ra8_rot.h

Go to the documentation of this file.

 
#pragma once
 
#ifdef __cplusplus
extern "C" {
#endif
 
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_err.h"

typedef enum : uint8_t {
  k_ra8_rot_digest_bytes = 32U, 
  k_ra8_rot_sig_bytes    = 64U, 
  k_ra8_rot_pubkey_bytes = 65U, 
} ra8_rot_size_t;

typedef enum : uint32_t {
  k_ra8_rot_trailer_magic = 0x524F5431U, 
  k_ra8_rot_version       = 0x00000001U, 
  k_ra8_rot_body_max      = 0x00100000U, 
} ra8_rot_const_t;

typedef struct {
  uint32_t magic;                          
  uint32_t version;                        
  uint32_t img_version;                    
  uint32_t body_len;                       
  uint32_t sig_len;                        
  uint8_t  digest[k_ra8_rot_digest_bytes]; 
  uint8_t  sig[k_ra8_rot_sig_bytes];       
} ra8_rot_trailer_t;
 
/* Five 32-bit metadata words (magic, version, img_version, body_len, sig_len)
 * precede the digest + signature byte blocks; the assert pins the no-padding
 * layout. The trailing ``+ sizeof(uint32_t)`` accounts for img_version (4 is in
 * the magic-number ignore set; 5 is not, so it is summed via sizeof). */
static_assert(sizeof(ra8_rot_trailer_t) == (4U * sizeof(uint32_t)) + sizeof(uint32_t) +
                                             (uint32_t)k_ra8_rot_digest_bytes +
                                             (uint32_t)k_ra8_rot_sig_bytes,
              "ra8_rot_trailer_t must have no implicit padding");

[[nodiscard]] ra8_err_t
ra8_rot_verify_image(const uint8_t* body, uint32_t body_len, const ra8_rot_trailer_t* trailer);

const ra8_rot_trailer_t* ra8_rot_trailer_after(const void* image_base, uint32_t body_len);

RA8_TEST_HELPER ra8_err_t ra8_rot_root_public_key(const uint8_t** out_key, uint32_t* out_len);
 
#ifdef __cplusplus
}
#endif