Rename cmd_version to cmd_version_openpgp

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>

.github/workflows/nightly.yml

@@ -24,7 +24,7 @@ jobs:
           PICO_SDK_PATH: ../pico-sdk
         run: |
            ./workflows/autobuild.sh pico
-           ./build_pico_openpgp.sh
+           ./build_pico_openpgp.sh --no-eddsa
            ./workflows/autobuild.sh esp32
       - name: Update nightly release
         uses: pyTooling/Actions/releaser@main

CMakeLists.txt

@@ -67,6 +67,7 @@ set(SOURCES ${SOURCES}
         ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/cmd_keypair_gen.c
         ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/cmd_reset_retry.c
         ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/do.c
+        ${CMAKE_CURRENT_LIST_DIR}/src/openpgp/defs.c
 )
 
 set(USB_ITF_CCID 1)

VERSION

@@ -1 +1 @@
-Version=3.4
+Version=3.6

build_pico_openpgp.sh

@@ -1,23 +1,47 @@
 #!/bin/bash
 
 VERSION_MAJOR="3"
-VERSION_MINOR="4-eddsa1"
+VERSION_MINOR="6"
+NO_EDDSA=0
 SUFFIX="${VERSION_MAJOR}.${VERSION_MINOR}"
 #if ! [[ -z "${GITHUB_SHA}" ]]; then
 #    SUFFIX="${SUFFIX}.${GITHUB_SHA}"
 #fi
 
-rm -rf release/*
+if [[ $1 == "--no-eddsa" ]]; then
+    NO_EDDSA=1
+    echo "Skipping EDDSA build"
+fi
+
 mkdir -p build_release
 mkdir -p release
+mkdir -p release_eddsa
+rm -rf -- release/*
+if [[ $NO_EDDSA -eq 0 ]]; then
+    rm -rf -- release_eddsa/*
+fi
 cd build_release
+
 PICO_SDK_PATH="${PICO_SDK_PATH:-../../pico-sdk}"
 board_dir=${PICO_SDK_PATH}/src/boards/include/boards
 for board in "$board_dir"/*
 do
-    board_name="$(basename -- $board .h)"
-    rm -rf *
-    PICO_SDK_PATH="${PICO_SDK_PATH}" cmake .. -DPICO_BOARD=$board_name
+    board_name="$(basename -- "$board" .h)"
+    rm -rf -- ./*
+    PICO_SDK_PATH="${PICO_SDK_PATH}" cmake .. -DPICO_BOARD=$board_name -DSECURE_BOOT_PKEY=../../ec_private_key.pem
     make -j`nproc`
     mv pico_openpgp.uf2 ../release/pico_openpgp_$board_name-$SUFFIX.uf2
 done
+
+# Build with EDDSA
+
+if [[ $NO_EDDSA -eq 0 ]]; then
+    for board in "$board_dir"/*
+    do
+        board_name="$(basename -- "$board" .h)"
+        rm -rf -- ./*
+        PICO_SDK_PATH="${PICO_SDK_PATH}" cmake .. -DPICO_BOARD=$board_name -DSECURE_BOOT_PKEY=../../ec_private_key.pem -DENABLE_EDDSA=1
+        make -j`nproc`
+        mv pico_openpgp.uf2 ../release_eddsa/pico_openpgp_$board_name-$SUFFIX-eddsa1.uf2
+    done
+fi

src/openpgp/cmd_change_pin.c

@@ -29,6 +29,10 @@ int cmd_change_pin() {
     }
     uint8_t pin_len = file_get_data(pw)[0];
     uint16_t r = 0;
+    r = check_pin(pw, apdu.data, pin_len);
+    if (r != 0x9000) {
+        return r;
+    }
     if ((r = load_dek()) != PICOKEY_OK) {
         return SW_EXEC_ERROR();
     }
@@ -38,10 +42,6 @@ int cmd_change_pin() {
             dek[IV_SIZE + i] ^= otp_key_1[i];
         }
     }
-    r = check_pin(pw, apdu.data, pin_len);
-    if (r != 0x9000) {
-        return r;
-    }
     uint8_t dhash[33];
     dhash[0] = apdu.nc - pin_len;
     double_hash_pin(apdu.data + pin_len, apdu.nc - pin_len, dhash + 1);

