Tom Rini | 10e4779 | 2018-05-06 17:58:06 -0400 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0+ |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 2 | /* |
| 3 | * Copyright (c) 2013, Google Inc. |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 4 | */ |
| 5 | |
Heiko Schocher | d7b4232 | 2014-03-03 12:19:30 +0100 | [diff] [blame] | 6 | #ifndef USE_HOSTCC |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 7 | #include <common.h> |
| 8 | #include <fdtdec.h> |
Heiko Schocher | d7b4232 | 2014-03-03 12:19:30 +0100 | [diff] [blame] | 9 | #include <asm/types.h> |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 10 | #include <asm/byteorder.h> |
Masahiro Yamada | 56a931c | 2016-09-21 11:28:55 +0900 | [diff] [blame] | 11 | #include <linux/errno.h> |
Heiko Schocher | d7b4232 | 2014-03-03 12:19:30 +0100 | [diff] [blame] | 12 | #include <asm/types.h> |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 13 | #include <asm/unaligned.h> |
Ruchika Gupta | a0d3ca6 | 2015-01-23 16:01:54 +0530 | [diff] [blame] | 14 | #include <dm.h> |
Heiko Schocher | d7b4232 | 2014-03-03 12:19:30 +0100 | [diff] [blame] | 15 | #else |
| 16 | #include "fdt_host.h" |
| 17 | #include "mkimage.h" |
| 18 | #include <fdt_support.h> |
| 19 | #endif |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 20 | #include <u-boot/rsa-mod-exp.h> |
Jeroen Hofstee | bfe88fe | 2014-06-12 22:27:12 +0200 | [diff] [blame] | 21 | #include <u-boot/rsa.h> |
Heiko Schocher | d7b4232 | 2014-03-03 12:19:30 +0100 | [diff] [blame] | 22 | |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 23 | /* Default public exponent for backward compatibility */ |
| 24 | #define RSA_DEFAULT_PUBEXP 65537 |
| 25 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 26 | /** |
Andrew Duda | 3db9ff0 | 2016-11-08 18:53:40 +0000 | [diff] [blame] | 27 | * rsa_verify_padding() - Verify RSA message padding is valid |
| 28 | * |
| 29 | * Verify a RSA message's padding is consistent with PKCS1.5 |
| 30 | * padding as described in the RSA PKCS#1 v2.1 standard. |
| 31 | * |
| 32 | * @msg: Padded message |
| 33 | * @pad_len: Number of expected padding bytes |
| 34 | * @algo: Checksum algo structure having information on DER encoding etc. |
| 35 | * @return 0 on success, != 0 on failure |
| 36 | */ |
| 37 | static int rsa_verify_padding(const uint8_t *msg, const int pad_len, |
| 38 | struct checksum_algo *algo) |
| 39 | { |
| 40 | int ff_len; |
| 41 | int ret; |
| 42 | |
| 43 | /* first byte must be 0x00 */ |
| 44 | ret = *msg++; |
| 45 | /* second byte must be 0x01 */ |
| 46 | ret |= *msg++ ^ 0x01; |
| 47 | /* next ff_len bytes must be 0xff */ |
| 48 | ff_len = pad_len - algo->der_len - 3; |
| 49 | ret |= *msg ^ 0xff; |
| 50 | ret |= memcmp(msg, msg+1, ff_len-1); |
| 51 | msg += ff_len; |
| 52 | /* next byte must be 0x00 */ |
| 53 | ret |= *msg++; |
| 54 | /* next der_len bytes must match der_prefix */ |
| 55 | ret |= memcmp(msg, algo->der_prefix, algo->der_len); |
| 56 | |
| 57 | return ret; |
| 58 | } |
| 59 | |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 60 | int padding_pkcs_15_verify(struct image_sign_info *info, |
| 61 | uint8_t *msg, int msg_len, |
| 62 | const uint8_t *hash, int hash_len) |
| 63 | { |
| 64 | struct checksum_algo *checksum = info->checksum; |
| 65 | int ret, pad_len = msg_len - checksum->checksum_len; |
| 66 | |
| 67 | /* Check pkcs1.5 padding bytes. */ |
