Skip to content

Commit 3215d92

Browse files
cfrantzpamaury
cfrantz
authored and
pamaury
committed
[hsmtool] Add tests
1. Add tests that check that signatures generated with opentitantool can be verified by hsmtool. 2. Add tests that check that signatures generated with hsmtool can be verified by opentitantool. 3. Verify the correctness of the manifest digest calculcated by opentitantool. Signed-off-by: Chris Frantz <[email protected]> (cherry picked from commit 12467bb)
1 parent 874017d commit 3215d92

16 files changed

+424
-1
lines changed

‎signing/softhsm/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,22 @@ softhsm2-util --init-token --label fake_keys --so-pin officer_pin --pin 123456 -
1111
```
1212

1313
Where `softhsm-util` is one of the binaries emitted by the `@softhsm2//:softhsm2` target.
14+
15+
## Keys
16+
17+
The softhsm instance contains a few keys needed for testing. These were
18+
imported with hsmtool.
19+
20+
```
21+
export HSMTOOL_MODULE=bazel-out/k8-fastbuild/bin/external/softhsm2/softhsm2/lib/softhsm/libsofthsm2.so
22+
export HSMTOOL_SPX_MODULE=pkcs11-ef
23+
export SOFTHSM2_CONF=signing/softhsm/softhsm.conf
24+
25+
hsmtool -t fake_keys -u user -p 123456 \
26+
ecdsa import --label fake_app_prod_ecdsa \
27+
sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_ecdsa_p256.der
28+
29+
hsmtool -t fake_keys -u user -p 123456 \
30+
spx import --label fake_app_prod_spx \
31+
sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_spx.pem
32+
```

‎signing/softhsm/tokens/1fb9bf0b-6f47-74b5-05b9-e1ccf1488ff0/30272913-d12b-af71-8cc9-c2686e538e23.lock‎

Whitespace-only changes.

‎signing/softhsm/tokens/1fb9bf0b-6f47-74b5-05b9-e1ccf1488ff0/30272913-d12b-af71-8cc9-c2686e538e23.object‎

517 Bytes
Binary file not shown.

‎signing/softhsm/tokens/1fb9bf0b-6f47-74b5-05b9-e1ccf1488ff0/71c8ac67-2b1f-7107-25d9-b3e9e4f1db9e.lock‎

Whitespace-only changes.

‎signing/softhsm/tokens/1fb9bf0b-6f47-74b5-05b9-e1ccf1488ff0/71c8ac67-2b1f-7107-25d9-b3e9e4f1db9e.object‎

785 Bytes
Binary file not shown.

‎signing/softhsm/tokens/1fb9bf0b-6f47-74b5-05b9-e1ccf1488ff0/73153cc5-c025-2ee0-c7f7-24ba6ba1361a.lock‎

Whitespace-only changes.

‎signing/softhsm/tokens/1fb9bf0b-6f47-74b5-05b9-e1ccf1488ff0/73153cc5-c025-2ee0-c7f7-24ba6ba1361a.object‎

628 Bytes
Binary file not shown.

‎signing/softhsm/tokens/1fb9bf0b-6f47-74b5-05b9-e1ccf1488ff0/token.object‎

0 Bytes
Binary file not shown.

‎sw/device/silicon_creator/lib/ownership/keys/fake/BUILD‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,16 @@ filegroup(
8080
srcs = ["app_dev_ecdsa_p256.pub.der"],
8181
)
8282

83+
filegroup(
84+
name = "app_spx_prod",
85+
srcs = ["app_prod_spx.pem"],
86+
)
87+
88+
filegroup(
89+
name = "app_spx_prod_pub",
90+
srcs = ["app_prod_spx.pub.pem"],
91+
)
92+
8393
key_ecdsa(
8494
name = "app_prod_ecdsa",
8595
method = "local",

‎sw/host/hsmtool/tests/BUILD‎

Lines changed: 321 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@
44

55
package(default_visibility = ["//visibility:public"])
66

7+
sh_library(
8+
name = "test_lib",
9+
srcs = ["test_lib.sh"],
10+
)
11+
712
sh_test(
813
name = "token_exists_test",
914
srcs = ["hsmtool_runner.sh"],
@@ -23,3 +28,319 @@ sh_test(
2328
"SOFTHSM2_CONF": "$(rootpath //signing/softhsm:conf)",
2429
},
2530
)
31+
32+
genrule(
33+
name = "tqbf_digest",
34+
srcs = ["tqbf.txt"],
35+
outs = ["tqbf.digest"],
36+
cmd = """
37+
sha256sum $< | cut -f1 -d' ' | tr '[:lower:]' '[:upper:]' | basenc -d --base16 > $@
38+
""",
39+
)
