Thanks Philippe and Ayoub, On Tue, Sep 1, 2026 at 11:58 AM Philippe Reynes <[email protected]> wrote: > > Hi Raymond and Ayoub, > > Le 01/09/2026 à 17:19, Raymond Mao a écrit : > > This Mail comes from Outside of SoftAtHome: Do not answer, click links or > > open attachments unless you recognize the sender and know the content is > > safe. > > > > Hi Ayoub, > > > > On Tue, Sep 1, 2026 at 8:15 AM Ayoub Zaki <[email protected]> wrote: > >> U-Boot can sign FIT images with ECDSA on the host but on most boards it > >> cannot verify them. ECDSA verification is dispatched through a > >> UCLASS_ECDSA driver and the only implementations in tree are backed by > >> hardware or firmware such as STM32MP ROM API. > >> On any other platform enabling CONFIG_ECDSA_VERIFY builds the > >> crypto_algo entries but ecdsa_verify() fails with -ENODEV because > >> uclass_first_device_err() finds no device. > >> > >> This series adds a software UCLASS_ECDSA driver built on the MbedTLS ECP > >> library which is already vendored in tree but currently reachable only > >> from the TLS bundle. > >> > >> Testing: > >> - 33 tests pass on sandbox (30 existing RSA vboot cases, 2 new ECDSA > >> cases, and the host-side test_fit_ecdsa) > >> - the new tests cover, for each curve, a valid signature that verifies > >> and boots, a tampered signature that is rejected, and a valid > >> signature checked against a different public key that is rejected > >> - I confirmed the tests actually catch a broken driver by making > >> verify() return 0 unconditionally: both fail and pass again once > >> reverted > >> - no regressions: a baseline build of the same test selection gives an > >> identical pass/fail/error count, plus the two new tests > >> - each patch builds individually, so the series bisects > >> - a MBEDTLS_LIB_TLS build was checked by hand, since no defconfig > >> enables it and CI would not catch a break there > >> > > Please use the new email list '[email protected]'. > > Can you please rebase on the existing ECDSA series from Philippe > > below? It is reviewed and pending merge. > > https://lore.kernel.org/u-boot/[email protected]/ > > > Talking about this serie, I've just sent a v9 as requested by Tom. > There are only 2 changes in this v9: > - rebase on branch next > - the cover letter is updated to better describe what is done in the serie >
I will look at the v9 patch set and return to you shortly. Regards, Raymond > > > Thanks and regards, > > Raymond > Best regards, > Philippe > > > > > >> Open points I would appreciate opinions on: > >> > >> - No SPL support. It would need SPL_ECDSA_VERIFY_MBEDTLS and > >> SPL_MBEDTLS_LIB_ECDSA, and the size cost matters far more there, so I > >> left it out of this series rather than guess at what is acceptable. > >> > >> - ecdsa_verify() uses uclass_first_device_err() so on a board with > >> both a hardware engine and this software driver the choice is > >> arbitrary bind order. No board is in that position today, but the > >> selection probably wants to be explicit before one is. > >> > >> Ayoub Zaki (7): > >> lib: ecdsa: read private keys from '<name>.key' like RSA > >> mbedtls: factor out shared bignum and ASN.1 objects > >> mbedtls: add ECDSA library module > >> lib: ecdsa: add software ECDSA verification using MbedTLS > >> test: vboot: add ECDSA verified boot tests > >> doc: fit: document ECDSA key creation and verification > >> MAINTAINERS: add an entry for lib/ecdsa > >> > >> MAINTAINERS | 7 + > >> configs/sandbox_defconfig | 2 + > >> doc/usage/fit/signature.rst | 38 +++++ > >> lib/ecdsa/Kconfig | 12 ++ > >> lib/ecdsa/Makefile | 1 + > >> lib/ecdsa/ecdsa-libcrypto.c | 2 +- > >> lib/ecdsa/ecdsa-mbedtls.c | 141 +++++++++++++++++ > >> lib/mbedtls/Kconfig | 45 ++++++ > >> lib/mbedtls/Makefile | 29 ++-- > >> lib/mbedtls/mbedtls_def_config.h | 19 +++ > >> test/py/tests/test_vboot_ecdsa.py | 148 ++++++++++++++++++ > >> test/py/tests/vboot/sign-configs-ecdsa256.its | 45 ++++++ > >> test/py/tests/vboot/sign-configs-ecdsa384.its | 45 ++++++ > >> test/py/tests/vboot/sign-images-ecdsa256.its | 42 +++++ > >> test/py/tests/vboot/sign-images-ecdsa384.its | 42 +++++ > >> 15 files changed, 606 insertions(+), 12 deletions(-) > >> create mode 100644 lib/ecdsa/ecdsa-mbedtls.c > >> create mode 100644 test/py/tests/test_vboot_ecdsa.py > >> create mode 100644 test/py/tests/vboot/sign-configs-ecdsa256.its > >> create mode 100644 test/py/tests/vboot/sign-configs-ecdsa384.its > >> create mode 100644 test/py/tests/vboot/sign-images-ecdsa256.its > >> create mode 100644 test/py/tests/vboot/sign-images-ecdsa384.its > >> > >> -- > >> 2.43.0 > >>