| 68 | ret = rsa_verify_padding(msg, pad_len, checksum); |
| 69 | if (ret) { |
| 70 | debug("In RSAVerify(): Padding check failed!\n"); |
| 71 | return -EINVAL; |
| 72 | } |
| 73 | |
| 74 | /* Check hash. */ |
| 75 | if (memcmp((uint8_t *)msg + pad_len, hash, msg_len - pad_len)) { |
| 76 | debug("In RSAVerify(): Hash check failed!\n"); |
| 77 | return -EACCES; |
| 78 | } |
| 79 | |
| 80 | return 0; |
| 81 | } |
| 82 | |
Philippe Reynes | 47d73f0 | 2018-11-14 13:51:01 +0100 | [diff] [blame^] | 83 | #ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT |
| 84 | static void u32_i2osp(uint32_t val, uint8_t *buf) |
| 85 | { |
| 86 | buf[0] = (uint8_t)((val >> 24) & 0xff); |
| 87 | buf[1] = (uint8_t)((val >> 16) & 0xff); |
| 88 | buf[2] = (uint8_t)((val >> 8) & 0xff); |
| 89 | buf[3] = (uint8_t)((val >> 0) & 0xff); |
| 90 | } |
| 91 | |
| 92 | /** |
| 93 | * mask_generation_function1() - generate an octet string |
| 94 | * |
| 95 | * Generate an octet string used to check rsa signature. |
| 96 | * It use an input octet string and a hash function. |
| 97 | * |
| 98 | * @checksum: A Hash function |
| 99 | * @seed: Specifies an input variable octet string |
| 100 | * @seed_len: Size of the input octet string |
| 101 | * @output: Specifies the output octet string |
| 102 | * @output_len: Size of the output octet string |
| 103 | * @return 0 if the octet string was correctly generated, others on error |
| 104 | */ |
| 105 | static int mask_generation_function1(struct checksum_algo *checksum, |
| 106 | uint8_t *seed, int seed_len, |
| 107 | uint8_t *output, int output_len) |
| 108 | { |
| 109 | struct image_region region[2]; |
| 110 | int ret = 0, i, i_output = 0, region_count = 2; |
| 111 | uint32_t counter = 0; |
| 112 | uint8_t buf_counter[4], *tmp; |
| 113 | int hash_len = checksum->checksum_len; |
| 114 | |
| 115 | memset(output, 0, output_len); |
| 116 | |
| 117 | region[0].data = seed; |
| 118 | region[0].size = seed_len; |
| 119 | region[1].data = &buf_counter[0]; |
| 120 | region[1].size = 4; |
| 121 | |
| 122 | tmp = malloc(hash_len); |
| 123 | if (!tmp) { |
| 124 | debug("%s: can't allocate array tmp\n", __func__); |
| 125 | ret = -ENOMEM; |
| 126 | goto out; |
| 127 | } |
| 128 | |
| 129 | while (i_output < output_len) { |
| 130 | u32_i2osp(counter, &buf_counter[0]); |
| 131 | |
| 132 | ret = checksum->calculate(checksum->name, |
| 133 | region, region_count, |
| 134 | tmp); |
| 135 | if (ret < 0) { |
| 136 | debug("%s: Error in checksum calculation\n", __func__); |
| 137 | goto out; |
| 138 | } |
| 139 | |
| 140 | i = 0; |
| 141 | while ((i_output < output_len) && (i < hash_len)) { |
| 142 | output[i_output] = tmp[i]; |
| 143 | i_output++; |
| 144 | i++; |
| 145 | } |
| 146 | |
| 147 | counter++; |
| 148 | } |
| 149 | |
| 150 | out: |
| 151 | free(tmp); |
| 152 | |
| 153 | return ret; |
| 154 | } |
| 155 | |
| 156 | static int compute_hash_prime(struct checksum_algo *checksum, |
| 157 | uint8_t *pad, int pad_len, |
| 158 | uint8_t *hash, int hash_len, |
| 159 | uint8_t *salt, int salt_len, |
| 160 | uint8_t *hprime) |
| 161 | { |
| 162 | struct image_region region[3]; |
| 163 | int ret, region_count = 3; |
| 164 | |
| 165 | region[0].data = pad; |
| 166 | region[0].size = pad_len; |
| 167 | region[1].data = hash; |
| 168 | region[1].size = hash_len; |
| 169 | region[2].data = salt; |
| 170 | region[2].size = salt_len; |
| 171 | |
| 172 | ret = checksum->calculate(checksum->name, region, region_count, hprime); |