40+
41+
# ECDSA-Sign a digest with opentitantool and then verify the signature with hsmtool.
42+
sh_test(
43+
name = "ecdsa_opentitantool_sign_hsmtool_verify_test",
44+
srcs = ["ot_hsm_runner.sh"],
45+
data = [
46+
":tqbf_digest",
47+
"//signing/softhsm",
48+
"//signing/softhsm:conf",
49+
"//sw/device/silicon_creator/lib/ownership/keys/fake:app_ecdsa_prod",
50+
"//sw/host/hsmtool",
51+
"//sw/host/opentitantool",
52+
"@softhsm2//:gen_dir",
53+
],
54+
env = {
55+
"SOFTHSM2_CONF": "$(rootpath //signing/softhsm:conf)",
56+
"FIRST": "opentitantool",
57+
"OTTOOL_ARGS": """
58+
--rcfile=
59+
ecdsa sign
60+
sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_ecdsa_p256.der
61+
--input=$(rootpath :tqbf_digest)
62+
--output=tqbf.ecdsa_sig
63+
""",
64+
"HSMTOOL_MODULE": "$(rootpath @softhsm2//:gen_dir)/lib/softhsm/libsofthsm2.so",
65+
"HSMTOOL_ARGS": """
66+
-t fake_keys -u user -p 123456
67+
ecdsa verify
68+
--little-endian
69+
--label=fake_app_prod_ecdsa
70+
$(rootpath :tqbf_digest)
71+
tqbf.ecdsa_sig
72+
""",
73+
},
74+
deps = [":test_lib"],
75+
)
76+
77+
# ECDSA-Sign a digest with hsmtool and then verify the signature with opentitantool.
78+
sh_test(
79+
name = "ecdsa_hsmtool_sign_opentitantool_verify_test",
80+
srcs = ["ot_hsm_runner.sh"],
81+
data = [
82+
"tqbf.txt",
83+
":tqbf_digest",
84+
"//signing/softhsm",
85+
"//signing/softhsm:conf",
86+
"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa_pub",
87+
"//sw/host/hsmtool",
88+
"//sw/host/opentitantool",
89+
"@softhsm2//:gen_dir",
90+
],
91+
env = {
92+
"SOFTHSM2_CONF": "$(rootpath //signing/softhsm:conf)",
93+
"FIRST": "hsmtool",
94+
"OTTOOL_ARGS": """
95+
--rcfile=
96+
ecdsa verify
97+
--digest-file=$(rootpath :tqbf_digest)
98+
--signature-file=tqbf.ecdsa_sig
99+
sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_ecdsa_p256.pub.der
100+
""",
101+
"HSMTOOL_MODULE": "$(rootpath @softhsm2//:gen_dir)/lib/softhsm/libsofthsm2.so",
102+
# This hsmtool invocation computes the digest from the plain-text `tqbf.txt` input file.
103+
"HSMTOOL_ARGS": """
104+
-t fake_keys -u user -p 123456
105+
ecdsa sign
106+
--little-endian
107+
--format=plain-text
108+
--label=fake_app_prod_ecdsa
109+
--output=tqbf.ecdsa_sig
110+
sw/host/hsmtool/tests/tqbf.txt
111+
""",
112+
},
113+
deps = [":test_lib"],
114+
)
115+
116+
_SPX_TESTS = {
117+
"pure": {
118+
"domain": "Pure",
119+
"format": "plain-text",
120+
"rev_flag": "--spx-hash-reversal-bug=false",
121+
},
122+
"prehashed": {
123+
"domain": "PreHashedSha256",
124+
"format": "sha256-hash",
125+
"rev_flag": "--spx-hash-reversal-bug=false",
126+
},
127+
"hashreversed": {
128+
"domain": "PreHashedSha256",
129+
"format": "sha256-hash-reversed",
130+
"rev_flag": "--spx-hash-reversal-bug=true",
131+
},
132+
}
133+
134+
# SPHINCS+-Sign a digest with opentitantool and then verify the signature with hsmtool.
135+
[
136+
sh_test(
137+
name = "spx_{}_opentitantool_sign_hsmtool_verify_test".format(name),
138+
srcs = ["ot_hsm_runner.sh"],
139+
data = [
140+
":tqbf_digest",
141+
"//signing/softhsm",
142+
"//signing/softhsm:conf",
143+
"//sw/device/silicon_creator/lib/ownership/keys/fake:app_spx_prod",
144+
"//sw/host/hsmtool",
145+
"//sw/host/opentitantool",
146+
"@softhsm2//:gen_dir",
147+
],
148+
env = {
149+
"SOFTHSM2_CONF": "$(rootpath //signing/softhsm:conf)",
150+
"FIRST": "opentitantool",
151+
"OTTOOL_ARGS": """
152+
--rcfile=
153+
spx sign {rev_flag}
154+
--domain={domain}
155+
$(rootpath :tqbf_digest)
156+
sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_spx.pem
157+
--output=tqbf.spx_sig
158+
""".format(
159+
domain = param["domain"],
160+
rev_flag = param["rev_flag"],
161+
),
162+
"HSMTOOL_MODULE": "$(rootpath @softhsm2//:gen_dir)/lib/softhsm/libsofthsm2.so",
163+
"HSMTOOL_SPX_MODULE": "pkcs11-ef",
164+
"HSMTOOL_ARGS": """
165+
-t fake_keys -u user -p 123456
166+
spx verify
167+
--label=fake_app_prod_spx
168+
--domain={domain}
169+
--format={fmt}
170+
$(rootpath :tqbf_digest)
171+
tqbf.spx_sig
172+
""".format(
173+
domain = param["domain"],
174+
fmt = param["format"],
175+
),
176+
},
177+
deps = [":test_lib"],
178+
)
179+
for name, param in _SPX_TESTS.items()
180+
]
181+
182+
# SPHINCS+-Sign a digest with hsmtool and then verify the signature with opentitantool.
183+
[
184+
sh_test(
185+
name = "spx_{}_hsmtool_sign_opentitantool_verify_test".format(name),
186+
srcs = ["ot_hsm_runner.sh"],
187+
data = [
188+
":tqbf_digest",
189+
"//signing/softhsm",
190+
"//signing/softhsm:conf",
191+
"//sw/device/silicon_creator/lib/ownership/keys/fake:app_spx_prod",
192+
"//sw/host/hsmtool",
193+
"//sw/host/opentitantool",
194+
"@softhsm2//:gen_dir",
195+
],
196+
env = {
197+
"SOFTHSM2_CONF": "$(rootpath //signing/softhsm:conf)",
198+
"FIRST": "hsmtool",
199+
"OTTOOL_ARGS": """
200+
--rcfile=
201+
spx verify {rev_flag}
202+
--domain={domain}
203+
sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_spx.pem
204+
$(rootpath :tqbf_digest)
205+
tqbf.spx_sig
206+
""".format(
207+
domain = param["domain"],
208+
rev_flag = param["rev_flag"],
209+
),
210+
"HSMTOOL_MODULE": "$(rootpath @softhsm2//:gen_dir)/lib/softhsm/libsofthsm2.so",
211+
"HSMTOOL_SPX_MODULE": "pkcs11-ef",
212+
"HSMTOOL_ARGS": """
213+
-t fake_keys -u user -p 123456
214+
spx sign
215+
--label=fake_app_prod_spx
216+
--domain={domain}
217+
--format={fmt}
218+
--output=tqbf.spx_sig
219+
$(rootpath :tqbf_digest)
220+
""".format(
221+
domain = param["domain"],
222+
fmt = param["format"],
223+
),
224+
},
225+
deps = [":test_lib"],
226+
)
227+
for name, param in _SPX_TESTS.items()
228+
]
