Skip to content

wolfBoot DICE attestation with wolfCOSE #831

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
aidangarske wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

wolfBoot DICE attestation with wolfCOSE #831

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d522c3d
Add wolfCOSE as a submodule at lib/wolfCOSE
aidangarske Jul 23, 2026
6645acf
Build DICE attestation tokens with wolfCOSE instead of a local CBOR w…
aidangarske Jul 23, 2026
fb5c373
Read the STM32H5 unique device ID from 0x08FFF800 for DICE UDS deriva…
aidangarske Jul 23, 2026
ba6c1d9
Wire wolfCOSE into the CMake WOLFCRYPT_TZ_PSA build path
aidangarske Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitmodules
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,6 @@
[submodule "lib/wolfHAL"]
path = lib/wolfHAL
url = https://github.com/wolfSSL/wolfHAL.git
[submodule "lib/wolfCOSE"]
path = lib/wolfCOSE
url = https://github.com/wolfSSL/wolfCOSE.git
5 changes: 5 additions & 0 deletions CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -566,6 +566,11 @@ endif()

if(DEFINED WOLFCRYPT_TZ_PSA AND NOT WOLFCRYPT_TZ_PSA STREQUAL "0")
list(APPEND WOLFBOOT_SOURCES "src/dice/dice.c")
list(APPEND WOLFBOOT_SOURCES "lib/wolfCOSE/src/wolfcose.c")
list(APPEND WOLFBOOT_SOURCES "lib/wolfCOSE/src/wolfcose_cbor.c")
list(APPEND WOLFBOOT_INCLUDE_DIRS ${WOLFBOOT_ROOT}/lib/wolfCOSE/include)
list(APPEND WOLFBOOT_DEFS WOLFCOSE_LEAN WOLFCOSE_ENABLE_EXT_SIGN
WOLFCOSE_SIGN1_UNTAGGED)
endif()

# build bin-assemble tool Windows
Expand Down
3 changes: 3 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,20 +179,23 @@ WOLFBOOT_LIB_WOLFTPM?=lib/wolfTPM
WOLFBOOT_LIB_WOLFPKCS11?=lib/wolfPKCS11
WOLFBOOT_LIB_WOLFPSA?=lib/wolfPSA
WOLFBOOT_LIB_WOLFHSM?=lib/wolfHSM
WOLFBOOT_LIB_WOLFCOSE?=lib/wolfCOSE

# Convert to absolute paths using abspath function
WOLFBOOT_LIB_WOLFSSL:=$(abspath $(WOLFBOOT_LIB_WOLFSSL))
WOLFBOOT_LIB_WOLFTPM:=$(abspath $(WOLFBOOT_LIB_WOLFTPM))
WOLFBOOT_LIB_WOLFPKCS11:=$(abspath $(WOLFBOOT_LIB_WOLFPKCS11))
WOLFBOOT_LIB_WOLFPSA:=$(abspath $(WOLFBOOT_LIB_WOLFPSA))
WOLFBOOT_LIB_WOLFHSM:=$(abspath $(WOLFBOOT_LIB_WOLFHSM))
WOLFBOOT_LIB_WOLFCOSE:=$(abspath $(WOLFBOOT_LIB_WOLFCOSE))

# Export variables so they are available to sub-makefiles
export WOLFBOOT_LIB_WOLFSSL
export WOLFBOOT_LIB_WOLFTPM
export WOLFBOOT_LIB_WOLFPKCS11
export WOLFBOOT_LIB_WOLFPSA
export WOLFBOOT_LIB_WOLFHSM
export WOLFBOOT_LIB_WOLFCOSE

## Architecture/CPU configuration
include arch.mk
Expand Down
33 changes: 17 additions & 16 deletions hal/stm32h5.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,10 +167,11 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
return 0;
}

#define STM32H5_BSEC_BASE 0x46009000u
#define STM32H5_BSEC_UID0 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x14))
#define STM32H5_BSEC_UID1 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x18))
#define STM32H5_BSEC_UID2 (*(volatile uint32_t *)(STM32H5_BSEC_BASE + 0x1C))
/* STM32H5 96-bit unique device ID, factory-programmed (RM0481). */
#define STM32H5_UID_BASE 0x08FFF800u
#define STM32H5_UID0 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x0u))
#define STM32H5_UID1 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x4u))
#define STM32H5_UID2 (*(volatile uint32_t *)(STM32H5_UID_BASE + 0x8u))

