Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 03:00:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(esp_tee): Support ECDSA secp384r1 keys in TEE secure storage

Browse Source
This commit is contained in:
Laukik Hase
2026-01-29 11:49:13 +05:30
parent 9ed8ae514a
commit 39f392f943
13 changed files with 350 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp_tee/test_apps/tee_cli_app/main/tee_srv_sec_str.c
+11 -4
View File
@@ -1,10 +1,11 @@
/*
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <string.h>
#include "soc/soc_caps.h"
#include "esp_event.h"
#include "esp_log.h"
@@ -20,11 +21,17 @@
#include "example_tee_srv.h"
#define SHA256_DIGEST_SZ (32)
#define ECDSA_SECP256R1_KEY_LEN (32)
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN
#define MAX_ECDSA_KEY_LEN (48)
#else
#define MAX_ECDSA_KEY_LEN (32)
#endif /* CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN */
#define AES256_GCM_TAG_LEN (16)
#define MAX_AES_PLAINTEXT_LEN (256)
#define ECDSA_SECP256R1_KEY_LEN (32)
static const char *TAG = "tee_sec_stg";
static esp_err_t hexstr_to_hexbuf(const char *hexstr, size_t hexstr_len, void *hexbuf, size_t hexbuf_sz)
@@ -266,7 +273,7 @@ static int tee_sec_stg_sign(int argc, char **argv)
goto exit;
}
size_t sign_hexstr_len = (ECDSA_SECP256R1_KEY_LEN * 2) * 2 + 1;
size_t sign_hexstr_len = (MAX_ECDSA_KEY_LEN * 2) * 2 + 1;
char *sign_hexstr = calloc(sign_hexstr_len, sizeof(char));
if (sign_hexstr == NULL) {
err = ESP_ERR_NO_MEM;
@@ -284,7 +291,7 @@ static int tee_sec_stg_sign(int argc, char **argv)
goto exit;
}
size_t pubkey_hexstr_len = (ECDSA_SECP256R1_KEY_LEN * 2) * 2 + 1;
size_t pubkey_hexstr_len = (MAX_ECDSA_KEY_LEN * 2) * 2 + 1;
char *pubkey_hexstr = calloc(pubkey_hexstr_len, sizeof(char));
if (pubkey_hexstr == NULL) {
err = ESP_ERR_NO_MEM;
components/esp_tee/test_apps/tee_test_fw/conftest.py
+15 -1
View File
@@ -1,4 +1,4 @@
# SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
# SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
# SPDX-License-Identifier: Apache-2.0
# pylint: disable=W0621 # redefined-outer-name
import base64
@@ -339,6 +339,20 @@ class TEESerial(IdfSerial):
'LS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo='
),
},
{'key': 'p192_key0', 'type': 'ecdsa_p192', 'input': None, 'write_once': False},
{
'key': 'p384_key0',
'type': 'ecdsa_p384',
'input': 'ecdsa_p384_key.pem',
'write_once': True,
'b64': (
'LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1JR2tBZ0VCQkRDQUIreENyckkrOWJObWlzVlVsSG1R'
'T3dZMHIyNWVIL09DalVMUVY4NHZtZU0wWDVLMnYrRE4KZkdSUkRZd0NheGlnQndZRks0RUVBQ0toWkFOaUFB'
'UVFWcHFObVY0Qm1aemw5VWZBcm0veVpiak9QZTJoUEtDRQp0RERZLy9FS0lOZExvY1dvMUgwWWhzYTBuU2xj'
'cGk2SDM3eXlSVHNxUnFueFBOeXFYZDdqbXo1WkIySWZHWHhBCmptZnZLVmJIcVNJV0JDRUx0WUxwS2t3UHNCO'
'XV4WW89Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0='
),
},
]
