fix(cert-create): add default keysize to Brainpool ECDSA

By default, the ECDSA Brainpool regular and ECDSA Brainpool twisted
algorithms support 256-bit sized keys. Not defining this leads to
an erro

fix(cert-create): add default keysize to Brainpool ECDSA

By default, the ECDSA Brainpool regular and ECDSA Brainpool twisted
algorithms support 256-bit sized keys. Not defining this leads to
an error indicating that '256' is not a valid key size for ECDSA
Brainpool. KEY_SIZES matrix must have a value in its table to avoid
problems when KEY_SIZE is defined.

Signed-off-by: Maxime Méré <maxime.mere@foss.st.com>
Change-Id: I34886659315f59a9582dcee1d92d0e24d4a4138e

show more ...

fix(tools): update the fiptool and certtool to fix POSIX build

This patch fixes below issue raised:

https://github.com/TrustedFirmware-A/trusted-firmware-a/issues/8
https://github.com/TrustedFirmwa

fix(tools): update the fiptool and certtool to fix POSIX build

This patch fixes below issue raised:

https://github.com/TrustedFirmware-A/trusted-firmware-a/issues/8
https://github.com/TrustedFirmware-A/trusted-firmware-a/issues/9
https://github.com/TrustedFirmware-A/trusted-firmware-a/issues/10

Change-Id: I521bf7410535ffe49198789ba183cc401b3b88a0
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

fix(cert-create): fix key loading logic

When key_load() attempts to load the key from a file and it fails to
open this file, the 'err_code' output argument is set to
'KEY_ERR_OPEN' error code. Howev

fix(cert-create): fix key loading logic

When key_load() attempts to load the key from a file and it fails to
open this file, the 'err_code' output argument is set to
'KEY_ERR_OPEN' error code. However, it is incorrectly overwritten
later on with 'KEY_ERR_NONE' or 'KEY_ERR_LOAD'.

The latter case messes up with the key creation scenario. The
'KEY_ERR_LOAD' error leads the tool to exit, when it should attempt to
create the said key file if invoked with the --new-keys/-n option.

Note that, to complicate matters further, which of 'KEY_ERR_OPEN' or
'KEY_ERR_NONE' values is returned by key_load() depends on the version
of OpenSSL in use:

- If using v3+, KEY_ERROR_LOAD is returned.

- If using <v3, KEY_ERROR_NONE is returned as a result of the key
pair container being initialized by key_new().

This patch fixes this bug and also takes the opportunity to refactor
key_load() implementation to (hopefully) make it more straight-forward
and easier to reason about.

Fixes: 616b3ce27d9a "feat(cert-create): add pkcs11 engine support"
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Reported-by: Wenchen Tan <xtaens@qq.com>
Change-Id: Ia78ff442e04c5ff98e6ced8d26becbd817a8ccb7

show more ...

feat(cert-create): ecdsa p384 key support

Adding ECDSA P384 (secp384r1) key creation support through key_bits
obtained from KEY_SIZE.

Change-Id: I571251caef20222990bd927cdfb5f35bf2a185d0
Signed-off

feat(cert-create): ecdsa p384 key support

Adding ECDSA P384 (secp384r1) key creation support through key_bits
obtained from KEY_SIZE.

Change-Id: I571251caef20222990bd927cdfb5f35bf2a185d0
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>

show more ...

feat(cert-create): add new option for CCA NV ctr

Extends cert_create tool with a new option for CCA NV
counter: ccafw_nvctr.

And changes the non-volatile counter used to protect
the CCA Content Cer

feat(cert-create): add new option for CCA NV ctr

Extends cert_create tool with a new option for CCA NV
counter: ccafw_nvctr.

And changes the non-volatile counter used to protect
the CCA Content Certificate from the Trusted FW NV counter
to the CCA FW NV counter in the CCA CoT description.

Change-Id: I27f3ab2e25809f0dcc56fa05e5c3a25a2e861ef6
Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com>

show more ...