#ifdef WOLFBOOT_UDS_OBKEYS
__attribute__((weak)) int stm32h5_obkeys_read_uds(uint8_t *out, size_t out_len)
Expand Down Expand Up @@ -205,18 +206,18 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
#endif
size_t copy_len;

uid[0] = (uint8_t)(STM32H5_BSEC_UID0 >> 0);
uid[1] = (uint8_t)(STM32H5_BSEC_UID0 >> 8);
uid[2] = (uint8_t)(STM32H5_BSEC_UID0 >> 16);
uid[3] = (uint8_t)(STM32H5_BSEC_UID0 >> 24);
uid[4] = (uint8_t)(STM32H5_BSEC_UID1 >> 0);
uid[5] = (uint8_t)(STM32H5_BSEC_UID1 >> 8);
uid[6] = (uint8_t)(STM32H5_BSEC_UID1 >> 16);
uid[7] = (uint8_t)(STM32H5_BSEC_UID1 >> 24);
uid[8] = (uint8_t)(STM32H5_BSEC_UID2 >> 0);
uid[9] = (uint8_t)(STM32H5_BSEC_UID2 >> 8);
uid[10] = (uint8_t)(STM32H5_BSEC_UID2 >> 16);
uid[11] = (uint8_t)(STM32H5_BSEC_UID2 >> 24);
uid[0] = (uint8_t)(STM32H5_UID0 >> 0);
uid[1] = (uint8_t)(STM32H5_UID0 >> 8);
uid[2] = (uint8_t)(STM32H5_UID0 >> 16);
uid[3] = (uint8_t)(STM32H5_UID0 >> 24);
uid[4] = (uint8_t)(STM32H5_UID1 >> 0);
uid[5] = (uint8_t)(STM32H5_UID1 >> 8);
uid[6] = (uint8_t)(STM32H5_UID1 >> 16);
uid[7] = (uint8_t)(STM32H5_UID1 >> 24);
uid[8] = (uint8_t)(STM32H5_UID2 >> 0);
uid[9] = (uint8_t)(STM32H5_UID2 >> 8);
uid[10] = (uint8_t)(STM32H5_UID2 >> 16);
uid[11] = (uint8_t)(STM32H5_UID2 >> 24);

#if defined(WOLFBOOT_HASH_SHA256)
wc_InitSha256(&hash);
Expand Down
1 change: 1 addition & 0 deletions lib/wolfCOSE
Open in desktop
Submodule wolfCOSE added at 21bd18
5 changes: 5 additions & 0 deletions options.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1122,6 +1122,9 @@ ifeq ($(WOLFCRYPT_TZ_PSA),1)
CFLAGS+=-DWOLFSSL_PSA_ENGINE
CFLAGS+=-DWOLFPSA_CUSTOM_STORE
CFLAGS+=-DNO_DES3 -DNO_DES3_TLS_SUITES
CFLAGS+=-I$(WOLFBOOT_LIB_WOLFCOSE)/include
CFLAGS+=-DWOLFCOSE_LEAN -DWOLFCOSE_ENABLE_EXT_SIGN
CFLAGS+=-DWOLFCOSE_SIGN1_UNTAGGED
WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)
WOLFPSA_CFLAGS+=-I$(WOLFBOOT_LIB_WOLFPSA)/wolfpsa
ifeq ($(USE_CLANG),1)
Expand All @@ -1135,6 +1138,8 @@ ifeq ($(WOLFCRYPT_TZ_PSA),1)
WOLFCRYPT_OBJS+=src/psa_store.o
WOLFCRYPT_OBJS+=src/arm_tee_psa_veneer.o
WOLFCRYPT_OBJS+=src/arm_tee_psa_ipc.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFCOSE)/src/wolfcose.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFCOSE)/src/wolfcose_cbor.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/pwdbased.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/hmac.o
WOLFCRYPT_OBJS+=$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/dh.o
Expand Down
Loading
Loading