NVS_KEYS_B64 = 'MzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzPMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzA=='
components/esp_tee/test_apps/tee_test_fw/main/test_esp_tee_att.c
+2 -2
View File
@@ -35,7 +35,7 @@
static const char *TAG = "test_esp_tee_att";
extern int verify_ecdsa_sign(const uint8_t *digest, size_t len, const esp_tee_sec_storage_ecdsa_pubkey_t *pubkey, const esp_tee_sec_storage_ecdsa_sign_t *sign, bool is_crv_p192);
extern int verify_ecdsa_sign(const esp_tee_sec_storage_type_t key_type, const uint8_t *digest, size_t len, const esp_tee_sec_storage_ecdsa_pubkey_t *pubkey, const esp_tee_sec_storage_ecdsa_sign_t *sign);
static uint8_t hexchar_to_byte(char hex)
{
@@ -268,7 +268,7 @@ TEST_CASE("Test TEE Attestation - Generate and verify the EAT", "[attestation]")
fetch_signature((const char *)token_buf, &sign_ctx);
// Verifying the generated token
TEST_ASSERT_EQUAL(0, verify_ecdsa_sign(digest, sizeof(digest), &pubkey_ctx, &sign_ctx, false));
TEST_ASSERT_EQUAL(0, verify_ecdsa_sign(ESP_SEC_STG_KEY_ECDSA_SECP256R1, digest, sizeof(digest), &pubkey_ctx, &sign_ctx));
free(token_buf);
}
components/esp_tee/test_apps/tee_test_fw/main/test_esp_tee_sec_stg.c
+156 -45
View File
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
@@ -27,7 +27,9 @@
error hex value (mbedTLS uses -N for error codes) */
#define TEST_ASSERT_MBEDTLS_OK(X) TEST_ASSERT_EQUAL_HEX32(0, -(X))
#define SHA384_DIGEST_SZ (48)
#define SHA256_DIGEST_SZ (32)
#define ECDSA_SECP384R1_KEY_LEN (48)
#define ECDSA_SECP256R1_KEY_LEN (32)
#define ECDSA_SECP192R1_KEY_LEN (24)
@@ -38,10 +40,13 @@
static const char *TAG = "test_esp_tee_sec_storage";
int verify_ecdsa_sign(const uint8_t *digest, size_t len, const esp_tee_sec_storage_ecdsa_pubkey_t *pubkey, const esp_tee_sec_storage_ecdsa_sign_t *sign, bool is_crv_p192)
int verify_ecdsa_sign(const esp_tee_sec_storage_type_t key_type, const uint8_t *digest, size_t len, const esp_tee_sec_storage_ecdsa_pubkey_t *pubkey, const esp_tee_sec_storage_ecdsa_sign_t *sign)
{
#if !CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP192R1_SIGN
TEST_ASSERT_FALSE(is_crv_p192);
TEST_ASSERT_FALSE(key_type == ESP_SEC_STG_KEY_ECDSA_SECP192R1);
#endif
#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN
TEST_ASSERT_FALSE(key_type == ESP_SEC_STG_KEY_ECDSA_SECP384R1);
#endif
TEST_ASSERT_NOT_NULL(pubkey);
@@ -59,22 +64,40 @@ int verify_ecdsa_sign(const uint8_t *digest, size_t len, const esp_tee_sec_stora
size_t pub_key_len;
size_t signature_size;
if (is_crv_p192) {
/* Use fixed-size array large enough for all supported curves (max: SECP384R1 = 2*48+1 = 97) */
uint8_t pub_key[2 * ECDSA_SECP384R1_KEY_LEN + 1];
switch (key_type) {
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP192R1_SIGN
case ESP_SEC_STG_KEY_ECDSA_SECP192R1:
psa_set_key_bits(&key_attributes, ECDSA_SECP192R1_KEY_LEN * 8);
pub_key_len = ECDSA_SECP192R1_KEY_LEN;
