bl_*: Add ED25519 support #19159

nordicjm · 2024-11-29T12:01:38Z

Does not adds support for ED25519 and SHA512, does not enable ED25519 by default on nRF54L15.

test_boot: ed25519-tests

NordicBuilder · 2024-11-29T12:19:50Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 23

Inputs:

Sources:

more details

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (0)

Outputs:

Toolchain

Version:
Build docker image:

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

❌ Toolchain
❌ Build twister
❌ Integration tests

Note: This message is automatically posted and updated by the CI

NordicBuilder · 2024-11-29T12:26:46Z

You can find the documentation preview for this PR at this link. It will be updated about 10 minutes after the documentation build succeeds.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

NordicBuilder · 2024-12-04T12:53:36Z

Memory footprint analysis revealed the following potential issues

sample.matter.template.debug[nrf7002dk/nrf5340/cpuapp]: High ROM usage: 912202[B] - link (cc: @kkasperczyk-no @ArekBalysNordic @markaj-nordic)
sample.matter.template.release[nrf7002dk/nrf5340/cpuapp]: High ROM usage: 821126[B] - link (cc: @kkasperczyk-no @ArekBalysNordic @markaj-nordic)

Note: This message is automatically posted and updated by the CI (latest/sdk-nrf/PR-19159/20)

de-nordic · 2024-12-05T14:53:37Z

subsys/bootloader/bl_crypto/Kconfig

+	select PSA_WANT_ALG_PURE_EDDSA
+	select PSA_WANT_ECC_TWISTED_EDWARDS_255
+	select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT


I have these probably selected for SHA512 in MCUboot but they should not be needed, they are just required by ED25519, sha itself does not need them.
As far as I understand we are using KMU here so the _IMPORT should not be needed at all.

This Kconfig is actually not used

nvlsianpu

note for me
sysbuild: Add support for selecting b0 hash/signature types

nvlsianpu · 2024-12-03T16:25:09Z

include/bl_crypto.h

 #endif

+


unwanted newline

nvlsianpu · 2024-12-16T16:21:41Z

sysbuild/Kconfig.secureboot

+
+config SECURE_BOOT_APPCORE_SUPPORTED_HASH_HARDWARE
+	bool
+	default y if SECURE_BOOT_HASH_TYPE_SHA256 && (SOC_SERIES_NRF91X || SOC_NRF52840)


might be ...&& HAS_HW_NRF_CC310

No such Kconfig in a sysbuild context, there is no devicetree

nvlsianpu · 2024-12-16T16:22:32Z

sysbuild/Kconfig.secureboot

+
+config SECURE_BOOT_APPCORE_SUPPORTED_SIGNATURE_HARDWARE
+	bool
+	default y if SECURE_BOOT_SIGNATURE_TYPE_ECDSA && (SOC_SERIES_NRF91X || SOC_NRF52840)


nvlsianpu · 2024-12-17T07:49:04Z

sysbuild/Kconfig.secureboot

Not to be fixed by this PR:
I'm start thinking about misleading of the secure_boot name. It's NSIB under the hood. Also SB acronym is used elsewhere.
MCUboot is also another bootloader which also can be claimed to be secure bootloader - which might cause some concerns around the name.
Probably it's no time of today to change this.

nordicjm · 2025-02-17T11:10:53Z

@nordicjm see 29958e5#diff-0e1f0a7a24c7a4e5f66889e67bf03cc1827d146d333cd06ed2d3054d58963298L17-R17

Adds support for using SHA512 signatures using PSA crypto Signed-off-by: Jamie McCrae <[email protected]>

Adds support for ED25519 signatures using PSA crypto Signed-off-by: Jamie McCrae <[email protected]>

Makes these fields optional for configurations where they are not needed Signed-off-by: Jamie McCrae <[email protected]>

Does not add support for allowing the hash and signature type to be selected, also does not add support for ED25519 on nrf54l15 Signed-off-by: Jamie McCrae <[email protected]>

github-actions · 2025-02-26T11:59:17Z

You can find the documentation preview for this PR here.

