diff mbox series

[v5,15/16] crypto: store cipher in decryption_key and use default key only if it matches

Message ID 20250904115704.58413-16-Michael.Glembotzki@iris-sensing.com
State Changes Requested
Delegated to: Stefano Babic
Headers show
Series Add support for asymmetric decryption | expand

Commit Message

Michael Glembotzki Sept. 4, 2025, 11:50 a.m. UTC 
Signed-off-by: Michael Glembotzki <Michael.Glembotzki@iris-sensing.com>
---
 core/cpio_utils.c   |  9 +++++++--
 core/decrypt_keys.c | 14 ++++++++++++--
 include/util.h      |  3 ++-
 3 files changed, 21 insertions(+), 5 deletions(-)
diff mbox series

Patch

diff --git a/core/cpio_utils.c b/core/cpio_utils.c
index 6ef38c15..cb291d3b 100644
--- a/core/cpio_utils.c
+++ b/core/cpio_utils.c
@@ -629,8 +629,13 @@  int copyfile(struct swupdate_copy *args)
 				aes_key = aesbuf;
 				keylen = strlen(args->imgaes) / 2;
 		} else {
-			aes_key = (unsigned char *)swupdate_get_decrypt_key();
-			keylen = swupdate_get_decrypt_keylen();
+			/*
+			 * Only fall back to the default decryption key if the requested cipher matches.
+			 */
+			if (swupdate_get_decrypt_cipher() == args->cipher) {
+				aes_key = (unsigned char *)swupdate_get_decrypt_key();
+				keylen = swupdate_get_decrypt_keylen();
+			}
 		}
 
 		decrypt_state.dcrypt = swupdate_DECRYPT_init(aes_key, keylen, ivt, args->cipher);
diff --git a/core/decrypt_keys.c b/core/decrypt_keys.c
index 25beb08a..95c7c13b 100644
--- a/core/decrypt_keys.c
+++ b/core/decrypt_keys.c
@@ -26,11 +26,12 @@  struct decryption_key {
 	char *key;
 	char keylen;
 	unsigned char *ivt;
+	cipher_t cipher;
 };
 
 static struct decryption_key *decrypt_keys = NULL;
 
-int set_filename_as_key(const char *fname)
+int set_filename_as_key(const char *fname, cipher_t cipher)
 {
 	size_t len;
 	if (!decrypt_keys) {
@@ -49,6 +50,7 @@  int set_filename_as_key(const char *fname)
 
 	decrypt_keys->keylen = len;
 	strncpy(decrypt_keys->key, fname, len);
+	decrypt_keys->cipher = cipher;
 	return 0;
 }
 
@@ -100,6 +102,8 @@  int set_aes_key(const char *key, const char *ivt)
 		}
 	}
 
+	decrypt_keys->cipher = AES_CBC;
+
 	if (decrypt_keys->key)
 		free(decrypt_keys->key);
 
@@ -129,7 +133,7 @@  int load_decryption_key(char *fname)
 	int ret;
 
 #ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION
-	return set_filename_as_key(fname);
+	return set_filename_as_key(fname, CMS);
 #endif
 
 	fp = fopen(fname, "r");
@@ -182,3 +186,9 @@  unsigned char *get_aes_ivt(void) {
 		return NULL;
 	return decrypt_keys->ivt;
 }
+
+cipher_t swupdate_get_decrypt_cipher(void) {
+	if (!decrypt_keys)
+		return AES_UNKNOWN;
+	return decrypt_keys->cipher;
+}
diff --git a/include/util.h b/include/util.h
index b3121ddb..52fff11a 100644
--- a/include/util.h
+++ b/include/util.h
@@ -296,7 +296,8 @@  char *swupdate_get_decrypt_key(void);
 char swupdate_get_decrypt_keylen(void);
 unsigned char *get_aes_ivt(void);
 int set_aes_key(const char *key, const char *ivt);
-int set_filename_as_key(const char *fname);
+int set_filename_as_key(const char *fname, cipher_t cipher);
+cipher_t swupdate_get_decrypt_cipher(void);
 
 /* Getting global information */
 int get_install_info(char *buf, size_t len);