lib: rsa: Add otp revoke pub key support

Change-Id: I73b07c051960813d4e5a8b27ac732672f3bf58b4
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

lib: rsa: Add otp disable upgrade support

Change-Id: Ie18df1ab3650eeb6d39c07eadaa2aaa468045e1e
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

lib: rsa: Simplify rsa_burn_key_hash func

Use new implementation misc_otp_write_readback.

Change-Id: I14d7df12ce1cf3de1ff79c20eb211e22ebcd9ac8
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

lib: rsa: Wait for power supply steady only before OTP write

If secureboot enabled, even burn_key flag exists,
don't need to delay 3s.

Change-Id: I1a93328295d7757346fd8d73d27393565ebd9122
Signed-of

lib: rsa: Wait for power supply steady only before OTP write

If secureboot enabled, even burn_key flag exists,
don't need to delay 3s.

Change-Id: I1a93328295d7757346fd8d73d27393565ebd9122
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

show more ...

lib: rsa: Add 3s delay before write secure otp

Delay 3 seconds to make sure power supply is steady.

Change-Id: Ieefae68fa52f23efb7315221d425b31650ae0883
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chi

lib: rsa: Add 3s delay before write secure otp

Delay 3 seconds to make sure power supply is steady.

Change-Id: Ieefae68fa52f23efb7315221d425b31650ae0883
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

show more ...

lib: rsa: Add burn rsa4096 key hash support

1. If burn both flags(0x30ff) into OTP_SECURE_BOOT_ENABLE_ADDR,
0xff will be burned first. If power down happens when burn rsa4096 flag
(0xff is already b

lib: rsa: Add burn rsa4096 key hash support

1. If burn both flags(0x30ff) into OTP_SECURE_BOOT_ENABLE_ADDR,
0xff will be burned first. If power down happens when burn rsa4096 flag
(0xff is already burned), the device becomes bricked.

2. So, fix all OTP_SECURE_BOOT_ENABLE_SIZE from 2 bytes to 1 byte,
only allow to burn 1 byte to open secureboot. Add OTP_RSA4096_ENABLE_ADDR/SIZE
definition used for burn rsa4096 flag.

Change-Id: Ifc9767242bc86fd0cf69ff107b4f557bc3a4fdcd
Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>

show more ...

lib: rsa-checksum: Add ARMv8 CE support

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I0f55ce8e302e9074b968fbcca16a82b639a20801

lib: rsa: Add burn-key-hash flag check

When enter rsa_burn_key_hash, need to check burn-key-hash flag in
itb first before further ops.

Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
Change-Id:

lib: rsa: Add burn-key-hash flag check

When enter rsa_burn_key_hash, need to check burn-key-hash flag in
itb first before further ops.

Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
Change-Id: I87ac5f4a0decaa984445b98e57d3a1fa589d7d56

show more ...

lib: rsa: Add support for rsa key repair

Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
Change-Id: I79828d8e268accf2e691f047107b3af3d2b35179

lib: rsa: Add support for rsa4096

Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
Change-Id: Icdbe40c0a416237b88db80fffa07c61de982516a

lib/rsa-sign: Support generate np factor for rsa4096

Signed-off-by: Yi Liu <liuyi@rock-chips.com>
Change-Id: I248a129941b64e78c901a887eb9eb3f82a46bdd2

lib: rsa: Fix secure boot check for burn key

Only secure_flags = 0xff means secure boot, other values(like 0xf0) have its special meaning.

Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
Change

lib: rsa: Fix secure boot check for burn key

Only secure_flags = 0xff means secure boot, other values(like 0xf0) have its special meaning.

Signed-off-by: Xuhui Lin <xuhui.lin@rock-chips.com>
Change-Id: I4fb53d1ce170ba67270b1136d5eecdef09f3ef55

show more ...

rsa/sig: Compile rsa_burn_key_hash() in SPL only

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: Ibe2c198432e75e5aec46f3784a78b215ad46af2f

rsa: Kconfig: delete the rsa N & E & C default value

Since the rsa N & E & C size are different, it will make mistake
to use default value.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Chang

rsa: Kconfig: delete the rsa N & E & C default value

Since the rsa N & E & C size are different, it will make mistake
to use default value.

