Skip to content

support for "aux" algorithms#761

Draft
bigbrett wants to merge 6 commits intowolfSSL:masterfrom
bigbrett:cert-chain-multi-algo
Draft

support for "aux" algorithms#761
bigbrett wants to merge 6 commits intowolfSSL:masterfrom
bigbrett:cert-chain-multi-algo

Conversation

@bigbrett
Copy link
Copy Markdown
Contributor

Adds support for compiling in multiple auxiliary algorithms beyond those required by SIGN and HASH.

This is primarily intended for certificate chain verification via wolfHSM, where all potential algorithms in the chain must be compiled in, however, the implementation is generic and can support other use cases in the future.

Also updates the dummy certificate chain generation script to:

  • Support auxiliary algorithms
  • Enable expanded testing for mixed certificate chains and image algorithms

Copilot AI review requested due to automatic review settings April 28, 2026 16:05
@bigbrett bigbrett force-pushed the cert-chain-multi-algo branch from 8ced268 to 4a54197 Compare April 28, 2026 16:20
@danielinux
Copy link
Copy Markdown
Member

This looks like a good idea, but it should be merged with other engines where we do the same, i.e. configurations that require a broader subset of algorithms than those used by wolfBoot. One example is PKCS11 algorithm selection, and perhaps also with hybrid verification (SECONDARY_ ...), to ensure that mixing/matching does not define things twice. user_settings.h is getting crowded and perhaps this could be an opportunity to simplify, and offload some preselection to .mk (aux.mk ? being included/activated in 'engine' configurations?) I'd like to see things converge in one direction because algorithm selection can be done in too many ways already.

SIGN=RSAPSS{N} now expands to WOLFBOOT_SIGN_RSA{N} + WOLFBOOT_SIGN_RSA_PSS,
matching the AUX_PK_RSA{N} + AUX_RSA_PSS pattern.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants