Closed chipweinberger closed 1 year ago
Each device has 5 Key slots, so... I suppose I can test 5 times per board. Which is not...too bad.
@mahavirj
Could you look at the code and see if there is anything obviously wrong? The RSA signatures I am generating on the device do not match the signature I'm generating in python.
I think my usage of esp_ds_encrypt_params()
or esp_ds_sign()
might be wrong.
Closing this issue in favor of a new one.
And for the record, virtually fuses are not supported.
They cause ESP_ERR_HW_CRYPTO_DS_HMAC_FAIL
Hi @chipweinberger! Sorry, It is not possible to support the Virtual eFuses because the DS module uses hardware to get the result.
In case you use the Virtual eFuses with DS you will get ESP_ERR_HW_CRYPTO_DS_HMAC_FAIL because the DS hardware reads a given eFuse key block but it is empty, eFuses are stored in RAM, not in eFuse registers, hardware can not reach it. There is no way you need to use the real eFuse mode.
Understood.
it would be great if a test function simulated the DS hardware with similar API, using virtual fuses.
But that it just a request.
With careful planning, I was able to get the DS hardware working with 5 attempts, and 5 burned keys.
@chipweinberger
it would be great if a test function simulated the DS hardware with similar API, using virtual fuses.
What might help here is to have more targets (includes ESP32-S2/C2/S3) supported in our qemu fork here, that way it would be possible to easily try out security features under emulator first and then move to the real physical target. Currently we have only ESP32 support in this but it does not feature DS peripheral. We will try to prioritize support for other targets here.
Virtual efuse feature is mostly for our internal testing purpose, but it definitely can not help in scenarios where peripheral is actually expecting credentials/data from actual efuse block/s. We will add note regarding this in our docs. Thank you for the feedback.
Yes that would be useful. Not all users will be able to use (easily) the simulator due to other hardware constraints, though.
What I am proposing it to completely reimplement the DS hardware in software in ESP-IDF. The software could then read the virtual fuses. I admit, It might be more trouble than it is worth.
Something like this:
#ifdef CONFIG_VIRTUAL_FUSES
ds_software_hal_start(key_id);
#elseif
ds_hal_start();
#endif
I'm not an expert, but the the RSA algorithm is not that complex. The software might be reasonable to maintain. Perhaps you can use mbedtls.
Is there any way to test digital signature code without actually burning fuses?
I'm trying to get ESP Digital Signature working, but
esp_ds_sign()
returnsESP_ERR_HW_CRYPTO_DS_HMAC_FAIL
, likely due toets_hmac_calculate_downstream()
not supporting virtual fuses.Is there anything like
esp_test_ds_sign(uint8_t* hmacKey256, ...)
that lets you pass in the hmac key without actually burning the fuses? Even if it was just implemented in software..The code is quite complicated (reproduced below).
WARNING: this code does not work!
generating Y,M,Rb,MPrime & burning:
uploading private key:
challenge: