diff mbox series

[v5,11/16] cpio_utils.c: use per-image AES key / iv from sw-description

Message ID 20250904115704.58413-12-Michael.Glembotzki@iris-sensing.com
State Changes Requested
Delegated to: Stefano Babic
Headers show
Series Add support for asymmetric decryption | expand

Commit Message

Michael Glembotzki Sept. 4, 2025, 11:49 a.m. UTC 
Signed-off-by: Michael Glembotzki <Michael.Glembotzki@iris-sensing.com>
---
 core/cpio_utils.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/core/cpio_utils.c b/core/cpio_utils.c
index 6fb7a984..aff7a4bb 100644
--- a/core/cpio_utils.c
+++ b/core/cpio_utils.c
@@ -532,6 +532,8 @@  int copyfile(struct swupdate_copy *args)
 	unsigned char *aes_key = NULL;
 	unsigned char *ivt = NULL;
 	unsigned char ivtbuf[AES_BLK_SIZE];
+	unsigned char aesbuf[AES_256_KEY_LEN];
+	char keylen = 0;
 
 	struct InputState input_state = {
 		.fdin = args->fdin,
@@ -608,7 +610,6 @@  int copyfile(struct swupdate_copy *args)
 	}
 
 	if (args->encrypted) {
-		aes_key = (unsigned char *)swupdate_get_decrypt_key();
 		if (args->imgivt && strlen(args->imgivt)) {
 			if (!is_hex_str(args->imgivt) || ascii_to_bin(ivtbuf, sizeof(ivtbuf), args->imgivt)) {
 				ERROR("Invalid image ivt");
@@ -617,7 +618,20 @@  int copyfile(struct swupdate_copy *args)
 			ivt = ivtbuf;
 		} else
 			ivt = get_aes_ivt();
-		decrypt_state.dcrypt = swupdate_DECRYPT_init(aes_key, swupdate_get_decrypt_keylen(), ivt, AES_CBC);
+
+		if (args->imgaes && strlen(args->imgaes)) {
+				if (!is_hex_str(args->imgaes) || ascii_to_bin(aesbuf, sizeof(aesbuf), args->imgaes)) {
+					ERROR("Invalid image aes-key");
+					return -EINVAL;
+				}
+				aes_key = aesbuf;
+				keylen = strlen(args->imgaes) / 2;
+		} else {
+			aes_key = (unsigned char *)swupdate_get_decrypt_key();
+			keylen = swupdate_get_decrypt_keylen();
+		}
+
+		decrypt_state.dcrypt = swupdate_DECRYPT_init(aes_key, keylen, ivt, args->cipher);
 		if (!decrypt_state.dcrypt) {
 			ERROR("decrypt initialization failure, aborting");
 			ret = -EFAULT;