Skip to content

Commit

Permalink
[nrf noup] boot: bootutil: Add required signature decoding
Browse files Browse the repository at this point in the history
The CC310 and bl_crypto require decoded signature instead of raw ASN.1

Signed-off-by: Dominik Ermel <dominik.ermel@nordicsemi.no>
  • Loading branch information
de-nordic authored and tejlmand committed May 3, 2023
1 parent c457401 commit 51afa7a
Showing 1 changed file with 11 additions and 3 deletions.
14 changes: 11 additions & 3 deletions boot/bootutil/include/bootutil/crypto/ecdsa_p256.h
Original file line number Diff line number Diff line change
Expand Up @@ -225,16 +225,20 @@ static inline int bootutil_ecdsa_p256_verify(bootutil_ecdsa_p256_context *ctx,
{
(void)ctx;
(void)pk_len;
(void)sig_len;
(void)hash_len;
uint8_t dsig[2 * NUM_ECC_BYTES];

if (bootutil_decode_sig(dsig, sig, sig + sig_len)) {
return -1;
}

/* Only support uncompressed keys. */
if (pk[0] != 0x04) {
return -1;
}
pk++;

return cc310_ecdsa_verify_secp256r1(hash, pk, sig, BOOTUTIL_CRYPTO_ECDSA_P256_HASH_SIZE);
return cc310_ecdsa_verify_secp256r1(hash, pk, dsig, BOOTUTIL_CRYPTO_ECDSA_P256_HASH_SIZE);
}

static inline int bootutil_ecdsa_p256_parse_public_key(bootutil_ecdsa_p256_context *ctx,
Expand Down Expand Up @@ -398,7 +402,11 @@ static inline int bootutil_ecdsa_p256_verify(bootutil_ecdsa_p256_context *ctx,
{
(void)ctx;
(void)pk_len;
(void)sig_len;
uint8_t dsig[2 * NUM_ECC_BYTES];

if (bootutil_decode_sig(dsig, sig, sig + sig_len)) {
return -1;
}

/* As described on the compact representation in IETF protocols,
* the first byte of the key defines if the ECC points are
Expand Down

0 comments on commit 51afa7a

Please sign in to comment.