eaw/esp-idf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bootloader: Add fault injection resistance to Secure Boot bootloader verification

Browse Source
This commit is contained in:
Sachin Parekh
2021-03-25 12:48:27 +05:30
parent 08ce445ab6
commit 3c7f439d5b
14 changed files with 580 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
components/bootloader_support/include/esp_secure_boot.h
View File

@@ -123,6 +123,19 @@ typedef struct {
esp_err_t esp_secure_boot_verify_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest);
/** @brief Verify the ECDSA secure boot signature block for Secure Boot.
*
* Calculates Deterministic ECDSA w/ SHA256 based on the SHA256 hash of the image. ECDSA signature
* verification must be enabled in project configuration to use this function.
*
* Similar to esp_secure_boot_verify_signature(), but can be used when the digest is precalculated.
* @param sig_block Pointer to ECDSA signature block data
* @param image_digest Pointer to 32 byte buffer holding SHA-256 hash.
* @param verified_digest Pointer to 32 byte buffer that will receive verified digest if verification completes. (Used during bootloader implementation only, result is invalid otherwise.)
*
*/
esp_err_t esp_secure_boot_verify_ecdsa_signature_block(const esp_secure_boot_sig_block_t *sig_block, const uint8_t *image_digest, uint8_t *verified_digest);
#define FLASH_OFFS_SECURE_BOOT_IV_DIGEST 0
/** @brief Secure boot IV+digest header */