Skip to content

Commit 0016643

Browse files
bigbrettbigbrett
committed
Adds generic cryptocb support for PK, hash, and symmetric crypto
1 parent dfa64a8 commit 0016643

12 files changed

Lines changed: 470 additions & 42 deletions

File tree

‎.github/workflows/test-cryptocb-simulator.yml‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
name: test simulator with crypto callback (cryptocb)
2+
3+
on:
4+
push:
5+
branches: [ 'master', 'main', 'release/**' ]
6+
pull_request:
7+
branches: [ '*' ]
8+
9+
jobs:
10+
cryptocb_simulator_tests:
11+
runs-on: ubuntu-latest
12+
container:
13+
image: ghcr.io/wolfssl/wolfboot-ci-sim:v1.0
14+
timeout-minutes: 30
15+
16+
steps:
17+
- uses: actions/checkout@v4
18+
with:
19+
submodules: true
20+
21+
- name: Trust workspace
22+
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
23+
24+
# 64 bit simulator, cryptocb enabled
25+
#
26+
- name: make clean
27+
run: |
28+
make keysclean
29+
30+
- name: Select config (64 bit simulator)
31+
run: |
32+
cp config/examples/sim.config .config
33+
34+
- name: Build tools
35+
run: |
36+
make -C tools/keytools && make -C tools/bin-assemble
37+
38+
# Classical algorithms (each tested once with SPMATH=1)
39+
# Note: ECC uses wc_ecc_verify_hash_ex which bypasses cryptocb PK dispatch,
40+
# so we only verify hash for ECC. ED25519 and RSA dispatch PK through cryptocb.
41+
#
42+
- name: Build wolfboot.elf (ED25519, cryptocb)
43+
run: |
44+
make clean && make test-sim-internal-flash-with-update SIGN=ED25519 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
45+
46+
- name: Run cryptocb sunnyday test (ED25519)
47+
run: |
48+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ED25519-verify"
49+
50+
- name: Cleanup to change key type
51+
run: |
52+
make keysclean
53+
54+
- name: Build wolfboot.elf (ECC256, cryptocb)
55+
run: |
56+
make clean && make test-sim-internal-flash-with-update SIGN=ECC256 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
57+
58+
- name: Run cryptocb sunnyday test (ECC256)
59+
run: |
60+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
61+
62+
- name: Cleanup to change key type
63+
run: |
64+
make keysclean
65+
66+
- name: Build wolfboot.elf (ECC384, cryptocb)
67+
run: |
68+
make clean && make test-sim-internal-flash-with-update SIGN=ECC384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
69+
70+
- name: Run cryptocb sunnyday test (ECC384)
71+
run: |
72+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
73+
74+
- name: Cleanup to change key type
75+
run: |
76+
make keysclean
77+
78+
- name: Build wolfboot.elf (ECC521, cryptocb)
79+
run: |
80+
make clean && make test-sim-internal-flash-with-update SIGN=ECC521 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
81+
82+
- name: Run cryptocb sunnyday test (ECC521)
83+
run: |
84+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
85+
86+
- name: Cleanup to change key type
87+
run: |
88+
make keysclean
89+
90+
- name: Build wolfboot.elf (RSA2048, cryptocb)
91+
run: |
92+
make clean && make test-sim-internal-flash-with-update SIGN=RSA2048 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
93+
94+
- name: Run cryptocb sunnyday test (RSA2048)
95+
run: |
96+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"
97+
98+
- name: Cleanup to change key type
99+
run: |
100+
make keysclean
101+
102+
- name: Build wolfboot.elf (RSA3072, cryptocb)
103+
run: |
104+
make clean && make test-sim-internal-flash-with-update SIGN=RSA3072 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
105+
106+
- name: Run cryptocb sunnyday test (RSA3072)
107+
run: |
108+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"
109+
110+
- name: Cleanup to change key type
111+
run: |
112+
make keysclean
113+
114+
- name: Build wolfboot.elf (RSA4096, cryptocb)
115+
run: |
116+
make clean && make test-sim-internal-flash-with-update SIGN=RSA4096 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
117+
118+
- name: Run cryptocb sunnyday test (RSA4096)
119+
run: |
120+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"
121+
122+
# SHA-384 hash coverage (paired with algorithms that naturally use 384-bit)
123+
#
124+
- name: Cleanup to change key type
125+
run: |
126+
make keysclean
127+
128+
- name: Build wolfboot.elf (ECC384 + SHA384, cryptocb)
