Skip to content

add support for rsa-pss image signatures #737

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
bigbrett wants to merge 13 commits into
base: master
Choose a base branch
from
Draft

add support for rsa-pss image signatures #737

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
ea0581b
Fix XMSS and ML_DSA keygen type mismatch between image headers and ke…
bigbrett Mar 27, 2026
c8dae48
Add SW-only RSA PSS
bigbrett Mar 18, 2026
9eaebce
expand tests, add additional macro protection, fix keygen type bug
bigbrett Mar 18, 2026
4cc4e91
support rsa-pss in ARMORED mode
bigbrett Mar 18, 2026
1568ec5
add wolfHSM support
bigbrett Mar 23, 2026
bd6312e
unify rsa and rsa-pss into single verify method
bigbrett Mar 26, 2026
42b301a
prevent duplicate asm labels in ARMORED mode
bigbrett Mar 26, 2026
eadbf87
fix xmalloc RSA PSS macro build error
bigbrett Mar 26, 2026
d3ecef9
fix lingering IMAGE_HEADER_SIZE override in options.mk that should in…
bigbrett Mar 26, 2026
88e5889
add keysize string for PSS debugging
bigbrett Mar 26, 2026
1b0d95b
rename aggregate RSA PSS macro, add Renesas protection
bigbrett Mar 26, 2026
6a432e8
remove accidentally committed files
bigbrett Mar 27, 2026
a46f5b8
add generic RSA_ANY macro to reduce clutter
bigbrett Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
240 changes: 240 additions & 0 deletions .github/workflows/test-sunnyday-simulator.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,6 +171,66 @@ jobs:
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS2048)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS3072)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS4096)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

# 32 Bit simulator, FASTMATH
#
- name: make clean
Expand Down Expand Up @@ -301,6 +361,66 @@ jobs:
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh


# 64 Bit simulator, SP_MATH
#
Expand Down Expand Up @@ -432,6 +552,66 @@ jobs:
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS2048)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS2048, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS3072)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS3072, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS4096)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS4096, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

# 64 Bit simulator, FASTMATH
#
- name: make clean
Expand Down Expand Up @@ -562,6 +742,66 @@ jobs:
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS2048, FASTMATH)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS2048, FASTMATH, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS2048 WOLFBOOT_SMALL_STACK=1 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS3072, FASTMATH)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS3072, FASTMATH, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS3072 WOLFBOOT_SMALL_STACK=1 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Cleanup to change key type
run: |
make keysclean

- name: Build wolfboot.elf (RSAPSS4096, FASTMATH)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 SPMATH=0 WOLFBOOT_HUGE_STACK=1

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Build wolfboot.elf (RSAPSS4096, FASTMATH, WOLFBOOT_SMALL_STACK)
run: |
make clean && make test-sim-internal-flash-with-update SIGN=RSAPSS4096 WOLFBOOT_SMALL_STACK=1 SPMATH=0

- name: Run sunny day update test
run: |
tools/scripts/sim-sunnyday-update.sh

- name: Run sunny day LMS update test
run: |
tools/scripts/sim-pq-sunnyday-update.sh config/examples/sim-lms.config
Expand Down
21 changes: 21 additions & 0 deletions config/examples/sim-rsapss2048.config
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
ARCH=sim
TARGET=sim
SIGN?=RSAPSS2048
HASH?=SHA256
WOLFBOOT_SMALL_STACK?=0
SPI_FLASH=0
DEBUG=1

# sizes should be multiple of system page size
WOLFBOOT_PARTITION_SIZE=0x40000
WOLFBOOT_SECTOR_SIZE=0x1000
WOLFBOOT_PARTITION_BOOT_ADDRESS=0x80000
# if on external flash, it should be multiple of system page size
WOLFBOOT_PARTITION_UPDATE_ADDRESS=0x100000
WOLFBOOT_PARTITION_SWAP_ADDRESS=0x180000

# required for keytools
WOLFBOOT_FIXED_PARTITIONS=1

# For debugging XMALLOC/XFREE
#CFLAGS_EXTRA+=-DWOLFBOOT_DEBUG_MALLOC
Loading
Loading