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I9c8466baac84f041f1627720c7669f21a30ccce2

show more ...

lib: rsa-verify: pass the public key to next stage

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I92f2906981ea14aaabda3b1b7b44574cc157e451

lib: rsa-verify: calculate the hash depended on operator size

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I72822a2331afb45a1b291e473cd83f7ce3d627f6

lib: rsa-sign: support calculate deferent size of rsa's key

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: Ia473b5123c11ed57d1eed560964b6a7dc482b7df

rsa: read back to check the key hash after writing OTP

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I9cee6e758b487e3947727dc4c68df66ef2c51f67

rsa: support write public hash in spl

Signed-off-by: Jason Zhu <jason.zhu@rock-chips.com>
Change-Id: I4120d0cad1cb24b45c3b281649e1eba520a11ee2

lib: rsa-sign: add rockchip rsa key hash

SPL requires key hash to verify and flash it to OTP/EFUSE.

- hash@c: n, e, c
- hash@np: n, e, np

/ {
signature {
key-dev {
require

lib: rsa-sign: add rockchip rsa key hash

SPL requires key hash to verify and flash it to OTP/EFUSE.

- hash@c: n, e, c
- hash@np: n, e, np

/ {
signature {
key-dev {
required = "conf";
algo = "sha256,rsa2048";
rsa,np = <...>;
rsa,c = <...>;
rsa,modulus = <...>;
rsa,exponent-BN = <...>;
...
key-name-hint = "dev";
hash@np {
algo = "sha256";
value = <0x0934bc4d 0xfbc31ffe 0x9224d6c2 0x1a3aa280 0x881d881e 0xe2006246 0x01b9e724 0x35c03428>;
};
hash@c {
algo = "sha256";
value = <0x08962385 0x34585e06 0x0b73a496 0x374b148d 0xa2700a75 0x4aae08ad 0xb2a324a3 0x95ee6b52>;
};
};
};
...
};

But after processed by scripts/fit.sh, only one of "hash@c" and "hash@np" would be left.

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: Id9454100f9fdb06b30f9a4b2a7bdd180f117cb68

show more ...

lib: rsa-verify: require np/c factor if using hardware decrypt

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I2c5a68e86a04f4c65719521ac9aac62297432beb

UPSTREAM: rsa: add support of padding pss

We add the support of the padding pss for rsa signature.
This new padding is often recommended instead of pkcs-1.5.

Signed-off-by: Philippe Reynes <philipp

UPSTREAM: rsa: add support of padding pss

We add the support of the padding pss for rsa signature.
This new padding is often recommended instead of pkcs-1.5.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
(cherry picked from commit 061daa0b61f0fbeb214c566f3adb23da05545320)

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I28e5722504bfd0428cd119b2aaae60682a720648

show more ...

UPSTREAM: rsa: add a structure for the padding

The rsa signature use a padding algorithm. By default, we use the
padding pkcs-1.5. In order to add some new padding algorithm, we
add a padding framew

UPSTREAM: rsa: add a structure for the padding

The rsa signature use a padding algorithm. By default, we use the
padding pkcs-1.5. In order to add some new padding algorithm, we
add a padding framework to manage several padding algorithm.
The choice of the padding is done in the file .its.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
(cherry picked from commit 20031567e12bb312bff95b70767f6275e20f0346)

Conflicts:
common/image-fit.c
lib/rsa/rsa-sign.c
lib/rsa/rsa-verify.c

Change-Id: Ie522fec1ea69e6b86ebde0f7dad91a45670da66b
Signed-off-by: Joseph Chen <chenjh@rock-chips.com>

show more ...

UPSTREAM: rsa: use new openssl API to create signature

Previous implementation of the rsa signature was using
the openssl API EVP_Sign*, but the new openssl API
EVP_DigestSign* is more flexible. So

UPSTREAM: rsa: use new openssl API to create signature

Previous implementation of the rsa signature was using
the openssl API EVP_Sign*, but the new openssl API
EVP_DigestSign* is more flexible. So we move to this
new API.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
(cherry picked from commit 3b5d6979fcb80ffae3b140be6edc04cbde1a0b72)

Conflicts:
lib/rsa/rsa-sign.c

Change-Id: I6016a13904024a63d6fb8110cef37e57a164eed9
Signed-off-by: Joseph Chen <chenjh@rock-chips.com>

show more ...

lib: rsa: checksum: clean up hash calculate

Signed-off-by: Joseph Chen <chenjh@rock-chips.com>
Change-Id: I9a8d30923c8744e4af9612b0edeaed10410b0b32