129+
run: |
130+
make clean && make test-sim-internal-flash-with-update SIGN=ECC384 HASH=SHA384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
131+
132+
- name: Run cryptocb sunnyday test (ECC384 + SHA384)
133+
run: |
134+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-384"
135+
136+
- name: Cleanup to change key type
137+
run: |
138+
make keysclean
139+
140+
- name: Build wolfboot.elf (RSA4096 + SHA384, cryptocb)
141+
run: |
142+
make clean && make test-sim-internal-flash-with-update SIGN=RSA4096 HASH=SHA384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
143+
144+
- name: Run cryptocb sunnyday test (RSA4096 + SHA384)
145+
run: |
146+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-384" "RSA"
147+
148+
# SHA3-384 hash coverage
149+
#
150+
- name: Cleanup to change key type
151+
run: |
152+
make keysclean
153+
154+
- name: Build wolfboot.elf (ECC384 + SHA3-384, cryptocb)
155+
run: |
156+
make clean && make test-sim-internal-flash-with-update SIGN=ECC384 HASH=SHA3 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1
157+
158+
- name: Run cryptocb sunnyday test (ECC384 + SHA3-384)
159+
run: |
160+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA3-384"
161+
162+
# AES encrypted partition coverage (external flash + AES128-CTR)
163+
#
164+
- name: Cleanup to change key type
165+
run: |
166+
make keysclean
167+
168+
- name: Build wolfboot.elf (ED25519 + AES128 encrypt, cryptocb)
169+
run: |
170+
cp config/examples/sim-encrypt-update.config .config
171+
make clean && make test-sim-external-flash-with-enc-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
172+
173+
- name: Run cryptocb sunnyday test (ED25519 + AES128 encrypt)
174+
run: |
175+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ED25519-verify" "AES-CTR"
176+
177+
# PQ algorithms (each uses its own config, build + test inline)
178+
#
179+
- name: Build and test LMS (cryptocb)
180+
run: |
181+
cp config/examples/sim-lms.config .config
182+
make keysclean && make clean
183+
make keytools
184+
make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
185+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
186+
187+
- name: Build and test XMSS (cryptocb)
188+
run: |
189+
cp config/examples/sim-xmss.config .config
190+
make keysclean && make clean
191+
make keytools
192+
make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
193+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"
194+
195+
- name: Build and test ML-DSA level 2 (cryptocb)
196+
run: |
197+
cp config/examples/sim-ml-dsa.config .config
198+
make keysclean && make clean
199+
make keytools
200+
make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
201+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"
202+
203+
- name: Build and test ML-DSA level 3 (cryptocb)
204+
run: |
205+
cp config/examples/sim-ml-dsa3.config .config
206+
make keysclean && make clean
207+
make keytools
208+
make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
209+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"
210+
211+
- name: Build and test ML-DSA level 5 (cryptocb)
212+
run: |
213+
cp config/examples/sim-ml-dsa5.config .config
214+
make keysclean && make clean
215+
make keytools
216+
make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
217+
tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"
218+
219+
# Hybrid auth: ML_DSA + ECDSA
220+
#
221+
- name: make clean (hybrid)
222+
run: |
223+
make keysclean
224+
225+
- name: Select config (hybrid ML_DSA + ECC)
226+
run: |
227+
cp config/examples/sim-ml-dsa-ecc-hybrid.config .config
228+
229+
- name: Build tools (hybrid)
230+
run: |
231+
make -C tools/keytools && make -C tools/bin-assemble
232+
233+
- name: Build wolfboot.elf (hybrid, cryptocb)
234+
run: |
235+
make clean && make WOLFBOOT_TEST_SIM_CRYPTOCB=1
236+
237+
- name: Run hybrid boot test with cryptocb verification
238+
run: |
239+
./wolfboot.elf get_version > sim_cryptocb.log 2>/dev/null
240+
grep -q "sim-cryptocb: hash SHA-256" sim_cryptocb.log || (echo "hash SHA-256 not found" && cat sim_cryptocb.log && exit 1)
241+
grep -q "sim-cryptocb: pk ML-DSA-verify" sim_cryptocb.log || (echo "pk ML-DSA-verify not found" && cat sim_cryptocb.log && exit 1)
242+
echo "Hybrid cryptocb verification passed"