| 173 | if (ret < 0) { |
| 174 | debug("%s: Error in checksum calculation\n", __func__); |
| 175 | goto out; |
| 176 | } |
| 177 | |
| 178 | out: |
| 179 | return ret; |
| 180 | } |
| 181 | |
| 182 | int padding_pss_verify(struct image_sign_info *info, |
| 183 | uint8_t *msg, int msg_len, |
| 184 | const uint8_t *hash, int hash_len) |
| 185 | { |
| 186 | uint8_t *masked_db = NULL; |
| 187 | int masked_db_len = msg_len - hash_len - 1; |
| 188 | uint8_t *h = NULL, *hprime = NULL; |
| 189 | int h_len = hash_len; |
| 190 | uint8_t *db_mask = NULL; |
| 191 | int db_mask_len = masked_db_len; |
| 192 | uint8_t *db = NULL, *salt = NULL; |
| 193 | int db_len = masked_db_len, salt_len = msg_len - hash_len - 2; |
| 194 | uint8_t pad_zero[8] = { 0 }; |
| 195 | int ret, i, leftmost_bits = 1; |
| 196 | uint8_t leftmost_mask; |
| 197 | struct checksum_algo *checksum = info->checksum; |
| 198 | |
| 199 | /* first, allocate everything */ |
| 200 | masked_db = malloc(masked_db_len); |
| 201 | h = malloc(h_len); |
| 202 | db_mask = malloc(db_mask_len); |
| 203 | db = malloc(db_len); |
| 204 | salt = malloc(salt_len); |
| 205 | hprime = malloc(hash_len); |
| 206 | if (!masked_db || !h || !db_mask || !db || !salt || !hprime) { |
| 207 | printf("%s: can't allocate some buffer\n", __func__); |
| 208 | ret = -ENOMEM; |
| 209 | goto out; |
| 210 | } |
| 211 | |
| 212 | /* step 4: check if the last byte is 0xbc */ |
| 213 | if (msg[msg_len - 1] != 0xbc) { |
| 214 | printf("%s: invalid pss padding (0xbc is missing)\n", __func__); |
| 215 | ret = -EINVAL; |
| 216 | goto out; |
| 217 | } |
| 218 | |
| 219 | /* step 5 */ |
| 220 | memcpy(masked_db, msg, masked_db_len); |
| 221 | memcpy(h, msg + masked_db_len, h_len); |
| 222 | |
| 223 | /* step 6 */ |
| 224 | leftmost_mask = (0xff >> (8 - leftmost_bits)) << (8 - leftmost_bits); |
| 225 | if (masked_db[0] & leftmost_mask) { |
| 226 | printf("%s: invalid pss padding ", __func__); |
| 227 | printf("(leftmost bit of maskedDB not zero)\n"); |
| 228 | ret = -EINVAL; |
| 229 | goto out; |
| 230 | } |
| 231 | |
| 232 | /* step 7 */ |
| 233 | mask_generation_function1(checksum, h, h_len, db_mask, db_mask_len); |
| 234 | |
| 235 | /* step 8 */ |
| 236 | for (i = 0; i < db_len; i++) |
| 237 | db[i] = masked_db[i] ^ db_mask[i]; |
| 238 | |
| 239 | /* step 9 */ |
| 240 | db[0] &= 0xff >> leftmost_bits; |
| 241 | |
| 242 | /* step 10 */ |
| 243 | if (db[0] != 0x01) { |
| 244 | printf("%s: invalid pss padding ", __func__); |
| 245 | printf("(leftmost byte of db isn't 0x01)\n"); |
| 246 | ret = EINVAL; |
| 247 | goto out; |
| 248 | } |
| 249 | |
| 250 | /* step 11 */ |
| 251 | memcpy(salt, &db[1], salt_len); |
| 252 | |
| 253 | /* step 12 & 13 */ |
| 254 | compute_hash_prime(checksum, pad_zero, 8, |
| 255 | (uint8_t *)hash, hash_len, |
| 256 | salt, salt_len, hprime); |
| 257 | |
| 258 | /* step 14 */ |
| 259 | ret = memcmp(h, hprime, hash_len); |
| 260 | |
| 261 | out: |
| 262 | free(hprime); |
| 263 | free(salt); |
| 264 | free(db); |
| 265 | free(db_mask); |
| 266 | free(h); |
| 267 | free(masked_db); |
| 268 | |
| 269 | return ret; |
| 270 | } |
| 271 | #endif |
| 272 | |
Andrew Duda | 3db9ff0 | 2016-11-08 18:53:40 +0000 | [diff] [blame] | 273 | /** |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 274 | * rsa_verify_key() - Verify a signature against some data using RSA Key |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 275 | * |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 276 | * Verify a RSA PKCS1.5 signature against an expected hash using |
