summaryrefslogtreecommitdiffstats
path: root/crypto/Makefile
Commit message (Collapse)AuthorAgeFilesLines
* crypto: add JSON Web Token (JWT) supportAhmad Fatoum2023-11-011-0/+2
| | | | | | | | | | | | | | | | | | | | | JSON Web Token is a proposed Internet standard for creating tokens with optional signature and/or optional encryption whose payload holds JSON that asserts some number of claims. The tokens are signed either using a private secret or a public/private key. In the context of barebox, a JSON Web Token can be used as unlock token for a system: By default, the system would be locked and only boot signed payloads, but when a valid unlock token is provided, board code can selectively allow access to disallowed features, such as booting unsigned payloads or provide access to the console and shell. This commit adds first support for JSON Web Tokens on top of the already existing JSON support. RS256 is the only currently supported format, but more may be added in future. Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Link: https://lore.barebox.org/20231023143122.1760217-3-a.fatoum@pengutronix.de Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: crc32: enable for PBLSascha Hauer2023-09-041-1/+1
| | | | | | A crc32 implementation might be useful for PBL as well, so enable it. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* pbl: export pbl_barebox_verifyAhmad Fatoum2022-08-221-2/+1
| | | | | | | | | | | | | There's no downside to always build the digest verification code in PBL and export pbl_barebox_verify to access it. This allows board code to use the function for verifying other firmware blobs and CONFIG_PBL_VERIFY_PIGGY=y will remain to enable the verification at barebox proper extraction time. Code not using it will have the function sections garbage collected by the linker, so no functional change. Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Link: https://lore.barebox.org/20220818050447.2072932-2-a.fatoum@pengutronix.de Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: skip make dependency for CONFIG_CRYPTO_RSA_KEY=__ENV__*Bastian Krause2022-06-271-1/+1
| | | | | | | | | | | | | | | | CONFIG_CRYPTO_RSA_KEY allows referring to environment variables, e.g. __ENV__FOO tells barebox' rsatoc to use the value of the environment variable "FOO". There is no point in creating a make dependency for such values. Actually looking into the environment variable and deciding whether it is a PKCS#11 URI or a file seems unnecessarily complex. Let's filter out these special values and leave the error handling to rsatoc. Fixes: a05ac5545c ("crypto: simplify $(srctree)/ handling and remove config_filename macro") Signed-off-by: Bastian Krause <bst@pengutronix.de> Link: https://lore.barebox.org/20220624141632.380159-1-bst@pengutronix.de Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: simplify $(srctree)/ handling and remove config_filename macroSascha Hauer2022-05-041-3/+9
| | | | | | | | | The config_filename macro has been dropped from mainline in b8c96a6b466c ("certs: simplify $(srctree)/ handling and remove config_filename macro"). Adopt the mechanism it has been replaced with for barebox. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* treewide: add SPDX-License-Identifier for Kbuild/KconfigAhmad Fatoum2022-01-051-0/+2
| | | | | | | | | | | | | | | To verify only Kconfig/Makefile is touched: git show --numstat --format=oneline HEAD | grep -v 'Kconfig\|Makefile' will print only arch/powerpc/Kbuild. To verify nothing unexpected is added: git show -U0 | grep '^-[^-]\|^+[^+]' | sort -u Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Link: https://lore.barebox.org/20220103120539.1730644-3-a.fatoum@pengutronix.de Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: add crypto_memneq()Sascha Hauer2021-07-301-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds crypto_memneq() from Linux for the same reason it is present in Linux. From the commit message adding it: When comparing MAC hashes, AEAD authentication tags, or other hash values in the context of authentication or integrity checking, it is important not to leak timing information to a potential attacker, i.e. when communication happens over a network. Bytewise memory comparisons (such as memcmp) are usually optimized so that they return a nonzero value as soon as a mismatch is found. E.g, on x86_64/i5 for 512 bytes this can be ~50 cyc for a full mismatch and up to ~850 cyc for a full match (cold). This early-return behavior can leak timing information as a side channel, allowing an attacker to iteratively guess the correct result. This patch adds a new method crypto_memneq ("memory not equal to each other") to the crypto API that compares memory areas of the same length in roughly "constant time" (cache misses could change the timing, but since they don't reveal information about the content of the strings being compared, they are effectively benign). Iow, best and worst case behaviour take the same amount of time to complete (in contrast to memcmp). Note that crypto_memneq (unlike memcmp) can only be used to test for equality or inequality, NOT for lexicographical order. This, however, is not an issue for its use-cases within the crypto API. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* rsa: Allow to directly compile in rsa public keysSascha Hauer2019-10-151-0/+10
| | | | | | | | | | | | | So far we relied on the U-Boot mkimage tool to generate us device tree snippets containing rsa public keys which we then compiled into barebox. Make this easier and allow to directly specify a filename or PKCS#11 URI in Kconfig. With this we no longer need the U-Boot mkimage tool here and no more external steps to prepare device tree snippets. With this rsa public keys can be directly compiled as C structs into barebox which is much more direct than putting it into the device tree. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* pbl: add sha256 and piggy verification to PBLRouven Czerwinski2019-08-071-0/+2
| | | | | | | | | Extract the necessary functions from sha256 into a PBL headder and add a verification function to the PBL. The function will be called before the individual architectures decompress functions is run. Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crc: Add PBL variant for crc_itu_t()Sascha Hauer2019-03-041-1/+1
| | | | | | | Enable crc_itu_t() for PBL. For the PBL use the slower-but-smaller variant without table. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crc: import crc_itu_t() from kernelSascha Hauer2019-03-041-1/+1
| | | | | | | | Our cyc_crc16() function is the same function as crc_itu_t() in the Linux kernel. Import and use crc_itu_t() from the Kernel for consistency. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: add CRC32 digestYegor Yefremov2016-05-251-0/+1
| | | | | | | CRC32 digest can be used to check CRC32 hashes in FIT images etc. Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: add RSA supportSascha Hauer2016-01-261-0/+1
| | | | | | | Taken from U-Boot and adopted to barebox with little changes. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
* crypto: add simple keystoreMarc Kleine-Budde2015-11-271-0/+1
| | | | | | | | This patch adds a simple keystore to barebox. The keystore implements a simple key-value store to hold arbitrary values. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: prepare to allow multiple digest driverJean-Christophe PLAGNIOL-VILLARD2015-03-271-7/+7
| | | | | | | | | | This will allow to have hw driver or asm optimised driver. Use a priority level to determine which one to use at runtime. The generic one will be 0. Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: add pbkdf2 hmac key generatorJean-Christophe PLAGNIOL-VILLARD2015-03-191-0/+2
| | | | | | | | | | this will allow to generate a KEY + IV based on a password and salt for AES encryption/decryption as example or simply the key for hmac or rsa from text password Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* digest: add HMAC support for md5, sha1, sha224, sha256, sha384, sha512Jean-Christophe PLAGNIOL-VILLARD2015-03-131-0/+1
| | | | | | | the hmac algo will be registered as hmac(%s) such as hmac(sha256) Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: add sha384 & sha512 supportJean-Christophe PLAGNIOL-VILLARD2015-03-121-0/+2
| | | | | Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* digest: move digest.c to cryptoJean-Christophe PLAGNIOL-VILLARD2015-03-121-0/+1
| | | | | | | with not the rest of the implementation Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: Add crc7 functionFranck Jullien2011-11-251-0/+1
| | | | | | | This function in used by the MCI over SPI driver. Signed-off-by: Franck Jullien <franck.jullien@gmail.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* crypto: add sha224 supportJean-Christophe PLAGNIOL-VILLARD2011-10-121-1/+2
| | | | | | | | the sha224sum is nearly the same as sha256sum except for the init of the context and the hash length Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* move digest to crypto/Jean-Christophe PLAGNIOL-VILLARD2011-10-121-0/+5
Signed-off-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
generated by cgit v1.2.3 (git 2.39.1) at 2024-04-19 23:28:26 +0000