Skip to content

boot: bootutil: fixes for image encryption support with PSA crypto #2790

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tpambor wants to merge 4 commits into
base: main
Choose a base branch
from
+28 −9
Open

boot: bootutil: fixes for image encryption support with PSA crypto #2790

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
feac818
boot: bootutil: Use MCUBOOT_USE_PSA_CRYPTO to select PSA crypto backend
tpambor Jul 11, 2026
bdcad4e
boot: bootutil: include encrypted_psa.c for MCUBOOT_USE_PSA_CRYPTO
tpambor Jul 11, 2026
bff151d
bootutil: crypto: aes_ctr: allow PSA_CRYPTO together with MBED_TLS
tpambor Jul 15, 2026
3d1c3ba
boot: bootutil: Guard code only used for encryption with EC256/X25519
tpambor Jul 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions boot/bootutil/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,11 +41,18 @@ target_sources(bootutil
)

# Select the FIH delay RNG implementation.
# When the bootloader uses PSA Crypto (CONFIG_BOOT_USE_PSA_CRYPTO), use
# When the bootloader uses PSA Crypto (MCUBOOT_USE_PSA_CRYPTO), use
# psa_generate_random() instead of the legacy mbedTLS entropy + CTR-DRBG
# APIs that were removed in tf-psa-crypto 1.0.
if(CONFIG_BOOT_USE_PSA_CRYPTO)
if(MCUBOOT_USE_PSA_CRYPTO)

@valeriosetti valeriosetti Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see that MCUBOOT_USE_PSA_CRYPTO is set when MCUboot is built from TF-M, but CONFIG_BOOT_USE_PSA_CRYPTO could be set when building from Zephyr (in case TF-M is not enabled in the build). Shouldn't we OR the condition here, so something like:
if(MCUBOOT_USE_PSA_CRYPTO || CONFIG_BOOT_USE_PSA_CRYPTO)
?

@tpambor tpambor Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This CMakeLists.txt isn't used by Zephyr. Zephyr selects it here:

mcuboot/boot/zephyr/CMakeLists.txt

Lines 133 to 137 in 7ad6710

if(CONFIG_BOOT_USE_PSA_CRYPTO)
zephyr_sources(${BOOT_DIR}/bootutil/src/fault_injection_hardening_delay_rng_psa.c)
else()
zephyr_sources(${BOOT_DIR}/bootutil/src/fault_injection_hardening_delay_rng_mbedtls.c)
endif()

with CONFIG_BOOT_USE_PSA_CRYPTO

@valeriosetti valeriosetti Jul 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh ok, sorry for the noise.

target_sources(bootutil PRIVATE src/fault_injection_hardening_delay_rng_psa.c)
else()
target_sources(bootutil PRIVATE src/fault_injection_hardening_delay_rng_mbedtls.c)
endif()

# When the bootloader uses PSA Crypto (MCUBOOT_USE_PSA_CRYPTO), include
# encrypted_psa.c in addition to encrypted.c, which still provides the common
# encrypted image support, when using the PSA Crypto APIs.
if(MCUBOOT_USE_PSA_CRYPTO)
target_sources(bootutil PRIVATE src/encrypted_psa.c)
endif()
18 changes: 13 additions & 5 deletions boot/bootutil/include/bootutil/crypto/aes_ctr.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,23 +4,31 @@
*
* At this point, there are four choices: MCUBOOT_USE_MBED_TLS,
* MCUBOOT_USE_TINYCRYPT, MCUBOOT_USE_PSA_CRYPTO, or
* MCUBOOT_USE_CUSTOM_CRYPTO. It is a compile error if there is not
* exactly one of these defined.
* MCUBOOT_USE_CUSTOM_CRYPTO.
* Note that support for MCUBOOT_USE_PSA_CRYPTO is still experimental and it
* might not support all the crypto abstractions that MCUBOOT_USE_MBED_TLS
* supports. For this reason, it's allowed to have both of them defined, and
* for crypto modules that support both abstractions, the MCUBOOT_USE_PSA_CRYPTO
* will take precedence.
*/

#ifndef __BOOTUTIL_CRYPTO_AES_CTR_H_
#define __BOOTUTIL_CRYPTO_AES_CTR_H_

#include "mcuboot_config/mcuboot_config.h"