The parameters listed are wrong Signed-off-by: Jamie McCrae <[email protected]>

Prevents compliance from complaining Signed-off-by: Jamie McCrae <[email protected]>

Selects the Kconfig to enable the hash field be present in the output Signed-off-by: Jamie McCrae <[email protected]>

The comments for no SHA256 and no secp256r1 wrongly stated that these are disabled, this however is not true, the fields are accessed and must still be present, therefore explain that whilst they might not be checked, they are still required to be present Signed-off-by: Jamie McCrae <[email protected]>

sonarqubecloud · 2025-02-26T12:25:48Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

nvlsianpu · 2025-02-26T14:50:56Z

Changes seams to be as expected by me. FYI @gchwier

+++ b/sysbuild/Kconfig.secureboot
@@ -37,7 +37,6 @@ config SECURE_BOOT_APPCORE_SUPPORTED_HASH_NONE
 config SECURE_BOOT_APPCORE_SUPPORTED_SIGNATURE_HARDWARE
        bool
        default y if SECURE_BOOT_SIGNATURE_TYPE_ECDSA && (SOC_SERIES_NRF91X || SOC_NRF52840)
-       default y if SECURE_BOOT_SIGNATURE_TYPE_ED25519 && SOC_NRF54L15_CPUAPP
 
 config SECURE_BOOT_APPCORE_SUPPORTED_SIGNATURE_SOFTWARE
        bool
@@ -204,7 +203,6 @@ config SECURE_BOOT_SUPPORTED_SIGNATURE_ECDSA
 
 config SECURE_BOOT_SUPPORTED_SIGNATURE_ED25519
        bool
-       default y if SOC_NRF54L15_CPUAPP
 
 choice SECURE_BOOT_HASH_TYPE
        prompt "Hash type"

+++ b/subsys/bootloader/Kconfig
@@ -73,7 +74,7 @@ config PM_PARTITION_SIZE_B0_IMAGE
        default 0x7800 if !B0_MIN_PARTITION_SIZE && (SOC_NRF5340_CPUNET)
        default FPROTECT_BLOCK_SIZE if SOC_SERIES_NRF91X || SOC_NRF5340_CPUAPP
        default 0x3800 if SOC_NRF5340_CPUNET
-       default 0x9800 if SOC_NRF54L15_CPUAPP
+       default 0x7800 if SOC_NRF54L15_CPUAPP
        default 0x7000 if !B0_MIN_PARTITION_SIZE
        default 0x4000
        help
@@ -103,6 +104,13 @@ config SB_CLEANUP_RAM
        help
          Sets contents of memory to 0 before jumping to application.

nordicjm requested review from a team as code owners November 29, 2024 12:01

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Nov 29, 2024

nordicjm force-pushed the ed25519nsibpr branch from 200e1ca to a07eb95 Compare November 29, 2024 12:09

nordicjm force-pushed the ed25519nsibpr branch 10 times, most recently from 1439d7e to c2812fd Compare December 4, 2024 10:27

nordicjm requested a review from a team as a code owner December 4, 2024 10:27

nordicjm force-pushed the ed25519nsibpr branch 3 times, most recently from c907725 to 4f7f146 Compare December 4, 2024 11:41

nordicjm force-pushed the ed25519nsibpr branch from 4f7f146 to ab149da Compare December 4, 2024 13:08

nordicjm added this to the 3.0.0 milestone Dec 5, 2024

de-nordic reviewed Dec 5, 2024

View reviewed changes

nvlsianpu reviewed Dec 16, 2024

View reviewed changes

nvlsianpu reviewed Dec 17, 2024

View reviewed changes

tejlmand approved these changes Jan 16, 2025

View reviewed changes

nordicjm force-pushed the ed25519nsibpr branch from ab149da to 6b35112 Compare January 20, 2025 16:00

nvlsianpu approved these changes Jan 28, 2025

View reviewed changes

nordicjm added 4 commits February 26, 2025 11:33

bootloader: bl_crypto: Add PSA SHA512 support

4497ae4

Adds support for using SHA512 signatures using PSA crypto Signed-off-by: Jamie McCrae <[email protected]>

