scripts/imgtool.py: Add PKCS#11 ECDSA P384 support #2444

IanJ-Arm · 2025-09-05T09:51:12Z

Based on work submitted in relation to:
Issue #599 ref: #599
particularly these commits:
grandcentrix/mcuboot@82441bd4286
grandcentrix/mcuboot@010ea89f
rretanubun@33c6400a40

Updated and modified to support ECDSA P384 keys.
Tests also updated and fixed, tested with SoftHSMv2.

fundakol · 2025-09-05T10:24:26Z

scripts/imgtool/keys/imgtool_keys_pkcs11.py

+    def __init__(self, uri, env=None):
+        if env is None:
+            env = os.environ
+        if not 'PKCS11_PIN' in env.keys():


Suggested change

if not 'PKCS11_PIN' in env.keys():

if 'PKCS11_PIN' not in env:

fundakol · 2025-09-05T10:27:35Z

scripts/imgtool/keys/imgtool_keys_pkcs11.py

+
+def unquote_to_bytes(urlencoded_string):
+    """Replace %xx escapes by their single-character equivalent,
+using the “iso-8859-1” encoding to decode all 8-bit values.


Add indentation with 4 spaces.

fundakol · 2025-09-05T10:28:52Z

scripts/imgtool/keys/imgtool_keys_pkcs11.py

+        if not 'PKCS11_PIN' in env.keys():
+            raise RuntimeError("Environment variable PKCS11_PIN not set. Set it to the user PIN.")
+        params = get_pkcs11_uri_params(uri)
+        assert b'serial' in params.keys()


Suggested change

assert b'serial' in params.keys()

assert b'serial' in params

fundakol · 2025-09-05T10:29:51Z

scripts/imgtool/keys/imgtool_keys_pkcs11.py

+            raise RuntimeError("Environment variable PKCS11_PIN not set. Set it to the user PIN.")
+        params = get_pkcs11_uri_params(uri)
+        assert b'serial' in params.keys()
+        assert b'id' in params.keys() or b'label' in params.keys()


Suggested change

assert b'id' in params.keys() or b'label' in params.keys()

assert b'id' in params or b'label' in params

fundakol · 2025-09-05T10:39:32Z

scripts/imgtool/keys/imgtool_keys_pkcs11.py

+        lib = ''
+        try:
+            lib = pkcs11.lib(pkcs11_module_path)
+        except RuntimeError:
+            pass  # happens if lib does not exist or is corrupt
+        if '' == lib:
+            raise RuntimeError(f"PKCS11 module {pkcs11_module_path} not loaded.")


I guess pkcs11.lib(pkcs11_module_path) does not return an empty string.

Suggested change

lib = ''

try:

lib = pkcs11.lib(pkcs11_module_path)

except RuntimeError:

pass # happens if lib does not exist or is corrupt

if '' == lib:

raise RuntimeError(f"PKCS11 module {pkcs11_module_path} not loaded.")

try:

lib = pkcs11.lib(pkcs11_module_path)

except RuntimeError:

raise RuntimeError(f"PKCS11 module {pkcs11_module_path} not loaded.")

fundakol · 2025-09-05T10:45:37Z

scripts/imgtool/keys/imgtool_keys_pkcs11.py

+        # signatures to be padded to a fixed length.  Because the DER
+        # encoding is done with signed integers, the size of the
+        # signature will vary depending on whether the high bit is set
+        # in each value.  This padding was done in a


Remove double space.

Comment was copied from here:
https://github.com/mcu-tools/mcuboot/blob/main/scripts/imgtool/keys/ecdsa.py#L161
But sure, will fix this and address all the other feedback, thanks!

fundakol · 2025-09-05T10:45:42Z

scripts/imgtool/keys/imgtool_keys_pkcs11.py

+
+    def sig_len(self):
+        # Early versions of MCUboot (< v1.5.0) required ECDSA
+        # signatures to be padded to a fixed length.  Because the DER


Remove double space.

fundakol · 2025-09-05T10:45:56Z

scripts/imgtool/keys/imgtool_keys_pkcs11.py

+        # not-easily-reversible way (by just adding zeros).
+        #
+        # The signing code no longer requires this padding, and newer
+        # versions of MCUboot don't require it.  But, continue to


Remove double space.

fundakol · 2025-09-05T10:59:44Z

scripts/imgtool/keys/imgtool_keys_pkcs11_test.py

+sys.path.insert(0, os.path.abspath(
+    os.path.join(os.path.dirname(__file__), '../..')))
+
+from datetime import datetime


Imports should be grouped in the following order:

Standard library imports.

Related third party imports.

Local application/library specific imports.

fundakol · 2025-09-05T11:02:35Z

scripts/imgtool/keys/imgtool_keys_pkcs11_test.py

+            )
+            pubkey.destroy()
+
+


Keep single line separation between methods.

