Skip to content

ncsdk-35330 - WIP - experiments #559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

ncsdk-35330 - WIP - experiments #559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cceaba4
WIP - add configs and implementation for ocrypto (nrf_oberon).
adsz-nordic Oct 17, 2025
7f50793
Add the missing parts to make ocrypto_ verification work
adsz-nordic Oct 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 59 additions & 5 deletions boot/bootutil/include/bootutil/crypto/ecdsa.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@
#if (defined(MCUBOOT_USE_TINYCRYPT) + \
defined(MCUBOOT_USE_CC310) + \
defined(MCUBOOT_USE_NRF_EXTERNAL_CRYPTO) + \
defined(MCUBOOT_USE_PSA_OR_MBED_TLS)) != 1
defined(MCUBOOT_USE_PSA_OR_MBED_TLS) + \
defined(MCUBOOT_USE_NRF_OBERON_EXPERIMENT)) != 1
#error "One crypto backend must be defined: either CC310/TINYCRYPT/MBED_TLS/PSA_CRYPTO"
#endif

Expand All @@ -58,8 +59,12 @@
#define MCUBOOT_ECDSA_NEED_ASN1_SIG
#endif /* MCUBOOT_USE_MBED_TLS */

#if defined(MCUBOOT_USE_NRF_OBERON_EXPERIMENT)
#include <ocrypto_ecdsa_p256.h>
#endif /* MCUBOOT_USE_NRF_OBERON_EXPERIMENT */

/*TODO: remove this after cypress port mbedtls to abstract crypto api */
#if defined(MCUBOOT_USE_CC310) || defined(MCUBOOT_USE_MBED_TLS)
#if defined(MCUBOOT_USE_CC310) || defined(MCUBOOT_USE_MBED_TLS) || defined(MCUBOOT_USE_NRF_OBERON_EXPERIMENT)
#define NUM_ECC_BYTES (256 / 8)
#endif

Expand All @@ -83,7 +88,8 @@ extern "C" {
#endif

#if (defined(MCUBOOT_USE_TINYCRYPT) || defined(MCUBOOT_USE_MBED_TLS) || \
defined(MCUBOOT_USE_CC310) || defined(MCUBOOT_USE_NRF_EXTERNAL_CRYPTO)) \
defined(MCUBOOT_USE_CC310) || defined(MCUBOOT_USE_NRF_EXTERNAL_CRYPTO) || \
defined(MCUBOOT_USE_NRF_OBERON_EXPERIMENT)) \
&& !defined(MCUBOOT_USE_PSA_CRYPTO)
/*
* Declaring these like this adds NULL termination.
Expand Down Expand Up @@ -136,7 +142,7 @@ static int bootutil_import_key(uint8_t **cp, uint8_t *end)
}
#endif /* (MCUBOOT_USE_TINYCRYPT || MCUBOOT_USE_MBED_TLS || MCUBOOT_USE_CC310) && !MCUBOOT_USE_PSA_CRYPTO */

#ifndef MCUBOOT_USE_PSA_CRYPTO
#if !defined(MCUBOOT_USE_PSA_CRYPTO)
/*
* cp points to ASN1 string containing an integer.
* Verify the tag, and that the length is 32 bytes. Helper function.
Expand Down Expand Up @@ -186,7 +192,7 @@ static int bootutil_decode_sig(uint8_t signature[NUM_ECC_BYTES * 2], uint8_t *cp
}
return 0;
}
#endif /* !MCUBOOT_USE_PSA_CRYPTO */
#endif /* !defined(MCUBOOT_USE_PSA_CRYPTO) */

#if defined(MCUBOOT_USE_TINYCRYPT)
typedef uintptr_t bootutil_ecdsa_context;
Expand Down Expand Up @@ -719,6 +725,54 @@ static inline int bootutil_ecdsa_parse_public_key(bootutil_ecdsa_context *ctx,
}
#endif /* MCUBOOT_USE_NRF_EXTERNAL_CRYPTO */

#if defined(MCUBOOT_USE_NRF_OBERON_EXPERIMENT)
typedef uintptr_t bootutil_ecdsa_context;

static inline void bootutil_ecdsa_init(bootutil_ecdsa_context *ctx)
{
(void)ctx;
}

static inline void bootutil_ecdsa_drop(bootutil_ecdsa_context *ctx)
{
(void)ctx;
}

static inline int bootutil_ecdsa_verify(bootutil_ecdsa_context *ctx,
uint8_t *pk, size_t pk_len,
uint8_t *hash, size_t hash_len,
uint8_t *sig, size_t sig_len)
{
if (pk == NULL || hash == NULL || sig == NULL) {
return -1;
}

uint8_t signature[2 * NUM_ECC_BYTES];
int rc = bootutil_decode_sig(signature, sig, sig + sig_len);
if (rc) {
return -1;
}

/* Only support uncompressed keys */
if (pk[0] != 0x04) {
return -1;
}
/* Skip the first byte holding key format */
pk++;

rc = ocrypto_ecdsa_p256_verify_hash(signature, hash, pk);
return rc;
}

static inline int bootutil_ecdsa_parse_public_key(bootutil_ecdsa_context *ctx,
uint8_t **cp,uint8_t *end)
{
(void)ctx;
return bootutil_import_key(cp, end);
return 0;
}
#endif /* MCUBOOT_USE_NRF_OBERON_EXPERIMENT */