bootloader: bl_crypto: Add support for PSA ED25519 signatures

792f708

Adds support for ED25519 signatures using PSA crypto Signed-off-by: Jamie McCrae <[email protected]>

bootloader: bl_validation: Make public key and hash optional

ab772bd

Makes these fields optional for configurations where they are not needed Signed-off-by: Jamie McCrae <[email protected]>

sysbuild: Do not add support for selecting b0 hash/signature types

da138dc

Does not add support for allowing the hash and signature type to be selected, also does not add support for ED25519 on nrf54l15 Signed-off-by: Jamie McCrae <[email protected]>

nordicjm force-pushed the ed25519nsibpr branch from 6b35112 to c60938f Compare February 26, 2025 11:40

nordicjm added the DNM label Feb 26, 2025

nordicjm changed the title ~~bl_*: Add ED25519 support for nRF54L15~~ bl_*: Add ED25519 support Feb 26, 2025

nordicjm added 4 commits February 26, 2025 12:11

include: bl_crypto: Fix wrong order of parameters

47cf047

The parameters listed are wrong Signed-off-by: Jamie McCrae <[email protected]>

fw_info: Fix AT LEAST with underscore

71cf307

Prevents compliance from complaining Signed-off-by: Jamie McCrae <[email protected]>

tests: bootloader: bl_validation: Select Kconfig for sha256

767da74

Selects the Kconfig to enable the hash field be present in the output Signed-off-by: Jamie McCrae <[email protected]>

nordicjm force-pushed the ed25519nsibpr branch 2 times, most recently from 84b4b0b to 7de4594 Compare February 26, 2025 12:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bl_*: Add ED25519 support #19159

bl_*: Add ED25519 support #19159

nordicjm commented Nov 29, 2024 •

edited

Loading

NordicBuilder commented Nov 29, 2024 •

edited

Loading

NordicBuilder commented Nov 29, 2024

NordicBuilder commented Dec 4, 2024 •

edited

Loading

de-nordic Dec 5, 2024

nordicjm Dec 10, 2024

nvlsianpu left a comment

nvlsianpu Dec 3, 2024

nvlsianpu Dec 16, 2024

nordicjm Dec 17, 2024

nvlsianpu Dec 16, 2024

nvlsianpu Dec 17, 2024

nordicjm commented Feb 17, 2025

github-actions bot commented Feb 26, 2025

sonarqubecloud bot commented Feb 26, 2025

nvlsianpu commented Feb 26, 2025

bl_*: Add ED25519 support #19159

Are you sure you want to change the base?

bl_*: Add ED25519 support #19159

Conversation

nordicjm commented Nov 29, 2024 • edited Loading

NordicBuilder commented Nov 29, 2024 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

NordicBuilder commented Nov 29, 2024

NordicBuilder commented Dec 4, 2024 • edited Loading

Memory footprint analysis revealed the following potential issues

de-nordic Dec 5, 2024

Choose a reason for hiding this comment

nordicjm Dec 10, 2024

Choose a reason for hiding this comment

nvlsianpu left a comment

Choose a reason for hiding this comment

nvlsianpu Dec 3, 2024

Choose a reason for hiding this comment

nvlsianpu Dec 16, 2024

Choose a reason for hiding this comment

nordicjm Dec 17, 2024

Choose a reason for hiding this comment

nvlsianpu Dec 16, 2024

Choose a reason for hiding this comment

nvlsianpu Dec 17, 2024

Choose a reason for hiding this comment

nordicjm commented Feb 17, 2025

github-actions bot commented Feb 26, 2025

sonarqubecloud bot commented Feb 26, 2025

Quality Gate passed

nvlsianpu commented Feb 26, 2025

nordicjm commented Nov 29, 2024 •

edited

Loading

NordicBuilder commented Nov 29, 2024 •

edited

Loading

NordicBuilder commented Dec 4, 2024 •

edited

Loading