src/openpgp/cmd_import_data.c

@@ -177,10 +177,13 @@ int cmd_import_data() {
             mbedtls_ecp_keypair_free(&ecdsa);
             return SW_EXEC_ERROR();
         }
+#ifdef MBEDTLS_EDDSA_C
         if (ecdsa.grp.id == MBEDTLS_ECP_DP_ED25519) {
             r = mbedtls_ecp_point_edwards(&ecdsa.grp, &ecdsa.Q, &ecdsa.d, random_gen, NULL);
         }
-        else {
+        else
+#endif
+        {
             r = mbedtls_ecp_mul(&ecdsa.grp, &ecdsa.Q, &ecdsa.d, &ecdsa.grp.G, random_gen, NULL);
         }
         if (r != 0) {

src/openpgp/cmd_internal_aut.c

@@ -37,7 +37,7 @@ int cmd_internal_aut() {
     if (!ef) {
         return SW_REFERENCE_NOT_FOUND();
     }
-    if (wait_button_pressed(EF_UIF_AUT) == true) {
+    if (wait_button_pressed_fid(EF_UIF_AUT) == true) {
         return SW_SECURE_MESSAGE_EXEC_ERROR();
     }
     int r = PICOKEY_OK;

src/openpgp/cmd_pso.c

@@ -66,7 +66,7 @@ int cmd_pso() {
     if (!ef) {
         return SW_REFERENCE_NOT_FOUND();
     }
-    if (wait_button_pressed(pk_fid == EF_PK_SIG ? EF_UIF_SIG : EF_UIF_DEC) == true) {
+    if (wait_button_pressed_fid(pk_fid == EF_PK_SIG ? EF_UIF_SIG : EF_UIF_DEC) == true) {
         return SW_SECURE_MESSAGE_EXEC_ERROR();
     }
     int r = PICOKEY_OK;

src/openpgp/cmd_terminate_df.c

@@ -32,6 +32,6 @@ int cmd_terminate_df() {
         return SW_WRONG_LENGTH();
     }
     initialize_flash(true);
-    scan_files();
+    scan_files_openpgp();
     return SW_OK();
 }

src/openpgp/cmd_version.c

@@ -18,7 +18,7 @@
 #include "openpgp.h"
 #include "version.h"
 
-int cmd_version() {
+int cmd_version_openpgp() {
     res_APDU[res_APDU_size++] = PIPGP_VERSION_MAJOR;
     res_APDU[res_APDU_size++] = PIPGP_VERSION_MINOR;
     res_APDU[res_APDU_size++] = 0x0;

src/openpgp/defs.c

@@ -0,0 +1,20 @@
+/*
+ * This file is part of the Pico OpenPGP distribution (https://github.com/polhenarejos/pico-openpgp).
+ * Copyright (c) 2022 Pol Henarejos.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "openpgp.h"
+
+uint8_t PICO_PRODUCT = 3;

src/openpgp/openpgp.c

@@ -30,9 +30,9 @@
 #include "ccid/ccid.h"
 #include "otp.h"
 #include "do.h"
+#ifdef MBEDTLS_EDDSA_C
 #include "mbedtls/eddsa.h"
-
-uint8_t PICO_PRODUCT = 3;
+#endif
 
 bool has_pw1 = false;
 bool has_pw2 = false;
@@ -65,7 +65,7 @@ int openpgp_process_apdu();
 
 extern uint32_t board_button_read(void);
 
-bool wait_button_pressed(uint16_t fid) {
+bool wait_button_pressed_fid(uint16_t fid) {
     uint32_t val = EV_PRESS_BUTTON;
 #ifndef ENABLE_EMULATION
     file_t *ef = search_by_fid(fid, NULL, SPECIFY_ANY);
@@ -97,7 +97,7 @@ void select_file(file_t *pe) {
     }
 }
 
-void scan_files() {
+void scan_files_openpgp() {
     scan_flash();
     file_t *ef;
     if ((ef = search_by_fid(EF_FULL_AID, NULL, SPECIFY_ANY))) {
@@ -286,7 +286,7 @@ void init_openpgp() {
     algo_aut = EF_ALGO_PRIV3;
     pk_dec = EF_PK_DEC;
     pk_aut = EF_PK_AUT;
-    scan_files();
+    scan_files_openpgp();
     //cmd_select();
 }
 