#ifdef __cplusplus
}
#endif
Expand Down
53 changes: 52 additions & 1 deletion boot/bootutil/include/bootutil/crypto/sha.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,8 @@
#if (defined(MCUBOOT_USE_PSA_OR_MBED_TLS) + \
defined(MCUBOOT_USE_TINYCRYPT) + \
defined(MCUBOOT_USE_NRF_EXTERNAL_CRYPTO) + \
defined(MCUBOOT_USE_CC310)) != 1
defined(MCUBOOT_USE_CC310) + \
defined(MCUBOOT_USE_NRF_OBERON_EXPERIMENT)) != 1
#error "One crypto backend must be defined: either CC310/MBED_TLS/TINYCRYPT/PSA_CRYPTO"
#endif

Expand Down Expand Up @@ -82,6 +83,10 @@
#include <cc310_glue.h>
#endif /* MCUBOOT_USE_CC310 */

#if defined(MCUBOOT_USE_NRF_OBERON_EXPERIMENT)
#include <ocrypto_sha256.h>
#endif /* MCUBOOT_USE_NRF_OBERON_EXPERIMENT */

#include <stdint.h>

#ifdef __cplusplus
Expand Down Expand Up @@ -302,6 +307,52 @@ static inline int bootutil_sha_finish(bootutil_sha_context *ctx,
}
#endif /* MCUBOOT_USE_NRF_EXTERNAL_CRYPTO */

#if defined(MCUBOOT_USE_NRF_OBERON_EXPERIMENT)
typedef ocrypto_sha256_ctx bootutil_sha_context;

static inline int bootutil_sha_init(bootutil_sha_context *ctx)
{
if (ctx == NULL) {
return -1;
}

ocrypto_sha256_init(ctx);
return 0;
}

static inline int bootutil_sha_drop(bootutil_sha_context *ctx)
{
/* NOTE: No corresponding function for ocrypto_sha256 */
(void)ctx;
return 0;
}

static inline int bootutil_sha_update(bootutil_sha_context *ctx,
const void *data,
uint32_t data_len)
{
if (ctx == NULL || data == NULL) {
return -1;
}

ocrypto_sha256_update(ctx, (const uint8_t *)data, (size_t)data_len);

return 0;
}

static inline int bootutil_sha_finish(bootutil_sha_context *ctx,
uint8_t *output)
{
if (ctx == NULL || output == NULL) {
return -1;
}

ocrypto_sha256_final(ctx, output);
return 0;
}

#endif /* MCUBOOT_USE_NRF_OBERON_EXPERIMENT */

#ifdef __cplusplus
}
#endif
Expand Down
5 changes: 5 additions & 0 deletions boot/bootutil/zephyr/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,11 @@ if(CONFIG_BOOT_USE_PSA_CRYPTO)
)
endif()

if(CONFIG_BOOT_USE_NRF_OBERON_EXPERIMENT)
target_include_directories(MCUBOOT_BOOTUTIL INTERFACE ${OBERON_BASE}/include)
zephyr_link_libraries(nrfxlib_crypto)
endif()

if(CONFIG_BOOT_USE_MBEDTLS OR CONFIG_BOOT_USE_PSA_CRYPTO AND NOT CONFIG_NRF_SECURITY)
zephyr_link_libraries(mbedTLS)
endif()
Expand Down
10 changes: 10 additions & 0 deletions boot/zephyr/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,12 @@ config BOOT_USE_CC310
config BOOT_USE_NRF_CC310_BL
bool

config BOOT_USE_NRF_OBERON_EXPERIMENT
bool
default n
help
Use nrf oberon.

config NRFXLIB_CRYPTO
bool

Expand Down Expand Up @@ -286,6 +292,10 @@ choice BOOT_ECDSA_IMPLEMENTATION
default BOOT_ECDSA_PSA if NRF_SECURITY
default BOOT_ECDSA_TINYCRYPT

config BOOT_ECDSA_NRF_OBERON_EXPERIMENT
bool "Use nrf oberon"
select BOOT_USE_NRF_OBERON_EXPERIMENT

config BOOT_ECDSA_TINYCRYPT
bool "Use tinycrypt"
select BOOT_USE_TINYCRYPT
Expand Down
2 changes: 2 additions & 0 deletions boot/zephyr/include/mcuboot_config/mcuboot_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,8 @@
#define MCUBOOT_USE_PSA_CRYPTO
#elif defined(CONFIG_BOOT_USE_NRF_EXTERNAL_CRYPTO)
#define MCUBOOT_USE_NRF_EXTERNAL_CRYPTO
#elif defined(CONFIG_BOOT_USE_NRF_OBERON_EXPERIMENT)
#define MCUBOOT_USE_NRF_OBERON_EXPERIMENT
#endif

#ifdef CONFIG_BOOT_IMG_HASH_ALG_SHA512
Expand Down
Loading