signature_size = ECDSA_SECP192R1_KEY_LEN * 2;
} else {
break;
#endif // CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP192R1_SIGN
case ESP_SEC_STG_KEY_ECDSA_SECP256R1:
psa_set_key_bits(&key_attributes, ECDSA_SECP256R1_KEY_LEN * 8);
pub_key_len = ECDSA_SECP256R1_KEY_LEN;
signature_size = ECDSA_SECP256R1_KEY_LEN * 2;
break;
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN
case ESP_SEC_STG_KEY_ECDSA_SECP384R1:
psa_set_key_bits(&key_attributes, ECDSA_SECP384R1_KEY_LEN * 8);
pub_key_len = ECDSA_SECP384R1_KEY_LEN;
signature_size = ECDSA_SECP384R1_KEY_LEN * 2;
break;
#endif // CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN
default:
ESP_LOGE(TAG, "Unsupported ECDSA curve type");
err = ESP_ERR_INVALID_ARG;
goto exit;
}
uint8_t pub_key[2 * pub_key_len + 1];
pub_key[0] = 0x04;
memcpy(pub_key + 1, pubkey->pub_x, pub_key_len);
memcpy(pub_key + 1 + pub_key_len, pubkey->pub_y, pub_key_len);
psa_status_t status = psa_import_key(&key_attributes, pub_key, sizeof(pub_key), &key_id);
psa_status_t status = psa_import_key(&key_attributes, pub_key, 2 * pub_key_len + 1, &key_id);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to import ECDSA public key: %ld", status);
err = ESP_ERR_INVALID_ARG;
@@ -131,7 +154,7 @@ TEST_CASE("Test TEE Secure Storage - Sign-verify (ecdsa_secp256r1)", "[sec_stora
esp_tee_sec_storage_ecdsa_pubkey_t pubkey = {};
TEST_ESP_OK(esp_tee_sec_storage_ecdsa_get_pubkey(&key_cfg, &pubkey));
TEST_ESP_OK(verify_ecdsa_sign(msg_digest, msg_digest_len, &pubkey, &sign, false));
TEST_ESP_OK(verify_ecdsa_sign(key_cfg.type, msg_digest, msg_digest_len, &pubkey, &sign));
TEST_ESP_OK(esp_tee_sec_storage_clear_key(key_cfg.id));
}
@@ -173,7 +196,51 @@ TEST_CASE("Test TEE Secure Storage - Sign-verify (ecdsa_secp192r1)", "[sec_stora
esp_tee_sec_storage_ecdsa_pubkey_t pubkey = {};
TEST_ESP_OK(esp_tee_sec_storage_ecdsa_get_pubkey(&key_cfg, &pubkey));
TEST_ESP_OK(verify_ecdsa_sign(msg_digest, sizeof(msg_digest), &pubkey, &sign, true));
TEST_ESP_OK(verify_ecdsa_sign(key_cfg.type, msg_digest, sizeof(msg_digest), &pubkey, &sign));
TEST_ESP_OK(esp_tee_sec_storage_clear_key(key_cfg.id));
}
}
#endif
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN
TEST_CASE("Test TEE Secure Storage - Sign-verify (ecdsa_secp384r1)", "[sec_storage]")
{
const size_t buf_sz = 16 * 1024 + 6; // NOTE: Not an exact multiple of SHA block size
unsigned char *message = heap_caps_malloc(buf_sz, MALLOC_CAP_8BIT | MALLOC_CAP_INTERNAL);
TEST_ASSERT_NOT_NULL(message);
esp_fill_random(message, buf_sz);
uint8_t msg_digest[SHA384_DIGEST_SZ];
// TEST_ASSERT_MBEDTLS_OK(mbedtls_sha512(message, buf_sz, msg_digest, false));
size_t msg_digest_len = 0;
psa_status_t status = psa_hash_compute(PSA_ALG_SHA_384, message, buf_sz, msg_digest, sizeof(msg_digest), &msg_digest_len);
TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
(void)msg_digest_len;
free(message);