‎IDE/Renesas/e2studio/RA6M4/wolfBoot/user_settings.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@
6060
# define WOLF_CRYPTO_CB
6161
# define RENESAS_SCE_INSTALLEDKEY_ADDR 0x08001000U
6262
# define SCE_ID 7890
63+
# define RENESAS_DEVID SCE_ID
64+
# define WOLFBOOT_DEVID_PUBKEY SCE_ID
65+
# define WOLFBOOT_DEVID_CRYPT (SCE_ID + 1)
6366
# undef VECTOR_Reset_Handler
6467
# define VECTOR_Reset_Handler ((uint32_t *)(0x20204))
6568
...

‎IDE/Renesas/e2studio/RX72N/include/user_settings.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,8 @@
4242
# define WOLF_CRYPTO_CB
4343
# define RENESAS_TSIP_INSTALLEDKEY_ADDR 0xFFFF0000
4444
# define RENESAS_DEVID 7890
45+
# define WOLFBOOT_DEVID_PUBKEY RENESAS_DEVID
46+
# define WOLFBOOT_DEVID_CRYPT (RENESAS_DEVID + 1)
4547
#else
4648
#define WOLFBOOT_SIGN_RSA2048
4749
/* #define WOLFBOOT_SIGN_RSA3072 */

‎IDE/Renesas/e2studio/RZN2L/user_settings.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,8 @@
5656
#define RENESAS_RSIP_INSTALLEDKEY_FLASH_ADDR 0x60200000
5757
#define RENESAS_RSIP_INSTALLEDKEY_RAM_ADDR 0x10000100
5858
#define RENESAS_DEVID 7890
59+
#define WOLFBOOT_DEVID_PUBKEY RENESAS_DEVID
60+
#define WOLFBOOT_DEVID_CRYPT (RENESAS_DEVID + 1)
5961

6062
#if defined(WOLFBOOT_SIGN_RSA3072) ||\
6163
defined(WOLFBOOT_SIGN_RSA4096) ||\

‎arch.mk‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -504,6 +504,8 @@ ifeq ($(ARCH),RENESAS_RX)
504504

505505
ifeq ($(PKA),1)
506506
CFLAGS+=-DWOLFBOOT_RENESAS_TSIP
507+
CFLAGS+=-DWOLFBOOT_DEVID_PUBKEY=7890
508+
CFLAGS+=-DWOLFBOOT_DEVID_CRYPT=7891
507509
RX_DRIVER_PATH?=./lib
508510

509511
OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/cryptocb.o \

‎hal/sim.c‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,66 @@
4848
#include "elf.h"
4949
#endif
5050