IanJ-Arm · 2025-09-10T13:55:56Z

@fundakol Pushed a revised set which hopefully addresses all your points.

IanJ-Arm · 2025-09-30T10:52:54Z

@d3zd3z Gentle ping on this. Is there anything I can do to help the review? Thanks!

nordicjm · 2025-10-10T10:52:20Z

Please rebase

IanJ-Arm · 2025-10-10T12:35:45Z

@nordicjm Rebased, fixed a couple of minor conflicts.

nordicjm · 2025-10-10T12:38:35Z

Commit sign off fix needed

IanJ-Arm · 2025-10-10T12:41:13Z

Where sorry? SoB looks right to me.

nordicjm · 2025-10-10T12:43:27Z

Where sorry? SoB looks right to me.

See https://github.com/mcu-tools/mcuboot/actions/runs/18406627289/job/52448159896?pr=2444

IanJ-Arm · 2025-10-10T12:47:19Z

The checker is case sensitive on the email address?

scripts/imgtool/keys/imgtool_keys_pkcs11_test.py

scripts/requirements.txt

IanJ-Arm · 2025-10-10T13:57:01Z

Thanks @fundakol . What about imgtool.nix? Should python-pkcs11 be added there too?
[Edit: added]

fundakol · 2025-10-10T14:23:54Z

Thanks @fundakol . What about imgtool.nix? Should python-pkcs11 be added there too? [Edit: added]

I have never used that tool, and I don't know if it is still used in this repo by anyone, but I would add it just in case.

fundakol

LGTM

Based on work submitted in relation to: Issue mcu-tools#599 ref: mcu-tools#599 particularly these commits: grandcentrix/mcuboot@82441bd4286 grandcentrix/mcuboot@010ea89f rretanubun@33c6400a40 Updated and modified to support ECDSA P384 keys. Tests also updated and fixed, tested with SoftHSMv2. Signed-off-by: Ian Jamison <[email protected]> Co-authored-by: Michael Zimmermann <[email protected]> Co-authored-by: Nils Dagsson Moskopp <[email protected]> Co-authored-by: Richard Retanubun <[email protected]> Change-Id: I175b710834bd20a868961634483d43b459959769

IanJ-Arm requested a review from d3zd3z as a code owner September 5, 2025 09:51

fundakol suggested changes Sep 5, 2025

View reviewed changes

IanJ-Arm force-pushed the imgtool-pkcs11-signing-flat branch from 21627be to 2474bf7 Compare September 10, 2025 13:54

IanJ-Arm force-pushed the imgtool-pkcs11-signing-flat branch from 2474bf7 to 11cb738 Compare October 10, 2025 12:33

IanJ-Arm force-pushed the imgtool-pkcs11-signing-flat branch from 11cb738 to 5dc35c0 Compare October 10, 2025 12:49

fundakol suggested changes Oct 10, 2025

View reviewed changes

scripts/imgtool/keys/imgtool_keys_pkcs11_test.py Outdated Show resolved Hide resolved

scripts/requirements.txt Show resolved Hide resolved

IanJ-Arm force-pushed the imgtool-pkcs11-signing-flat branch from 5dc35c0 to 3e6141c Compare October 10, 2025 14:04

fundakol approved these changes Oct 10, 2025

View reviewed changes

davidvincze added the 2.3.0 Issues to be brought into 2.3.0 label Oct 13, 2025

IanJ-Arm force-pushed the imgtool-pkcs11-signing-flat branch from 3e6141c to 8a57afd Compare October 13, 2025 15:37

	if not 'PKCS11_PIN' in env.keys():
	if 'PKCS11_PIN' not in env:

	assert b'id' in params.keys() or b'label' in params.keys()
	assert b'id' in params or b'label' in params

scripts/imgtool.py: Add PKCS#11 ECDSA P384 support #2444

Are you sure you want to change the base?

scripts/imgtool.py: Add PKCS#11 ECDSA P384 support #2444

Conversation

IanJ-Arm commented Sep 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

IanJ-Arm commented Sep 10, 2025

Uh oh!

IanJ-Arm commented Sep 30, 2025

Uh oh!

nordicjm commented Oct 10, 2025

Uh oh!

IanJ-Arm commented Oct 10, 2025

Uh oh!

nordicjm commented Oct 10, 2025

Uh oh!

IanJ-Arm commented Oct 10, 2025

Uh oh!

nordicjm commented Oct 10, 2025

Uh oh!

IanJ-Arm commented Oct 10, 2025

Uh oh!

Uh oh!

Uh oh!

IanJ-Arm commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fundakol commented Oct 10, 2025

Uh oh!

fundakol left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

IanJ-Arm commented Oct 10, 2025 •

edited

Loading