@@ -573,10 +573,13 @@ int load_private_key_ecdsa(mbedtls_ecp_keypair *ctx, file_t *fkey, bool use_dek)
         return PICOKEY_EXEC_ERROR;
     }
     mbedtls_platform_zeroize(kdata, sizeof(kdata));
+#ifdef MBEDTLS_EDDSA_C
     if (ctx->grp.id == MBEDTLS_ECP_DP_ED25519) {
         r = mbedtls_ecp_point_edwards(&ctx->grp, &ctx->Q, &ctx->d, random_gen, NULL);
     }
-    else {
+    else
+#endif
+    {
         r = mbedtls_ecp_mul(&ctx->grp, &ctx->Q, &ctx->d, &ctx->grp.G, random_gen, NULL);
     }
     if (r != 0) {
@@ -623,9 +626,11 @@ mbedtls_ecp_group_id get_ec_group_id_from_attr(const uint8_t *algo, size_t algo_
     else if (memcmp(algorithm_attr_x448 + 2, algo, algo_len) == 0) {
         return MBEDTLS_ECP_DP_CURVE448;
     }
+#ifdef MBEDTLS_EDDSA_C
     else if (memcmp(algorithm_attr_ed25519 + 2, algo, algo_len) == 0) {
         return MBEDTLS_ECP_DP_ED25519;
     }
+#endif
     return MBEDTLS_ECP_DP_NONE;
 }
 
@@ -744,10 +749,13 @@ int ecdsa_sign(mbedtls_ecp_keypair *ctx,
                size_t *out_len) {
 
     int r = 0;
+#ifdef MBEDTLS_EDDSA_C
     if (ctx->grp.id == MBEDTLS_ECP_DP_ED25519) {
         r = mbedtls_eddsa_write_signature(ctx, data, data_len, out, 64, out_len, MBEDTLS_EDDSA_PURE, NULL, 0, random_gen, NULL);
     }
-    else {
+    else
+#endif
+    {
         mbedtls_mpi ri, si;
         mbedtls_mpi_init(&ri);
         mbedtls_mpi_init(&si);
@@ -770,7 +778,7 @@ extern int cmd_get_next_data();
 extern int cmd_put_data();
 extern int cmd_verify();
 extern int cmd_select_data();
-extern int cmd_version();
+extern int cmd_version_openpgp();
 extern int cmd_import_data();
 extern int cmd_change_pin();
 extern int cmd_mse();
@@ -815,7 +823,7 @@ static const cmd_t cmds[] = {
     { INS_INTERNAL_AUT, cmd_internal_aut },
     { INS_MSE, cmd_mse },
     { INS_IMPORT_DATA, cmd_import_data },
-    { INS_VERSION, cmd_version },
+    { INS_VERSION, cmd_version_openpgp },
     { INS_SELECT_DATA, cmd_select_data },
     { INS_GET_NEXT_DATA, cmd_get_next_data },
     { 0x00, 0x0 }

src/openpgp/openpgp.h

@@ -72,8 +72,8 @@ extern int check_pin(const file_t *pin, const uint8_t *data, size_t len);
 extern mbedtls_ecp_group_id get_ec_group_id_from_attr(const uint8_t *algo, size_t algo_len);
 extern int reset_sig_count();
 extern uint16_t algo_dec, algo_aut, pk_dec, pk_aut;
-extern bool wait_button_pressed(uint16_t fid);
-extern void scan_files();
+extern bool wait_button_pressed_fid(uint16_t fid);
+extern void scan_files_openpgp();
 extern int load_aes_key(uint8_t *aes_key, file_t *fkey);
 extern int inc_sig_count();
 extern int dek_encrypt(uint8_t *data, size_t len);

src/openpgp/version.h

@@ -29,7 +29,7 @@
 #define PIV_VERSION_MINOR (PIV_VERSION & 0xff)
 
 
-#define PIPGP_VERSION 0x0304
+#define PIPGP_VERSION 0x0306
 
 #define PIPGP_VERSION_MAJOR ((PIPGP_VERSION >> 8) & 0xff)
 #define PIPGP_VERSION_MINOR (PIPGP_VERSION & 0xff)

tests/build-in-docker.sh

@@ -3,5 +3,5 @@
 source tests/docker_env.sh
 #run_in_docker rm -rf CMakeFiles
 run_in_docker mkdir -p build_in_docker
-run_in_docker -w "$PWD/build_in_docker" cmake -DENABLE_EMULATION=1 ..
+run_in_docker -w "$PWD/build_in_docker" cmake -DENABLE_EMULATION=1 -DENABLE_EDDSA=1 ..
 run_in_docker -w "$PWD/build_in_docker" make -j ${NUM_PROC}