Skip to content

Commit

Permalink
Switch to using a fixed flash location for wrapped public key, so it …
Browse files Browse the repository at this point in the history
…can be flash on its own.
  • Loading branch information
dgarske committed Jun 28, 2024
1 parent c6308f1 commit ae03ddd
Show file tree
Hide file tree
Showing 5 changed files with 35 additions and 9 deletions.
3 changes: 0 additions & 3 deletions arch.mk
Original file line number Diff line number Diff line change
Expand Up @@ -330,9 +330,6 @@ ifeq ($(ARCH),RENESAS_RX)
./lib/wolfssl/wolfcrypt/src/port/Renesas/renesas_common.o \
./lib/wolfssl/wolfcrypt/src/port/Renesas/renesas_tsip_util.o

# Key Data from Security Key Management Tool (SKMT). See docs/Renesas.md
OBJS+=./include/key_data.o

# RX TSIP uses pre-compiled .a library by default
ifeq ($(RX_TSIP_SRC),)
ifeq ($(BIG_ENDIAN),1)
Expand Down
26 changes: 22 additions & 4 deletions docs/Renesas.md
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ Public key slot: 0
Done.
```

6) Create wrapped public key
6) Create wrapped public key (code files)

Use the Security Key Management Tool (SKMT) command line tool (CLI) to create a wrapped public key.

Expand All @@ -86,11 +86,25 @@ IV: 6C296A040EEF5EDD687E8D3D98D146D0
Encrypted key: 5DD8D7E59E6AC85AE340BBA60AA8F8BE56C4C1FE02340C49EB8F36DA79B8D6640961FE9EAECDD6BADF083C5B6060C1D0309D28EFA25946F431979B9F9D21E77BDC5B1CC7165DE2F4AE51E418746260F518ED0C328BD3020DEC9B774DC00270B0CFBBE3DD738FDF715342CFBF2D461239
```

7) Edit .config `PKA?=1`.
7) Create wrapped public key (flash file)

8) Rebuild wolfBoot. `make clean && make wolfboot.srec`
Generate Motorola HEX file to write wrapped key to flash.

9) Sign application
```
$ C:\Renesas\SecurityKeyManagementTool\cli\skmt.exe -genkey -ufpk file=./sample.key -wufpk file=./sample.key_enc.key -key file=./pub-ecc384.pem -mcu RX-TSIP -keytype secp384r1-public -output pub-ecc384.srec -filetype "mot" -address 0xFFFF0000
```

The generated file is a Motorola HEX (S-Record) formatted image containing the wrapped public key with instructions to use the `0xFFFF0000` address.

The flash memory address `0xFFFF0000` must be set in two places:
a) The `RENESAS_TSIP_INSTALLEDKEY_ADDR` macro in `user_settings.h`
b) The linker script .rot section in `hal/rx72n.ld` or `hal/rx65n.ld`

8) Edit .config `PKA?=1`.

9) Rebuild wolfBoot. `make clean && make wolfboot.srec`

10) Sign application

Sign application using the created private key above `pri-ecc384.der`:

Expand All @@ -110,3 +124,7 @@ Calculating SHA256 digest...
Signing the digest...
Output image(s) successfully created.
```

11) Flash wolfboot.srec, pub-ecc384.srec and signed application binary

Download files to flash using Renesas flash programmer.
6 changes: 6 additions & 0 deletions hal/rx65n.ld
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,12 @@ SECTIONS
KEEP(*(.fvectors))
} = 0x4

.rot 0xFFFF0000 :
{
/* Reserved space for Wrapped Public Key (See docs/Renesas.md) */
KEEP(*(.rot))
} = 0x2000 /* 8KB (min sector size) */

.rvectors ORIGIN(ROM) :
{
_rvectors_start = .;
Expand Down
6 changes: 6 additions & 0 deletions hal/rx72n.ld
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,12 @@ SECTIONS
KEEP(*(.fvectors))
} = 0x4

.rot 0xFFFF0000 :
{
/* Reserved space for Wrapped Public Key (See docs/Renesas.md) */
KEEP(*(.rot))
} = 0x2000 /* 8KB (min sector size) */

.rvectors ORIGIN(ROM) :
{
_rvectors_start = .;
Expand Down
3 changes: 1 addition & 2 deletions include/user_settings.h
Original file line number Diff line number Diff line change
Expand Up @@ -444,8 +444,7 @@ extern int tolower(int c);
#define WOLFSSL_RENESAS_TSIP_CRYPT
#define WOLFSSL_RENESAS_TSIP_CRYPTONLY
#define NO_WOLFSSL_RENESAS_TSIP_CRYPT_HASH
/* from key_data.h */
#define RENESAS_TSIP_INSTALLEDKEY_ADDR (&g_enc_pub_key)
#define RENESAS_TSIP_INSTALLEDKEY_ADDR 0xFFFF0000
#define ENCRYPTED_KEY_BYTE_SIZE ENC_PUB_KEY_SIZE
#define RENESAS_DEVID 7890
#endif
Expand Down

0 comments on commit ae03ddd

Please sign in to comment.