ra8_ota_verify.c

Go to the documentation of this file.

 
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_ota.h"
#include "ra8_ota_internal.h"
#include "ra8_secure.h"

static const char* const s_tag = "ra8_ota";

RA8_INTERNAL
static ra8_err_t internal_rehash_bank(const ra8_ota_manifest_t* m, uint8_t out_digest[32])
{
  ra8_err_t e = g_ra8_ota_cfg.crypto.sha256_init(g_ra8_ota_cfg.crypto.ctx);
  if (e != k_ra8_ok) {
    return e;
  }
  uint32_t       offset     = 0U;
  const uint32_t max_chunks = (k_ra8_ota_max_image_bytes / k_ra8_ota_chunk_bytes) + 1U;
  for (uint32_t i = 0U; i < max_chunks; ++i) {
    if (offset >= m->image_size_bytes) {
      break;
    }
    const uint32_t remaining = m->image_size_bytes - offset;
    const uint32_t want = (remaining < k_ra8_ota_chunk_bytes) ? remaining : k_ra8_ota_chunk_bytes;
    e = g_ra8_ota_cfg.flash.readback(g_ra8_ota_cfg.flash.ctx,
                                     g_ra8_ota_cfg.flash.inactive_bank_addr + offset,
                                     g_ra8_ota_buf,
                                     want);
    if (e != k_ra8_ok) {
      return e;
    }
    e = g_ra8_ota_cfg.crypto.sha256_update(g_ra8_ota_cfg.crypto.ctx, g_ra8_ota_buf, want);
    if (e != k_ra8_ok) {
      return e;
    }
    offset += want;
  }
  return g_ra8_ota_cfg.crypto.sha256_final(g_ra8_ota_cfg.crypto.ctx, out_digest);
}

typedef enum : uint8_t {
  k_ra8_ota_size_field_bytes = 4U, 
  k_ra8_ota_octet_bits       = 8U, 
} ra8_ota_bind_field_t;

RA8_INTERNAL
static ra8_err_t internal_bind_manifest_material(const ra8_ota_manifest_t* manifest,
                                                 const uint8_t*            image_digest,
                                                 uint8_t out_bound[k_ra8_ota_sha256_bytes])
{
  RA8_CHECK_NULL_PTR(manifest, s_tag, "bind: manifest");
  RA8_CHECK_NULL_PTR(image_digest, s_tag, "bind: image_digest");
  RA8_CHECK_NULL_PTR(out_bound, s_tag, "bind: out_bound");
 
  uint8_t size_le[k_ra8_ota_size_field_bytes] = {};
  for (uint8_t i = 0U; i < (uint8_t)k_ra8_ota_size_field_bytes; ++i) {
    size_le[i] =
      (uint8_t)(manifest->image_size_bytes >> ((uint32_t)i * (uint32_t)k_ra8_ota_octet_bits));
  }
 
  /* Parallel arrays: the fixed-width segments hashed in order, and their byte
   * counts. Kept in step by the static_assert below. */
  const uint8_t* const segments[] = {
    (const uint8_t*)manifest->version,
    (const uint8_t*)manifest->image_url,
    size_le,
    image_digest,
  };
  const uint32_t lengths[] = {
    (uint32_t)k_ra8_ota_version_str_bytes,
    (uint32_t)k_ra8_ota_url_max_bytes,
    (uint32_t)sizeof size_le,
    (uint32_t)k_ra8_ota_sha256_bytes,
  };
  static_assert(sizeof segments / sizeof segments[0] == sizeof lengths / sizeof lengths[0],
                "segments[] and lengths[] must describe the same number of chunks");
 
  ra8_err_t e = g_ra8_ota_cfg.crypto.sha256_init(g_ra8_ota_cfg.crypto.ctx);
  if (e != k_ra8_ok) {
    return e;
  }
  for (uint8_t i = 0U; i < (uint8_t)(sizeof segments / sizeof segments[0]); ++i) {
    e = g_ra8_ota_cfg.crypto.sha256_update(g_ra8_ota_cfg.crypto.ctx, segments[i], lengths[i]);
    if (e != k_ra8_ok) {
      return e;
    }
  }
  return g_ra8_ota_cfg.crypto.sha256_final(g_ra8_ota_cfg.crypto.ctx, out_bound);
}

ra8_err_t ra8_ota_verify_signature(const ra8_ota_manifest_t* manifest)
{
  if (!g_ra8_ota_initialized) {
    return k_ra8_err_not_initialized;
  }
  RA8_CHECK_NULL_PTR(manifest, s_tag, "manifest");
  if (g_ra8_ota_state != k_ra8_ota_state_verifying) {
    return k_ra8_err_invalid_state;
  }
 
  uint8_t   digest[k_ra8_ota_sha256_bytes] = {};
  ra8_err_t e                              = internal_rehash_bank(manifest, digest);
  if (e != k_ra8_ok) {
    priv_ota_set_state(k_ra8_ota_state_error, e);
    return e;
  }
  /* Constant-time compare: this digest gates the ECDSA signature check, so a
   * data-dependent early-out would leak how many leading bytes of the expected
   * hash matched -- a byte-at-a-time forgery primitive (T5-12). */
  if (!ra8_ct_equal(digest, manifest->image_sha256, k_ra8_ota_sha256_bytes)) {
    priv_ota_set_state(k_ra8_ota_state_error, k_ra8_err_crc_mismatch);
    return k_ra8_err_crc_mismatch;
  }
  /* Bind the manifest metadata (version/url/size) into the material the ECDSA
   * signature authenticates so a forged version (anti-rollback bypass), a
   * redirected URL, or a changed size cannot ride a signature made over the bare
   * image digest (T5-05). */
  uint8_t bound[k_ra8_ota_sha256_bytes] = {};
  e                                     = internal_bind_manifest_material(manifest, digest, bound);
  if (e != k_ra8_ok) {
    priv_ota_set_state(k_ra8_ota_state_error, e);
    return e;
  }
  e = g_ra8_ota_cfg.crypto.ecdsa_verify(g_ra8_ota_cfg.crypto.ctx,
                                        g_ra8_ota_cfg.pubkey_handle,
                                        bound,
                                        manifest->signature,
                                        manifest->signature_len);
  if (e != k_ra8_ok) {
    priv_ota_set_state(k_ra8_ota_state_error, k_ra8_err_hw_error);
    return k_ra8_err_hw_error;
  }
  priv_ota_set_state(k_ra8_ota_state_committing, k_ra8_ok);
  return k_ra8_ok;
}