| 277 | * the RSA Key properties in prop structure. |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 278 | * |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 279 | * @info: Specifies key and FIT information |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 280 | * @prop: Specifies key |
| 281 | * @sig: Signature |
| 282 | * @sig_len: Number of bytes in signature |
| 283 | * @hash: Pointer to the expected hash |
Andrew Duda | 06ca6d6 | 2016-11-08 18:53:41 +0000 | [diff] [blame] | 284 | * @key_len: Number of bytes in rsa key |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 285 | * @return 0 if verified, -ve on error |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 286 | */ |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 287 | static int rsa_verify_key(struct image_sign_info *info, |
| 288 | struct key_prop *prop, const uint8_t *sig, |
Heiko Schocher | edaf9b1 | 2014-03-03 12:19:26 +0100 | [diff] [blame] | 289 | const uint32_t sig_len, const uint8_t *hash, |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 290 | const uint32_t key_len) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 291 | { |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 292 | int ret; |
Ruchika Gupta | a0d3ca6 | 2015-01-23 16:01:54 +0530 | [diff] [blame] | 293 | #if !defined(USE_HOSTCC) |
| 294 | struct udevice *mod_exp_dev; |
| 295 | #endif |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 296 | struct checksum_algo *checksum = info->checksum; |
| 297 | struct padding_algo *padding = info->padding; |
| 298 | int hash_len = checksum->checksum_len; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 299 | |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 300 | if (!prop || !sig || !hash || !checksum) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 301 | return -EIO; |
| 302 | |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 303 | if (sig_len != (prop->num_bits / 8)) { |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 304 | debug("Signature is of incorrect length %d\n", sig_len); |
| 305 | return -EINVAL; |
| 306 | } |
| 307 | |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 308 | debug("Checksum algorithm: %s", checksum->name); |
Heiko Schocher | edaf9b1 | 2014-03-03 12:19:26 +0100 | [diff] [blame] | 309 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 310 | /* Sanity check for stack size */ |
| 311 | if (sig_len > RSA_MAX_SIG_BITS / 8) { |
| 312 | debug("Signature length %u exceeds maximum %d\n", sig_len, |
| 313 | RSA_MAX_SIG_BITS / 8); |
| 314 | return -EINVAL; |
| 315 | } |
| 316 | |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 317 | uint8_t buf[sig_len]; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 318 | |
Ruchika Gupta | a0d3ca6 | 2015-01-23 16:01:54 +0530 | [diff] [blame] | 319 | #if !defined(USE_HOSTCC) |
| 320 | ret = uclass_get_device(UCLASS_MOD_EXP, 0, &mod_exp_dev); |
| 321 | if (ret) { |
| 322 | printf("RSA: Can't find Modular Exp implementation\n"); |
| 323 | return -EINVAL; |
| 324 | } |
| 325 | |
| 326 | ret = rsa_mod_exp(mod_exp_dev, sig, sig_len, prop, buf); |
| 327 | #else |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 328 | ret = rsa_mod_exp_sw(sig, sig_len, prop, buf); |