229+
230+
filegroup(
231+
name = "image_bin",
232+
# A hand assembled binary image.
233+
# dd if=/dev/zero of=image.bin bs=1k count=1
234+
# Then, use hexdump tools (e.g. `xxd` and `xxd -r`) to insert the following bytes:
235+
#
236+
# 00000330: 0000 0000 4f54 5245 476c 0200 0004 0000 ................
237+
# 00000340: 0004 0000 0000 0000 0000 0000 0000 0000 ................
238+
#
239+
# This sets the identifier, manifest_version, signed_region_end and length fields.
240+
srcs = ["image.bin"],
241+
)
242+
243+
genrule(
244+
name = "image_digest",
245+
srcs = [":image_bin"],
246+
outs = ["image.digest"],
247+
# Opentitantool computes the digest by excluding the signature region of the manifest.
248+
# The signature region is the first 384 bytes.
249+
cmd = """
250+
dd if=$< bs=1 skip=384 | sha256sum - | cut -f1 -d' ' | tr '[:lower:]' '[:upper:]' | basenc -d --base16 > $@
251+
""",
252+
)
253+
254+
# Verify the opentitantool image digest calculation.
255+
sh_test(
256+
name = "image_digest_test",
257+
srcs = ["image_digest_test.sh"],
258+
data = [
259+
":image_bin",
260+
":image_digest",
261+
"//sw/host/opentitantool",
262+
],
263+
env = {
264+
"IMAGE_BIN": "$(rootpath :image_bin)",
265+
"KNOWN_DIGEST": "$(rootpath :image_digest)",
266+
},
267+
deps = [":test_lib"],
268+
)
269+
270+
# ECDSA-Sign an image with opentitantool and then verify the signature with hsmtool.
271+
sh_test(
272+
name = "manifest_opentitantool_sign_hsmtool_verify_test",
273+
srcs = ["ot_hsm_runner.sh"],
274+
data = [
275+
":image_bin",
276+
"//signing/softhsm",
277+
"//signing/softhsm:conf",
278+
"//sw/device/silicon_creator/lib/ownership/keys/fake:app_ecdsa_prod",
279+
"//sw/host/hsmtool",
280+
"//sw/host/opentitantool",
281+
"@softhsm2//:gen_dir",
282+
],
283+
env = {
284+
"SOFTHSM2_CONF": "$(rootpath //signing/softhsm:conf)",
285+
"FIRST": "opentitantool",
286+
"OTTOOL_ARGS": """
287+
--rcfile=
288+
image manifest update
289+
--ecdsa-key=sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_ecdsa_p256.der
290+
--output=image.signed_bin
291+
$(rootpath :image_bin)
292+
""",
293+
"HSMTOOL_MODULE": "$(rootpath @softhsm2//:gen_dir)/lib/softhsm/libsofthsm2.so",
294+
"HSMTOOL_ARGS": """
295+
-t fake_keys -u user -p 123456
296+
ecdsa verify
297+
--little-endian
298+
--label=fake_app_prod_ecdsa
299+
--format=slice:384..1024
300+
--signature-at=0..64
301+
image.signed_bin
302+
""",
303+
},
304+
deps = [":test_lib"],
305+
)
306+
307+
# ECDSA-Sign an image with hsmtool and then verify the signature with opentitantool.
308+
sh_test(
309+
name = "manifest_hsmtool_sign_opentitantool_verify_test",
310+
srcs = ["ot_hsm_runner.sh"],
311+
data = [
312+
":image_bin",
313+
"//signing/softhsm",
314+
"//signing/softhsm:conf",
315+
"//sw/device/silicon_creator/lib/ownership/keys/fake:app_prod_ecdsa_pub",
316+
"//sw/host/hsmtool",
317+
"//sw/host/opentitantool",
318+
"@softhsm2//:gen_dir",
319+
],
320+
env = {
321+
"SOFTHSM2_CONF": "$(rootpath //signing/softhsm:conf)",
322+
"FIRST": "hsmtool",
323+
"PREPARE_CMD": """
324+
sw/host/opentitantool/opentitantool image manifest update
325+
--ecdsa-key=sw/device/silicon_creator/lib/ownership/keys/fake/app_prod_ecdsa_p256.pub.der
326+
--output=image.signed_bin
327+
$(rootpath :image_bin)
328+
""",
329+
"OTTOOL_ARGS": """
330+
--rcfile=
331+
image manifest verify
332+
image.signed_bin
333+
""",
334+
"HSMTOOL_MODULE": "$(rootpath @softhsm2//:gen_dir)/lib/softhsm/libsofthsm2.so",
335+
"HSMTOOL_ARGS": """
336+
-t fake_keys -u user -p 123456
337+
ecdsa sign
338+
--little-endian
339+
--label=fake_app_prod_ecdsa
340+
--format=slice:384..1024
341+
--update-in-place=0..64
342+
image.signed_bin
343+
""",
344+
},
345+
deps = [":test_lib"],
346+
)

0 commit comments

Comments
 (0)