Skip to content

Experimental support for pkcs#11 #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
junkmejl63 wants to merge 8 commits into
base: master
Choose a base branch
from
Open

Experimental support for pkcs#11 #5

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c632233
Experimental support for pkcs#11
junkmejl63 Jan 13, 2025
0a58176
PKCS#11 support
junkmejl63 Jan 30, 2025
1a09893
Fixed a defect and added two checks
junkmejl63 Feb 12, 2025
127059e
Reverted to original placement of cst path
junkmejl63 Mar 11, 2025
65e66b7
Updated pkcs11 hab4 example
junkmejl63 Mar 11, 2025
7f13476
Added support for i.MX8M
junkmejl63 Mar 11, 2025
a8844c2
adding .gitignore
junkmejl63 Mar 11, 2025
22eb540
Updates
junkmejl63 Jun 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,27 @@ Build this tool using `make` command.

---

### Sign images using hardware backed cryptographic keys "--pkcs11"
This introduces a few changes to nxp-cst--signer for secure hardware singing.
This code is experimental, and has been tested with AHAB mimx9352.

Steps required
- Works currently on linux
- build nxp-cst-signer
- build cst-3.4.1 (make sure the copmiled binary is in ${CST_PATH}/code/build director)
- make sure that you have PKCS11_MODULE_PATH to the pkcs#11 library when executing cst-signer
- make sure to set the PKCS#11 as key in the csf.

Note:
- The benfit of using this is that it protects private key from exposure.
- Make sure that you use a have a recoverable backup of your private key.
- The solution protects the private key from exposure of normal usage.

PKCS#11 is expeimental support is added for linux, append --pkcs11
In order for this to work, PKCS11_MODULE_PATH must be set before invoking

@utkarshguptanxp utkarshguptanxp Mar 10, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We will reword this description. CST does have HSM docker environment to experiment with this feature, so would refer to it as well.

@junkmejl63 junkmejl63 Mar 11, 2025

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quite still experimental, still working on it, have also made some adjustment for it to work with i.MX8MN and i.MX8MP.


----

### Run

To run this tool, along with CST, you would also need to have the CSF config
Expand Down
5 changes: 4 additions & 1 deletion inc/cst_signer.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
Command line arguments
************************/
/* Valid short command line option letters. */
const char* const short_opt = "hfdi:o:c:";
const char* const short_opt = "hfdi:o:c:p:";

/* Valid long command line options. */
const struct option long_opt[] =
Expand All @@ -30,6 +30,7 @@ const struct option long_opt[] =
{"offset", required_argument, 0, 'o'},
{"debug", no_argument, 0, 'd'},
{"fdt-debug", no_argument, 0, 'f'},
{"pkcs11", no_argument, 0, 'p'},
{"help", no_argument, 0, 'h'},
{NULL, 0, NULL, 0}
};
Expand All @@ -42,6 +43,7 @@ const char* desc_opt[] =
"(Optional) Offset to the start of image",
"(Optional) Enable debug information",
"(Optional) FDT debug information",
"(Optional) Enable pkcs#11 signing. Currently only Linux support, and for cst-3.4.1 you must compile the source",
"This text",
NULL
};
Expand Down Expand Up @@ -186,6 +188,7 @@ static bool g_debug = 0;
static char *g_csf_cfgfilename = NULL;
extern uint32_t g_image_offset;
static char *g_cst_path = NULL;
static bool g_pkcs11 = 0; // static to enable pkcs#11 signing

unsigned char g_ivt_v1_mask[] = {0xFF,0xFF,0xFF,0xF0};
unsigned char g_ivt_v1[] = {0xD1,0x00,0x20,0x41};
Expand Down
62 changes: 55 additions & 7 deletions src/cst_signer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,17 @@ int sign_csf(char *ifname, char *ofname)
return -E_FAILURE;
}
#if defined(__linux__)
if (0 > (snprintf(sys_cmd, SYS_CMD_LEN, "%s/linux64/bin/cst ", g_cst_path))) {
const char *sz_bin_path="/linux64/bin/cst";
const char *sz_extra_venv="";
char tmp_sz_buf[128];
if ( g_pkcs11 ) { // pkcs#11 - extend with ENV variable and modify to compiled cst
#define PKCS11_MODULE_PATH_VAR "PKCS11_MODULE_PATH"
sprintf( tmp_sz_buf, "%s=%s && ", PKCS11_MODULE_PATH_VAR, getenv(PKCS11_MODULE_PATH_VAR)); // The last space is important!
sz_extra_venv=tmp_sz_buf;
sz_bin_path="/code/build/cst";
}

if (0 > (snprintf(sys_cmd, SYS_CMD_LEN, "%s%s%s ", sz_extra_venv, g_cst_path, sz_bin_path))) {
fprintf(stderr, "ERROR: System command build unsuccessful. Exiting.\n");
return -E_FAILURE;
}
Expand All @@ -139,8 +149,12 @@ int sign_csf(char *ifname, char *ofname)
#else
#error Unsupported OS
#endif

if (0 > (snprintf(sys_cmd + strlen(sys_cmd), (SYS_CMD_LEN - strlen(sys_cmd)), "--i %s --o %s", ifname, ofname))) {