Ruchika Gupta | a0d3ca6 | 2015-01-23 16:01:54 +0530 | [diff] [blame] | 329 | #endif |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 330 | if (ret) { |
| 331 | debug("Error in Modular exponentation\n"); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 332 | return ret; |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 333 | } |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 334 | |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 335 | ret = padding->verify(info, buf, key_len, hash, hash_len); |
Andrew Duda | 3db9ff0 | 2016-11-08 18:53:40 +0000 | [diff] [blame] | 336 | if (ret) { |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 337 | debug("In RSAVerify(): padding check failed!\n"); |
| 338 | return ret; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 339 | } |
| 340 | |
| 341 | return 0; |
| 342 | } |
| 343 | |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 344 | /** |
| 345 | * rsa_verify_with_keynode() - Verify a signature against some data using |
| 346 | * information in node with prperties of RSA Key like modulus, exponent etc. |
| 347 | * |
| 348 | * Parse sign-node and fill a key_prop structure with properties of the |
| 349 | * key. Verify a RSA PKCS1.5 signature against an expected hash using |
| 350 | * the properties parsed |
| 351 | * |
| 352 | * @info: Specifies key and FIT information |
| 353 | * @hash: Pointer to the expected hash |
| 354 | * @sig: Signature |
| 355 | * @sig_len: Number of bytes in signature |
| 356 | * @node: Node having the RSA Key properties |
| 357 | * @return 0 if verified, -ve on error |
| 358 | */ |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 359 | static int rsa_verify_with_keynode(struct image_sign_info *info, |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 360 | const void *hash, uint8_t *sig, |
| 361 | uint sig_len, int node) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 362 | { |
| 363 | const void *blob = info->fdt_blob; |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 364 | struct key_prop prop; |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 365 | int length; |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 366 | int ret = 0; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 367 | |
| 368 | if (node < 0) { |
| 369 | debug("%s: Skipping invalid node", __func__); |
| 370 | return -EBADF; |
| 371 | } |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 372 | |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 373 | prop.num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 374 | |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 375 | prop.n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 376 | |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 377 | prop.public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length); |
| 378 | if (!prop.public_exponent || length < sizeof(uint64_t)) |
| 379 | prop.public_exponent = NULL; |
| 380 | |
| 381 | prop.exp_len = sizeof(uint64_t); |
| 382 | |
| 383 | prop.modulus = fdt_getprop(blob, node, "rsa,modulus", NULL); |
| 384 | |
| 385 | prop.rr = fdt_getprop(blob, node, "rsa,r-squared", NULL); |
| 386 | |
| 387 | if (!prop.num_bits || !prop.modulus) { |
| 388 | debug("%s: Missing RSA key info", __func__); |
| 389 | return -EFAULT; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 390 | } |
| 391 | |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 392 | ret = rsa_verify_key(info, &prop, sig, sig_len, hash, |