51+
#if defined(WOLFBOOT_TEST_SIM_CRYPTOCB) && defined(__WOLFBOOT)
52+
#include <wolfssl/wolfcrypt/error-crypt.h>
53+
#include <wolfssl/wolfcrypt/cryptocb.h>
54+
55+
/* Crypto callback that prints dispatched algorithm names to stdout, then
56+
* returns CRYPTOCB_UNAVAILABLE to trigger software fallback. Test scripts
57+
* redirect stdout to a log and grep for "sim-cryptocb: <type> <name>" lines.
58+
*
59+
* NOTE: We only need to support the algorithms used by wolfBoot that also have
60+
* internal support for crypto callbacks. Algorithms like ED448 do not need to
61+
* be handled here since they do not dispatch to a crypto callback internally.
62+
*/
63+
static int sim_cryptocb(int devIdArg, wc_CryptoInfo* info, void* ctx)
64+
{
65+
(void)devIdArg;
66+
(void)ctx;
67+
68+
if (info == NULL)
69+
return CRYPTOCB_UNAVAILABLE;
70+
71+
if (info->algo_type == WC_ALGO_TYPE_HASH) {
72+
const char* name = "unknown";
73+
switch (info->hash.type) {
74+
case WC_HASH_TYPE_SHA256: name = "SHA-256"; break;
75+
case WC_HASH_TYPE_SHA384: name = "SHA-384"; break;
76+
case WC_HASH_TYPE_SHA3_384: name = "SHA3-384"; break;
77+
default: break;
78+
}
79+
printf("sim-cryptocb: hash %s\n", name);
80+
}
81+
else if (info->algo_type == WC_ALGO_TYPE_PK) {
82+
const char* name = "unknown";
83+
switch (info->pk.type) {
84+
case WC_PK_TYPE_RSA: name = "RSA"; break;
85+
case WC_PK_TYPE_ECDSA_VERIFY: name = "ECDSA-verify"; break;
86+
case WC_PK_TYPE_ED25519_VERIFY: name = "ED25519-verify"; break;
87+
#ifdef HAVE_DILITHIUM
88+
case WC_PK_TYPE_PQC_SIG_VERIFY:
89+
name = "ML-DSA-verify";
90+
break;
91+
#endif
92+
default: break;
93+
}
94+
printf("sim-cryptocb: pk %s\n", name);
95+
}
96+
#if !defined(NO_AES) || !defined(NO_DES3)
97+
else if (info->algo_type == WC_ALGO_TYPE_CIPHER) {
98+
const char* name = "unknown";
99+
switch (info->cipher.type) {
100+
case WC_CIPHER_AES_CTR: name = "AES-CTR"; break;
101+
default: break;
102+
}
103+
printf("sim-cryptocb: cipher %s\n", name);
104+
}
105+
#endif
106+
107+
return CRYPTOCB_UNAVAILABLE;
108+
}
109+
#endif /* WOLFBOOT_TEST_SIM_CRYPTOCB && __WOLFBOOT */
110+
51111
#ifdef WOLFBOOT_ENABLE_WOLFHSM_CLIENT
52112
#include "wolfhsm/wh_error.h"
53113
#include "wolfhsm/wh_client.h"
@@ -438,6 +498,23 @@ void hal_init(void)
438498
else if (strcmp(main_argv[i], "emergency") == 0)
439499
forceEmergency = 1;
440500
}
501+
502+
#if defined(WOLFBOOT_TEST_SIM_CRYPTOCB) && defined(__WOLFBOOT)
503+
{
504+
int cb_ret;
505+
/* wolfCrypt_Init() must be called before RegisterDevice —
506+
* it initializes CryptoDev[] slots to INVALID_DEVID via
507+
* wc_CryptoCb_Init(). Ref-counted, safe to call multiple times. */
508+
wolfCrypt_Init();
509+
cb_ret = wc_CryptoCb_RegisterDevice(0xCB, sim_cryptocb, NULL);
510+
if (cb_ret != 0) {
511+
wolfBoot_printf("Failed to register sim crypto callback: %d\n",
512+
cb_ret);
513+
exit(-1);
514+
}
515+
wolfBoot_printf("Registered sim_cryptocb with devId 0xCB\n");
516+
}
517+
#endif
441518
}
442519

443520
void ext_flash_lock(void)
@@ -583,6 +660,7 @@ void do_boot(const uint32_t *app_offset)
583660
}
584661
wolfBoot_printf("Stored test-app to memfd, address %p (%zu bytes)\n", app_offset, wret);
585662

663+
fflush(stdout);
586664
ret = fexecve(fd, main_argv, envp);
587665
wolfBoot_printf( "fexecve error\n");
588666
#endif

0 commit comments

Comments
 (0)