Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for creating self-decrypting binaries, and use 4-way AES key shares instead of just the AES key #207

Open
wants to merge 45 commits into
base: develop
Choose a base branch
from
Open

Add support for creating self-decrypting binaries, and use 4-way AES key shares instead of just the AES key #207

wants to merge 45 commits into from

Conversation

will-v-pi
Copy link
Contributor

@will-v-pi will-v-pi commented Feb 24, 2025 •
edited
Loading

This adds support for creating self-decrypting binaries, which can be created using

picotool encrypt --sign --embed hello_world.elf hello_world.enc.elf my_aesfile.pem my_sigfile.pem my_otp.json

This introduces a breaking change to picotool encrypt to take a 4-way AES key share, rather than just taking an AES key, as this makes it simpler to mask the power signature when decrypting the binary. The only difference from a user perspective is that they now need to use a 1024 bit binary file instead of the 256 bit file used before. The AES key is derived from the 4-way share as follows:

aes_key.words[i] = aes_key_share.words[i*4]
                 ^ aes_key_share.words[i*4 + 1]
                 ^ aes_key_share.words[i*4 + 2]
                 ^ aes_key_share.words[i*4 + 3];

This also introduces a breaking change that picotool encrypt now requires an IV salt binary to be passed to it as the 4th file, so the signing_key is now the 5th file and the OTP JSON is now the 6th file.

This PR requires raspberrypi/pico-sdk#2233 so should be merged after that

@will-v-pi will-v-pi added this to the 2.1.2 milestone Feb 24, 2025
@will-v-pi will-v-pi requested a review from kilograham February 24, 2025 15:20
This was referenced Feb 24, 2025
Open
Open
@will-v-pi
Use 4-way key shares for AES private keys
89b792e 
The privateaes.bin key file is now 4x256bit numbers (A,B,C,D), and the AES key X is A^B^C^D
@will-v-pi
Remove check that ELF segments are between metadata blocks
011111d 
This is not required, as you can still load data outside of the region between the metadata blocks which contain the binary - for example, loading code into scratch memory.
@will-v-pi
Fix overlapping memory ranges issue for encrypted binaries
90e2216
@will-v-pi
Update share as word-wise
c02717f
@will-v-pi
Add enc_bootloader binary
8e5464a 
You can now use `picotool encrypt --embed ...` to create a self-decrypting binary, using enc_bootloader
@will-v-pi
Apply encrypted-example 6de8084b6eda
4220510
@will-v-pi
Fixup no libusb build
6186b68
@will-v-pi
Remove debug prints, and add USE_USB_DPRAM option
3d0857c
@will-v-pi
Reduce binary size
1cd9a30 
Add pico_minimize_runtime and some other runtime skips

Re-use scratch_y for the workarea, without overwriting the stack
@will-v-pi
Remove pico_rand and use boot random instead
3242ec5 
Rejig everything to fit into scratch, so full 512k of SRAM is available for the user
@will-v-pi
Update precompiled enc_bootloader.elf
a00a9a1
@will-v-pi
Remove unused use_usb_dpram
1a585d2
@will-v-pi
Re-jig to create more space for the AES code
02b7afa 
Move vtor into main code body, leaving only binary info and embedded block at start

Reduce initial stack size, then increase after AES code to overwrite the workspace

Reduce vector table IRQs (requires pico-sdk pr 2200)
@will-v-pi
Integrate new aes.S
0cd7f74 
Uses a modified version of get_rand_32 temporarily, until the aes.S code is modified to use rom_get_boot_random

From commit d4f4b2a7d9f00
@will-v-pi
Use minimal vector table
16b7006 
Add temporary workaround to clone SDK branch with support for PICO_MINIMAL_VECTOR_TABLE define
@will-v-pi
Pass TBYB and version from encrypted binary metadata to the decryptio…
f5a09f4 
…n stage metadata

This means that the bootrom will treat the binary with embedded decryption stage the same as the non-encrypted binary, for rollback/versions/tbyb/etc
@will-v-pi
Add --otp-key-page argument
b76f4e4 
Allows specifying the OTP page the AES key is stored on
@will-v-pi
Update aes.S
00db02b 
From commit 3d93bdd06c55
@will-v-pi
Shrink enc_bootloader.c code further
857fa02 
Now fits inside 2K, so moved to 0x20081800, giving more room for AES workspace
@will-v-pi
Add otp file to enc
684b6f6
@will-v-pi
Increase stack size by 0x80 to provide some headroom
bb62382
@will-v-pi
Integrate latest aes.S code
f19f0ce 
From commit 052dab85a9ac38
@will-v-pi
Use ROSC randomisation instead of CK_JITTER
952dbd4
@will-v-pi
Fix SDK branch for enc_bootloader
956f514
@will-v-pi
Add comments and slight size reduction
713f9e9
@will-v-pi
Uncomment chaff assertion
7bb027f
@will-v-pi
Shrink IV storage size
471efe9 
Use bi_ptr_string instead of 4 bi_ptr_int32s
@will-v-pi
Update enc_bootloader.elf with latest
242f189
@will-v-pi
Rejig clock init to prevent overclocking
9a3e4fe 
Now goes through configurations until it finds one under 150MHz
@will-v-pi
Update with latest aes.S
081cb62 
From commit 59c6d71d7
@will-v-pi
Seed ROSC random using rstate_lfsr
594b87c
@will-v-pi
Use CK_JITTER to enable/disable ROSC randomisation
34c4383
@will-v-pi
Add IV XOR code, but turn it off with IV0_XOR for now
96f9ce1
@will-v-pi
Disable calibration using XOSC by default
f6a0fd7
@will-v-pi
Update with latest aes.S
7eae923 
From commit 6e6df5a5769
@will-v-pi
Add fast-rosc option
6657416 
Default to the 110MHz ROSC config, but can be increased to the 180MHz config by setting --fast-rosc
@will-v-pi
clock_configure_mhz no longer used
6829265
@will-v-pi
Tidy up indents in CMakeLists.txt
e3fcac7
@will-v-pi
Remove CK_JITTER from aes.S, as this is now handled in the C code
333d571
@will-v-pi
Throw error when using AES key share file of incorrect size
a8bfde0
@will-v-pi
Incorporate latest aes.S code, and add IV salt
28c0335 
Now uses IV salt in OTP, and IV0_XOR is now enabled and fixed

From commit 627274d21a2d6a30
@will-v-pi will-v-pi marked this pull request as ready for review February 26, 2025 13:00
@will-v-pi
Update enc_bootloader.elf with latest
401be66
@will-v-pi
Remove pico-sdk branch handling
92ffec2 
This will now fail CI checks until raspberrypi/pico-sdk#2233 is merged
@will-v-pi
Update aes.S
c68be91 
From commit d831bb59
@will-v-pi
Add USE_MBEDTLS variant
e8ef20a 
This variant runs from xip_sram, and uses the MbedTLS AES code instead. This is much faster, but not secure against side channel attacks.

Currently no way to enable it, but that can be added if it's going to be useful
@will-v-pi will-v-pi mentioned this pull request Feb 28, 2025
Open
@will-v-pi will-v-pi linked an issue Feb 28, 2025 that may be closed by this pull request
"ERROR: Found overlapping memory" on encrypted binary #210
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kilograham kilograham Awaiting requested review from kilograham

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
2.1.2
Development

Successfully merging this pull request may close these issues.

"ERROR: Found overlapping memory" on encrypted binary
1 participant
@will-v-pi