esp_tee_sec_storage_key_cfg_t key_cfg = {
.type = ESP_SEC_STG_KEY_ECDSA_SECP384R1
};
for (unsigned int i = 0; i < MAX_SEC_STG_ITER; i++) {
char key_id[32];
int ret = snprintf(key_id, sizeof(key_id), "ecdsa_key_%u", i);
TEST_ASSERT_TRUE(ret > 0 && ret < sizeof(key_id));
key_cfg.id = key_id;
esp_err_t err = esp_tee_sec_storage_clear_key(key_cfg.id);
TEST_ASSERT_TRUE(err == ESP_OK || err == ESP_ERR_NOT_FOUND);
TEST_ESP_OK(esp_tee_sec_storage_gen_key(&key_cfg));
esp_tee_sec_storage_ecdsa_sign_t sign = {};
TEST_ESP_OK(esp_tee_sec_storage_ecdsa_sign(&key_cfg, msg_digest, sizeof(msg_digest), &sign));
esp_tee_sec_storage_ecdsa_pubkey_t pubkey = {};
TEST_ESP_OK(esp_tee_sec_storage_ecdsa_get_pubkey(&key_cfg, &pubkey));
TEST_ESP_OK(verify_ecdsa_sign(key_cfg.type, msg_digest, sizeof(msg_digest), &pubkey, &sign));
TEST_ESP_OK(esp_tee_sec_storage_clear_key(key_cfg.id));
}
@@ -288,7 +355,7 @@ TEST_CASE("Test TEE Secure Storage - Operations with invalid/non-existent keys",
TEST_ESP_OK(esp_tee_sec_storage_gen_key(&key_cfg));
esp_tee_sec_storage_ecdsa_sign_t sign = {};
TEST_ESP_ERR(ESP_FAIL, esp_tee_sec_storage_ecdsa_sign(&key_cfg, msg_digest, sizeof(msg_digest), &sign));
TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_tee_sec_storage_ecdsa_sign(&key_cfg, msg_digest, sizeof(msg_digest), &sign));
TEST_ESP_OK(esp_tee_sec_storage_clear_key(key_cfg.id));
// Test with non-existent data
@@ -400,46 +467,64 @@ static void test_aead_encrypt_decrypt(const char *key_id, const uint8_t *input,
free(decrypted);
}
static void do_ecdsa_sign_and_verify(const esp_tee_sec_storage_key_cfg_t *cfg, const uint8_t *digest, size_t digest_len)
{
esp_tee_sec_storage_ecdsa_sign_t sign = {0};
esp_tee_sec_storage_ecdsa_pubkey_t pubkey = {0};
TEST_ESP_OK(esp_tee_sec_storage_ecdsa_sign(cfg, digest, digest_len, &sign));
TEST_ESP_OK(esp_tee_sec_storage_ecdsa_get_pubkey(cfg, &pubkey));
TEST_ESP_OK(verify_ecdsa_sign(cfg->type, digest, digest_len, &pubkey, &sign));
}
TEST_CASE("Test TEE Secure Storage - Host-generated keys", "[sec_storage_host_keygen]")
{
const char *aes_key_id0 = "aes256_key0";
const char *aes_key_id1 = "aes256_key1";
const char *aes_key_ids[] = { "aes256_key0", "aes256_key1" };
const char *ecdsa_key_id0 = "p256_key0";
const char *attest_key_id = "attest_key";
TEST_ESP_ERR(ESP_ERR_INVALID_STATE, esp_tee_sec_storage_clear_key(aes_key_id0));
TEST_ESP_ERR(ESP_ERR_INVALID_STATE, esp_tee_sec_storage_clear_key(aes_key_ids[0]));
const size_t SZ = 100;
uint8_t *plaintext = heap_caps_malloc(SZ, MALLOC_CAP_8BIT | MALLOC_CAP_INTERNAL);
TEST_ASSERT_NOT_NULL(plaintext);
esp_fill_random(plaintext, SZ);
test_aead_encrypt_decrypt(aes_key_id0, plaintext, SZ);
test_aead_encrypt_decrypt(aes_key_id1, plaintext, SZ);
for (size_t i = 0; i < sizeof(aes_key_ids) / sizeof(aes_key_ids[0]); ++i) {
test_aead_encrypt_decrypt(aes_key_ids[i], plaintext, SZ);
}
free(plaintext);
heap_caps_free(plaintext);
TEST_ESP_OK(esp_tee_sec_storage_clear_key(aes_key_id1));
TEST_ESP_OK(esp_tee_sec_storage_clear_key(aes_key_ids[1]));
uint8_t msg_digest[SHA256_DIGEST_SZ];
esp_fill_random(msg_digest, sizeof(msg_digest));
uint8_t digest_buf[SHA384_DIGEST_SZ];
esp_fill_random(digest_buf, sizeof(digest_buf));
esp_tee_sec_storage_key_cfg_t key_cfg = {
.id = ecdsa_key_id0,
.id = ecdsa_key_id0,
.type = ESP_SEC_STG_KEY_ECDSA_SECP256R1,
};
esp_tee_sec_storage_ecdsa_sign_t sign = {};
TEST_ESP_OK(esp_tee_sec_storage_ecdsa_sign(&key_cfg, msg_digest, sizeof(msg_digest), &sign));
esp_tee_sec_storage_ecdsa_pubkey_t pubkey = {};
TEST_ESP_OK(esp_tee_sec_storage_ecdsa_get_pubkey(&key_cfg, &pubkey));
TEST_ESP_OK(verify_ecdsa_sign(msg_digest, sizeof(msg_digest), &pubkey, &sign, false));
do_ecdsa_sign_and_verify(&key_cfg, digest_buf, SHA256_DIGEST_SZ);
TEST_ESP_OK(esp_tee_sec_storage_clear_key(ecdsa_key_id0));
TEST_ESP_ERR(ESP_ERR_INVALID_STATE, esp_tee_sec_storage_clear_key(attest_key_id));
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP192R1_SIGN
const char *ecdsa_key_id1 = "p192_key0";
key_cfg.id = ecdsa_key_id1;
key_cfg.type = ESP_SEC_STG_KEY_ECDSA_SECP192R1;
do_ecdsa_sign_and_verify(&key_cfg, digest_buf, SHA256_DIGEST_SZ);
TEST_ESP_OK(esp_tee_sec_storage_clear_key(ecdsa_key_id1));
#endif /* CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP192R1_SIGN */
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN
const char *ecdsa_key_id2 = "p384_key0";
key_cfg.id = ecdsa_key_id2;
key_cfg.type = ESP_SEC_STG_KEY_ECDSA_SECP384R1;
do_ecdsa_sign_and_verify(&key_cfg, digest_buf, SHA384_DIGEST_SZ);
TEST_ESP_ERR(ESP_ERR_INVALID_STATE, esp_tee_sec_storage_clear_key(ecdsa_key_id2));
#endif /* CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN */
#if CONFIG_SECURE_TEE_ATTESTATION
uint8_t *token_buf = heap_caps_calloc(ESP_ATT_TK_BUF_SIZE, sizeof(uint8_t), MALLOC_CAP_8BIT | MALLOC_CAP_INTERNAL);
@@ -450,29 +535,52 @@ TEST_CASE("Test TEE Secure Storage - Host-generated keys", "[sec_storage_host_ke
token_buf, ESP_ATT_TK_BUF_SIZE, &token_len));
free(token_buf);
#endif
const char *attest_key_id = "attest_key";
TEST_ESP_ERR(ESP_ERR_INVALID_STATE, esp_tee_sec_storage_clear_key(attest_key_id));
#endif /* CONFIG_SECURE_TEE_ATTESTATION */
}
#if CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN
static const uint8_t sha[] = {
0x0c, 0xaa, 0x08, 0xb4, 0xf0, 0x89, 0xd3, 0x45,
0xbb, 0x55, 0x98, 0xd9, 0xc2, 0xe9, 0x65, 0x5d,
0x7e, 0xa3, 0xa9, 0xc3, 0xcd, 0x69, 0xb1, 0xcf,
0x91, 0xbe, 0x58, 0x10, 0xfe, 0x80, 0x65, 0x6e
0xda, 0x99, 0x5d, 0x66, 0xcb, 0xa5, 0xcb, 0xc7,
0xc5, 0x3d, 0x8d, 0x08, 0x4d, 0x6a, 0x5e, 0x8e,
0xf0, 0x84, 0x4b, 0x7b, 0xdd, 0xd0, 0x20, 0x47,
0xa3, 0x6c, 0x61, 0xf3, 0xbc, 0xcf, 0xf4, 0xe2,
0xf7, 0x70, 0xcd, 0x19, 0xf7, 0x31, 0x52, 0x48,
0x1f, 0x29, 0x0e, 0x13, 0x24, 0x55, 0x9d, 0xb9,
0x1a, 0x48, 0xa4, 0x0e, 0x75, 0xc2, 0xa8, 0x35,