const char *sz_cmd_format = "--i %s --o %s";
if ( g_pkcs11 ) {
sz_cmd_format = "-b pkcs11 --i %s --o %s"; // use pkcs11
}
if (0 > (snprintf(sys_cmd + strlen(sys_cmd), (SYS_CMD_LEN - strlen(sys_cmd)), sz_cmd_format, ifname, ofname))) {
fprintf(stderr, "ERROR: System command build unsuccessful. Exiting.\n");
return -E_FAILURE;
}
Expand Down Expand Up @@ -529,8 +543,17 @@ static int create_csf_file_v3(char *csf_filename, char *ifname, csf_params_t *cs
cfg_parser(fp_cfg, rvalue, RSIZE, "srk_source");
if ('\0' == rvalue[0])
fprintf(fp_csf_file, "\tSource = \"%s/crts/SRK1_sha256_prime256v1_v3_ca_crt.pem\"\n", g_cst_path);
else
fprintf(fp_csf_file, "\tSource = \"%s/crts/%s\"\n", g_cst_path, rvalue);
else {
if ( 0 == g_pkcs11 ) {
DEBUG("Source = \"%s/crts/%s\"\n", g_cst_path, rvalue);
fprintf(fp_csf_file, "\tSource = \"%s/crts/%s\"\n", g_cst_path, rvalue);

} else { // use PKCS#11
DEBUG("PKCS11:\n");

@kadirc kadirc Jan 30, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line results in a syntax error because the VA_ARGS is empty, leading to an extra comma before the closing parenthesis.

I get following error trying to compile this PR:

| In file included from cst_signer.c:9:
| cst_signer.c: In function ‘create_csf_file_v3’:
| ../inc/cst_signer.h:67:107: error: expected expression before ‘)’ token
|    67 |                                     printf("%s:%s:%d: " fmt, __FILE__, __FUNCTION__, __LINE__, __VA_ARGS__); \
|       |                                                                                                           ^
| cst_signer.c:552:17: note: in expansion of macro ‘DEBUG’
|   552 |                 DEBUG("PKCS11:\n");
|       |                 ^~~~~

Following change to the macro fixes my problem:

--- a/inc/cst_signer.h
+++ b/inc/cst_signer.h
@@ -64,7 +64,7 @@ const char* desc_opt[] =
 
 #define DEBUG(fmt, ...)     do { \
                                 if (1 == g_debug) { \
-                                    printf("%s:%s:%d: " fmt, __FILE__, __FUNCTION__, __LINE__, __VA_ARGS__); \
+                                    printf("%s:%s:%d: " fmt, __FILE__, __FUNCTION__, __LINE__, ##__VA_ARGS__); \
                                 } \
                             } while(0)

https://github.com/nxp-imx-support/nxp-cst-signer/blob/c632233fc5cf7186740d143c180478c76758580a/inc/cst_signer.h#L65

@petergullberg petergullberg Jan 30, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed it, I must have added between testing and comitting (I'm not an expert on git).
Also added some details on how to find the pkcs#11 url, and an example (that must be changed), on PKCS#11 URL in the cfg.

DEBUG("Source = %s\n", rvalue);
fprintf(fp_csf_file, "\tSource = \"%s\"\n", rvalue);
}
}

cfg_parser(fp_cfg, rvalue, RSIZE, "srk_source_index");
if ('\0' == rvalue[0])
Expand Down Expand Up @@ -1094,7 +1117,18 @@ static int generate_csf_v1(int idx, char *csf_file)
}

#if defined(__linux__)
if (0 > (snprintf(sys_cmd, SYS_CMD_LEN, "%s/linux64/bin/cst ", g_cst_path))) {
const char *sz_bin_path="/linux64/bin/cst";
const char *sz_extra_venv="";
char tmp_sz_buf[128];
if ( g_pkcs11 ) { // do some trckling
#define PKCS11_MODULE_PATH_VAR "PKCS11_MODULE_PATH"
sprintf( tmp_sz_buf, "%s=%s && ", PKCS11_MODULE_PATH_VAR, getenv(PKCS11_MODULE_PATH_VAR)); // The last space is important!
sz_extra_venv=tmp_sz_buf;
sz_bin_path="/code/build/cst";
}


if (0 > (snprintf(sys_cmd, SYS_CMD_LEN, "%s%s%s ", sz_extra_venv, sz_bin_path, g_cst_path))) {
fprintf(stderr, "ERROR: System command build unsuccessful. Exiting.\n");
goto err;
}
Expand All @@ -1106,8 +1140,12 @@ static int generate_csf_v1(int idx, char *csf_file)
#else
#error Unsupported OS
#endif
const char *sz_cmd_format = "--i %s --o %s";
if ( g_pkcs11 ) {
sz_cmd_format = "-b pkcs11 --i %s --o %s"; // use pkcs11
}

if (0 > (snprintf(sys_cmd + strlen(sys_cmd), (SYS_CMD_LEN - strlen(sys_cmd)), "--i %s --o %s", csf_ifilename, csf_ofilename))) {
if (0 > (snprintf(sys_cmd + strlen(sys_cmd), (SYS_CMD_LEN - strlen(sys_cmd)), sz_cmd_format, csf_ifilename, csf_ofilename))) {
fprintf(stderr, "ERROR: System command build unsuccessful. Exiting.\n");
goto err;
}
Expand Down Expand Up @@ -1619,6 +1657,16 @@ int main(int argc, char **argv)
print_usage();
exit(EXIT_SUCCESS);
break;
case 'p': // enable pkcs, this command does NOT take 'pkcs11' as option as cst
#if defined(__linux__)
g_pkcs11 = 1;
#else
print_usage();
DEBUG("pkcs#11 only implemented on Linux\n");
exit(EXIT_FAILURE);

#endif
break;
/* Invalid Option */
default:
break;
Expand Down