| 393 | info->crypto->key_len); |
Ruchika Gupta | b92ebab | 2015-01-23 16:01:50 +0530 | [diff] [blame] | 394 | |
| 395 | return ret; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 396 | } |
| 397 | |
| 398 | int rsa_verify(struct image_sign_info *info, |
| 399 | const struct image_region region[], int region_count, |
| 400 | uint8_t *sig, uint sig_len) |
| 401 | { |
| 402 | const void *blob = info->fdt_blob; |
Heiko Schocher | edaf9b1 | 2014-03-03 12:19:26 +0100 | [diff] [blame] | 403 | /* Reserve memory for maximum checksum-length */ |
Andrew Duda | 6616c82 | 2016-11-08 18:53:41 +0000 | [diff] [blame] | 404 | uint8_t hash[info->crypto->key_len]; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 405 | int ndepth, noffset; |
| 406 | int sig_node, node; |
| 407 | char name[100]; |
Heiko Schocher | edaf9b1 | 2014-03-03 12:19:26 +0100 | [diff] [blame] | 408 | int ret; |
| 409 | |
| 410 | /* |
| 411 | * Verify that the checksum-length does not exceed the |
| 412 | * rsa-signature-length |
| 413 | */ |
Andrew Duda | 6616c82 | 2016-11-08 18:53:41 +0000 | [diff] [blame] | 414 | if (info->checksum->checksum_len > |
| 415 | info->crypto->key_len) { |
Heiko Schocher | 4b81756 | 2014-03-03 12:19:27 +0100 | [diff] [blame] | 416 | debug("%s: invlaid checksum-algorithm %s for %s\n", |
Andrew Duda | 6616c82 | 2016-11-08 18:53:41 +0000 | [diff] [blame] | 417 | __func__, info->checksum->name, info->crypto->name); |
Heiko Schocher | edaf9b1 | 2014-03-03 12:19:26 +0100 | [diff] [blame] | 418 | return -EINVAL; |
| 419 | } |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 420 | |
| 421 | sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME); |
| 422 | if (sig_node < 0) { |
| 423 | debug("%s: No signature node found\n", __func__); |
| 424 | return -ENOENT; |
| 425 | } |
| 426 | |
Heiko Schocher | edaf9b1 | 2014-03-03 12:19:26 +0100 | [diff] [blame] | 427 | /* Calculate checksum with checksum-algorithm */ |
Andrew Duda | 6616c82 | 2016-11-08 18:53:41 +0000 | [diff] [blame] | 428 | ret = info->checksum->calculate(info->checksum->name, |
Ruchika Gupta | 2c8987f | 2015-01-23 16:01:59 +0530 | [diff] [blame] | 429 | region, region_count, hash); |
| 430 | if (ret < 0) { |
| 431 | debug("%s: Error in checksum calculation\n", __func__); |
| 432 | return -EINVAL; |
| 433 | } |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 434 | |
| 435 | /* See if we must use a particular key */ |
| 436 | if (info->required_keynode != -1) { |
| 437 | ret = rsa_verify_with_keynode(info, hash, sig, sig_len, |
| 438 | info->required_keynode); |
| 439 | if (!ret) |
| 440 | return ret; |
| 441 | } |
| 442 | |
| 443 | /* Look for a key that matches our hint */ |
| 444 | snprintf(name, sizeof(name), "key-%s", info->keyname); |
| 445 | node = fdt_subnode_offset(blob, sig_node, name); |
| 446 | ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node); |
| 447 | if (!ret) |
| 448 | return ret; |
| 449 | |
| 450 | /* No luck, so try each of the keys in turn */ |
| 451 | for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, &ndepth); |
| 452 | (noffset >= 0) && (ndepth > 0); |
| 453 | noffset = fdt_next_node(info->fit, noffset, &ndepth)) { |
| 454 | if (ndepth == 1 && noffset != node) { |
| 455 | ret = rsa_verify_with_keynode(info, hash, sig, sig_len, |
| 456 | noffset); |
| 457 | if (!ret) |
| 458 | break; |
| 459 | } |
| 460 | } |
| 461 | |
| 462 | return ret; |
| 463 | } |