0xa9, 0x53, 0x97, 0xec, 0xcc, 0x66, 0x5b, 0xa6
};
static void test_ecdsa_sign(mbedtls_ecp_group_id gid)
{
bool is_crv_p192 = false;
esp_tee_sec_storage_type_t key_type = ESP_SEC_STG_KEY_ECDSA_SECP256R1;
size_t key_len = ECDSA_SECP256R1_KEY_LEN;
esp_tee_sec_storage_type_t key_type = ESP_SEC_STG_TYPE_MAX;
size_t key_len = 0;
size_t sha_len = SHA256_DIGEST_SZ;
if (gid == MBEDTLS_ECP_DP_SECP192R1) {
is_crv_p192 = true;
switch (gid) {
case MBEDTLS_ECP_DP_SECP256R1:
key_type = ESP_SEC_STG_KEY_ECDSA_SECP256R1;
key_len = ECDSA_SECP256R1_KEY_LEN;
break;
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP192R1_SIGN
case MBEDTLS_ECP_DP_SECP192R1:
key_type = ESP_SEC_STG_KEY_ECDSA_SECP192R1;
key_len = ECDSA_SECP192R1_KEY_LEN;
key_len = ECDSA_SECP192R1_KEY_LEN;
break;
#endif
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN
case MBEDTLS_ECP_DP_SECP384R1:
key_type = ESP_SEC_STG_KEY_ECDSA_SECP384R1;
key_len = ECDSA_SECP384R1_KEY_LEN;
sha_len = SHA384_DIGEST_SZ;
break;
#endif
default:
ESP_LOGE(TAG, "Unsupported curve ID: %d", gid);
return;
}
const char *key_id = "ecdsa_k0";
esp_tee_sec_storage_key_cfg_t key_cfg = {
@@ -509,13 +617,13 @@ static void test_ecdsa_sign(mbedtls_ecp_group_id gid)
mbedtls_ecp_keypair *keypair = key_ctx.MBEDTLS_PRIVATE(pk_ctx); //mbedtls_pk_ec(key_ctx);
mbedtls_mpi key_mpi = keypair->MBEDTLS_PRIVATE(d);
TEST_ASSERT_MBEDTLS_OK(mbedtls_ecdsa_sign(&ecdsa_context.MBEDTLS_PRIVATE(grp), &r, &s, &key_mpi, sha, SHA256_DIGEST_SZ, NULL, NULL));
TEST_ASSERT_MBEDTLS_OK(mbedtls_ecdsa_sign(&ecdsa_context.MBEDTLS_PRIVATE(grp), &r, &s, &key_mpi, sha, sha_len, NULL, NULL));
esp_tee_sec_storage_ecdsa_sign_t sign = {};
TEST_ASSERT_MBEDTLS_OK(mbedtls_mpi_write_binary(&r, sign.signature, key_len));
TEST_ASSERT_MBEDTLS_OK(mbedtls_mpi_write_binary(&s, sign.signature + key_len, key_len));
TEST_ESP_OK(verify_ecdsa_sign(sha, sizeof(sha), &pubkey, &sign, is_crv_p192));
TEST_ESP_OK(verify_ecdsa_sign(key_type, sha, sha_len, &pubkey, &sign));
esp_ecdsa_free_pk_context(&key_ctx);
mbedtls_ecdsa_free(&ecdsa_context);
@@ -531,5 +639,8 @@ TEST_CASE("Test TEE Secure Storage - mbedtls ECDSA signing", "[mbedtls]")
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP192R1_SIGN && !TEMPORARY_DISABLED_FOR_TARGETS(ESP32H2)
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP192R1);
#endif
#if CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN
test_ecdsa_sign(MBEDTLS_ECP_DP_SECP384R1);
#endif
}
#endif
components/esp_tee/test_apps/tee_test_fw/sdkconfig.ci.tee_ota
+2
View File
@@ -9,6 +9,8 @@ CONFIG_BOOTLOADER_LOG_LEVEL_DEBUG=y
CONFIG_SECURE_TEE_LOG_LEVEL_DEBUG=y
CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP192R1_SIGN=y
# Takes effect only for supported targets
CONFIG_SECURE_TEE_SEC_STG_SUPPORT_SECP384R1_SIGN=y
# secure storage key slot for attestation
CONFIG_SECURE_TEE_ATT_KEY_STR_ID="tee_att_keyN"