The keygen command allows the `-p` argument which will prompt for a
password, and protect the private key with this password. When loading
keys, it will prompt for a password if it detects a password protected
key.
Signed-off-by: David Brown <david.brown@linaro.org>
Support for PKCS1.5 has been removed from the bootloader for a while
now, remove it as well from the tool.
Signed-off-by: David Brown <david.brown@linaro.org>
Although these files are likely implicitly licensed under the Apache 2.0
license because of the LICENSE file for this project, make this explicit
in these files.
Signed-off-by: David Brown <david.brown@linaro.org>
Add a `--rust` flag to the getpub subcommand to output the public key in
Rust format rather than C.
Signed-off-by: David Brown <david.brown@linaro.org>
The imgtool.py program has been assuming that the input image for
signing has a zero padded place for the header at the beginning of the
image. This is only true for some platforms.
Instead, make this included header space optional. By default, prepend
the header to the image. If `--included-header` is specified to the
sign command, consider the bytes at the beginning of the image to be
padded space for the header. This option is required for Zephyr builds.
If the --key is not specified, only the SHA256 hash is added to the TLV.
This is useful for testing configurations, where the crypto has not been
fully configured. Note that this configuration is not secure, and this
only verifies that the image has not been corrupted.
Changing the name of the command line argument changes the name of the
fields used to access it. Change the keysigning code to reflect this,
avoiding a stack dump when trying to generate keys.
Add support for the RSA-PSS signature algorithm to imgtool.py. This
algorithm has a strong security proof, and is recommended for all new
designs. The new algorithm is enabled by default for RSA signatures to
match the default in the bootloader also being changed.
This is the start of a python implementation of imgtool. This
implements all of the functionality that was missing in the zep2newt.py
tool, namely creation of keypairs, and converting the public version of
these keys into C code.
David Brown