mbox series

[v5,00/16] Add support for asymmetric decryption

Message ID 20250904115704.58413-1-Michael.Glembotzki@iris-sensing.com
Headers show
Series Add support for asymmetric decryption | expand

Message

Michael Glembotzki Sept. 4, 2025, 11:49 a.m. UTC 
Hi everyone,

I’ve just updated the long-pending Asymmetric Decryption feature.
Now that Stefano has finished the crypto rework, there shouldn’t be any
blockers left.

The first few patch files are basically independent of the OpenSSL CMS part and
could already be merged.

Thanks a lot for your feedback and please test it thoroughly.

Best regards,
Michael

Michael Glembotzki (12):
      openssl_DECRYPT_init: Fix error message on missing iv
      swupdate.c: Abort if no key for encrypted sw-description is provided
      swupdate: Add -K / --decryption-key param and decryption-key-file config
      parser: Read aes-key from sw-description into struct img_type
      Add openssl cms decryption functions for asymmetric decryption
      util.h: Propagate cipher and image aes key to copy pipeline
      stream_interface.c: Force opensslCMS as crypto lib for sw-description
      cpio_utils.c: use per-image AES key / iv from sw-description
      decrypt_keys: make ivt dynamically allocated
      cpio_utils: handle -EAGAIN and set eof only on success
      crypto: store cipher in decryption_key and use default key only if it matches
      doc: Add documentation for asymmetric decryption

Stefano Babic (4):
      core: don't check for writen output to terminate
      crypto: prepare to support multiple cipher
      Move accessors for keys in own file
      decrypt_keys.c: Store key filename for opensslCMS decryption

 core/Makefile                         |   1 +
 core/cpio_utils.c                     |  34 +++++++++++--
 core/crypto.c                         |   4 +-
 core/decrypt_keys.c                   | 194 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 core/installer.c                      |   2 +
 core/stream_interface.c               |  39 ++++++++++-----
 core/swupdate.c                       |  15 ++++--
 core/util.c                           | 134 -------------------------------------------------
 crypto/Kconfig                        |  18 +++++++
 crypto/Makefile                       |   1 +
 crypto/swupdate_decrypt_mbedtls.c     |   7 ++-
 crypto/swupdate_decrypt_openssl.c     |   7 ++-
 crypto/swupdate_decrypt_openssl_cms.c | 202 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 crypto/swupdate_decrypt_wolfssl.c     |   6 ++-
 crypto/swupdate_openssl.h             |   3 ++
 doc/source/asym_encrypted_images.rst  | 159 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 doc/source/encrypted_images.rst       |   2 +
 doc/source/index.rst                  |   1 +
 doc/source/sw-description.rst         |  25 +++++++---
 include/swupdate_aes.h                |  55 ++++++++++++++++++++
 include/swupdate_crypto.h             |   5 +-
 include/swupdate_image.h              |   3 ++
 include/util.h                        |   9 +++-
 parser/parser.c                       |  35 ++++++++++++-
 24 files changed, 789 insertions(+), 172 deletions(-)