRIC_KEY_TYPE >>>+ imply ASYMMETRIC_PUBLIC_KEY_SUBTYPE >>>+ imply RSA_PUBLIC_KEY_PARSER >>>+ imply RSA_VERIFY_WITH_PKEY >> >>This test should depend on RSA_VERIFY_WITH_PKEY because is cannot be >>executed otherwise. > >See below. > >>Best regards >> >>Heinrich >> >>>+ default y >>>+ help >>>+ Enables rsa_verify() test, currently rsa_verify_with_pkey only() >>>+ only, at the 'ut lib' command. >>>+ >>> endif >>> >>> config UT_TIME >>>diff --git a/test/lib/Makefile b/test/lib/Makefile >>>index 72d2ec74b5f4..2bf6ef3935bb 100644 >>>--- a/test/lib/Makefile >>>+++ b/test/lib/Makefile >>>@@ -8,3 +8,4 @@ obj-y += lmb.o >>> obj-y += string.o >>> obj-$(CONFIG_ERRNO_STR) += test_errno_str.o >>> obj-$(CONFIG_UT_LIB_ASN1) += asn1.o >>>+obj-$(CONFIG_UT_LIB_RSA) += rsa.o >>>diff --git a/test/lib/rsa.c b/test/lib/rsa.c >>>new file mode 100644 >>>index 000000000000..44f8ade226f4 >>>--- /dev/null >>>+++ b/test/lib/rsa.c >>>@@ -0,0 +1,206 @@ >>>+// SPDX-License-Identifier: GPL-2.0+ >>>+/* >>>+ * Copyright (c) 2019 Linaro Limited >>>+ * Author: AKASHI Takahiro >>>+ * >>>+ * Unit test for rsa_verify() function >>>+ */ >>>+ >>>+#include <common.h> >>>+#include <command.h> >>>+#include <image.h> >>>+#include <test/lib.h> >>>+#include <test/test.h> >>>+#include <test/ut.h> >>>+#include <u-boot/rsa.h> >>>+ >>>+#ifdef CONFIG_RSA_VERIFY_WITH_PKEY >> >>Please, remove this ifdef. Simply do not build this module if >>CONFIG_RSA_VERIFY_WITH_PKEY is not defined. > >That is why I added this #ifdef here to avoid a build error. >I think it is a good idea to make test code as generic as possible >to easily add more test cases.

It is preferable to move configuration dependencies to the Makefile.

You can create a new C file if you have tests needing a different configuration.

test/lib/rsa_verify.c might be a better name for the file.

In test/Kconfig, please, replace

config UT_LIB_RSA         bool "Unit test for rsa_verify() function"         imply RSA

by

config UT_LIB_RSA bool "Unit test for rsa_verify() function" default y depends on RSA

Initially in my development code, I did the exact same thing, but I didn't adopt this approach.

If we follow your proposal, UT_LIB_RSA won't be selected unless RSA is enabled. So UT_LIB_RSA won't be executed under most existing configurations in the current CI. This was not what I wanted.

What I wanted here is that, if UT (and UT_LIB) is selected, all the configurations needed for enabling all the test cases be also selected *automatically*.

What I want is that if I run 'make menuconfig' and select CONFIG_UT manually I end up with a configuration that compiles and that does what I have configured.

Hmm, that is what I intend to do here, but the code doesn't work as I expected. It works only if CONFIG_UT_LIB_RSA is on in *defconfig.

So I have no option other than changing reverse dependencies as follows, CONFIG_UT_LIB_RSA select IMAGE_SIGN_INFO select RSA imply RSA_VERIFY_WITH_PKEY

Using 'select' is still safe as CONFIG_RSA has no dependency. (Please note we can still use 'imply' for VERIFY_WITH_PKEY here.)

Tom, do you agree to this change?

OK, my fault for not spotting it before. Using imply (as we do today on UT_LIB_ASN1) is wrong. All of the tests should "depends on" what they need in order to function. Thanks!

I know that using "depends on" is an obvious solution here, but in that case, we won't run those tests automatically in CI unless the dependency targets, like CONFIG_RSA, are explicitly or implicitly enabled by *defconfig.

Is that OK for you?

Yes, I expect them to be enabled in sandbox and relevant qemu targets to get broad testing here as that is part of the reason for those targets. In fact, sandbox should always be a priority to build-support, that is also where we get Coverity scans run.