verify.h

Go to the documentation of this file.

 
#ifndef _VERIFY_H
#define _VERIFY_H
 
// Dependencies
#include "boot_config.h"
#include "core/cboot_error.h"
#include "core/crc32.h"
#include "core/crypto.h"
#include "debug.h"
#include "hash/hash_algorithms.h"
 
// Integrity verification support
#ifndef VERIFY_INTEGRITY_SUPPORT
#define VERIFY_INTEGRITY_SUPPORT ENABLED
#elif (VERIFY_INTEGRITY_SUPPORT != ENABLED && VERIFY_INTEGRITY_SUPPORT != DISABLED)
#error VERIFY_INTEGRITY_SUPPORT parameter is not valid!
#endif
 
// Authentication verification support
#ifndef VERIFY_AUTHENTICATION_SUPPORT
#define VERIFY_AUTHENTICATION_SUPPORT DISABLED
#elif (VERIFY_AUTHENTICATION_SUPPORT != ENABLED && VERIFY_AUTHENTICATION_SUPPORT != DISABLED)
#error VERIFY_INTEGRITY_SUPPORT parameter is not valid!
#endif
 
// Signature verification support
#ifndef VERIFY_SIGNATURE_SUPPORT
#define VERIFY_SIGNATURE_SUPPORT DISABLED
#elif (VERIFY_SIGNATURE_SUPPORT != ENABLED && VERIFY_SIGNATURE_SUPPORT != DISABLED)
#error VERIFY_INTEGRITY_SUPPORT parameter is not valid!
#endif
 
// RSA key support
#ifndef VERIFY_RSA_SUPPORT
#define VERIFY_RSA_SUPPORT DISABLED
#elif (VERIFY_RSA_SUPPORT != ENABLED && VERIFY_RSA_SUPPORT != DISABLED)
#error VERIFY_RSA_SUPPORT parameter is not valid!
#endif
 
// ECDSA key support
#ifndef VERIFY_ECDSA_SUPPORT
#define VERIFY_ECDSA_SUPPORT DISABLED
#elif (VERIFY_ECDSA_SUPPORT != ENABLED && VERIFY_ECDSA_SUPPORT != DISABLED)
#error VERIFY_ECDSA_SUPPORT parameter is not valid!
#endif
 
// Add authentication related dependencies
#if (VERIFY_AUTHENTICATION_SUPPORT == ENABLED)
#include "cipher/cipher_algorithms.h"
#include "mac/mac_algorithms.h"
#endif
 
// Add signature related dependencies
#if (VERIFY_SIGNATURE_SUPPORT == ENABLED)
#if VERIFY_RSA_SUPPORT == ENABLED
#include "pkc/rsa.h"
#endif
#if VERIFY_ECDSA_SUPPORT == ENABLED
#include "ecc/ecdsa.h"
#endif
#include "pkix/pem_import.h"
#include "pkix/pem_key_import.h"
#endif
 
// Maximum check data context size
#if (VERIFY_AUTHENTICATION_SUPPORT == ENABLED)
#define MAX_CHECK_CONTEXT_SIZE sizeof(HmacContext)
#else
#define MAX_CHECK_CONTEXT_SIZE sizeof(HashContext)
#endif
 
// Make sure MAX_HASH_DIGEST_SIZE is always defined.
#ifndef MAX_HASH_DIGEST_SIZE
#if (VERIFY_SIGNATURE_SUPPORT == ENABLED) || (VERIFY_AUTHENTICATION_SUPPORT == ENABLED)
#error A signature/authentication verify method is enabled but no hash algorithm is; enable at least SHA-256 in crypto_config.h
#else
#define MAX_HASH_DIGEST_SIZE CRC32_DIGEST_SIZE
#endif
#endif
 
// Maximum digest size
#define VERIFY_MAX_HASH_DIGEST_SIZE MAX_HASH_DIGEST_SIZE
 
// C++ guard
#ifdef __cplusplus
extern "C"
{
#endif
 
typedef enum
{
   VERIFY_METHOD_INTEGRITY,
   VERIFY_METHOD_AUTHENTICATION,
   VERIFY_METHOD_SIGNATURE
} VerifyMethod;
 
typedef enum
{
   VERIFY_AUTH_NONE,
   VERIFY_AUTH_HMAC
} VerifyAuthAlgo;
 
typedef enum
{
   VERIFY_SIGN_NONE,
   VERIFY_SIGN_RSA,
   VERIFY_SIGN_ECDSA,
} VerifySignAlgo;
 
typedef struct
{
   VerifyMethod verifyMethod;          
#if (VERIFY_INTEGRITY_SUPPORT == ENABLED)
   const HashAlgo *integrityAlgo;      
#endif
#if (VERIFY_AUTHENTICATION_SUPPORT == ENABLED)
   VerifyAuthAlgo authAlgo;           
   const HashAlgo *authHashAlgo;      
   const char_t *authKey;             
   size_t authKeyLen;                 
#endif
#if (VERIFY_SIGNATURE_SUPPORT == ENABLED || BOOT_RUNTIME_SIGNATURE_CHECK_SUPPORT == ENABLED)
   VerifySignAlgo signAlgo;           
   const HashAlgo *signHashAlgo;      
   const char_t *signKey;             
   size_t signKeyLen;                 
#endif
} VerifySettings;
 
typedef struct
{
   VerifySettings verifySettings;      
 
   uint8_t checkContext[MAX_CHECK_CONTEXT_SIZE];      
   size_t checkDataSize;                              
 
   uint8_t imageCheckDigest[MAX_HASH_DIGEST_SIZE];      
   size_t imageCheckDigestSize;                         
} VerifyContext;
 
// CycloneBOOT verification related functions
cboot_error_t verifyInit(VerifyContext *context, VerifySettings *settings);
cboot_error_t verifyProcess(VerifyContext *context, uint8_t *data, size_t length);
cboot_error_t verifyConfirm(VerifyContext *context, uint8_t *verifyData,
   size_t verifyDataLength);
cboot_error_t verifyGenerateCheckData(VerifyContext *context, uint8_t *checkData,
   size_t checkDataSize, size_t *checkDataLength);
 
// C++ guard
#ifdef __cplusplus
}
#endif
#endif // !_CIPHER_H