#if (defined(MCUBOOT_USE_MBED_TLS) + \
#if defined(MCUBOOT_USE_PSA_CRYPTO) || defined(MCUBOOT_USE_MBED_TLS)
#define MCUBOOT_USE_PSA_OR_MBED_TLS
#endif /* MCUBOOT_USE_PSA_CRYPTO || MCUBOOT_USE_MBED_TLS */

#if (defined(MCUBOOT_USE_PSA_OR_MBED_TLS) + \
defined(MCUBOOT_USE_TINYCRYPT) + \
defined(MCUBOOT_USE_PSA_CRYPTO) + \
defined(MCUBOOT_USE_CUSTOM_CRYPTO)) != 1
#error "One crypto backend must be defined: either MBED_TLS or TINYCRYPT or PSA or CUSTOM_CRYPTO"
#endif

#if defined(MCUBOOT_USE_MBED_TLS)
/* PSA_CRYPTO takes precedence over MBED_TLS */
#if defined(MCUBOOT_USE_MBED_TLS) && !defined(MCUBOOT_USE_PSA_CRYPTO)
#include "bootutil/crypto/aes_ctr_mbedtls.h"
#endif /* MCUBOOT_USE_MBED_TLS */

Expand Down
2 changes: 1 addition & 1 deletion boot/bootutil/src/encrypted.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
#endif

#if defined(MCUBOOT_ENCRYPT_EC256) || defined(MCUBOOT_ENCRYPT_X25519)
#include "bootutil/crypto/common.h"
#include "bootutil/crypto/sha.h"
#include "bootutil/crypto/hmac_sha256.h"
#include "mbedtls/oid.h"
Expand All @@ -49,7 +50,6 @@
#include "bootutil/image.h"
#include "bootutil/enc_key.h"
#include "bootutil/sign_key.h"
#include "bootutil/crypto/common.h"
#include "bootutil/bootutil_log.h"

BOOT_LOG_MODULE_DECLARE(mcuboot);
Expand Down
6 changes: 5 additions & 1 deletion boot/bootutil/src/encrypted_psa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,11 @@
#include <inttypes.h>
#include <string.h>

#if defined(MCUBOOT_ENCRYPT_EC256) || defined(MCUBOOT_ENCRYPT_X25519)
/* We are not really using the MBEDTLS but need the ASN.1 parsing functions */
#define MBEDTLS_ASN1_PARSE_C

#include "bootutil/crypto/common.h"
#include "bootutil/crypto/sha.h"
#include "mbedtls/build_info.h"
#include "mbedtls/oid.h"
Expand All @@ -36,11 +38,11 @@
#if !defined(MBEDTLS_OID_EC_GRP_SECP256R1)
#define MBEDTLS_OID_EC_GRP_SECP256R1 "\x2a\x86\x48\xce\x3d\x03\x01\x07"
#endif
#endif /* defined(MCUBOOT_ENCRYPT_EC256) || defined(MCUBOOT_ENCRYPT_X25519) */

#include "bootutil/image.h"
#include "bootutil/enc_key.h"
#include "bootutil/sign_key.h"
#include "bootutil/crypto/common.h"

#include "bootutil_priv.h"
#include "bootutil/bootutil_log.h"
Expand Down Expand Up @@ -252,6 +254,7 @@ int bootutil_aes_ctr_set_key(bootutil_aes_ctr_context *ctx, const uint8_t *k)
}

#if defined(MCUBOOT_ENC_IMAGES)
#if defined(MCUBOOT_ENCRYPT_EC256) || defined(MCUBOOT_ENCRYPT_X25519)
extern const struct bootutil_key bootutil_enc_key;
/*
* Decrypt an encryption key TLV.
Expand Down Expand Up @@ -441,6 +444,7 @@ boot_decrypt_key(const uint8_t *buf, uint8_t *enckey)

return 0;
}
#endif /* defined(MCUBOOT_ENCRYPT_EC256) || defined(MCUBOOT_ENCRYPT_X25519) */

int bootutil_aes_ctr_encrypt(bootutil_aes_ctr_context *ctx, uint8_t *counter,
const uint8_t *m, uint32_t mlen, size_t blk_off, uint8_t *c)
Expand Down
Loading