IntelFsp2Pkg/Tools/ConfigEditor/SingleSign.py - edk2 - Git at Google

 #!/usr/bin/env python
 # @ SingleSign.py
 # Single signing script
 #
 # Copyright (c) 2020 - 2021, Intel Corporation. All rights reserved.<BR>
 # SPDX-License-Identifier: BSD-2-Clause-Patent
 #
 ##

 import os
 import sys
 import re
 import shutil
 import subprocess

 SIGNING_KEY = {
     # Key Id                                | Key File Name start |
     # =================================================================
     # KEY_ID_MASTER is used for signing Slimboot Key Hash Manifest \
     # container (KEYH Component)
     "KEY_ID_MASTER_RSA2048": "MasterTestKey_Priv_RSA2048.pem",
     "KEY_ID_MASTER_RSA3072": "MasterTestKey_Priv_RSA3072.pem",

     # KEY_ID_CFGDATA is used for signing external Config data blob)
     "KEY_ID_CFGDATA_RSA2048": "ConfigTestKey_Priv_RSA2048.pem",
     "KEY_ID_CFGDATA_RSA3072": "ConfigTestKey_Priv_RSA3072.pem",

     # KEY_ID_FIRMWAREUPDATE is used for signing capsule firmware update image)
     "KEY_ID_FIRMWAREUPDATE_RSA2048": "FirmwareUpdateTestKey_Priv_RSA2048.pem",
     "KEY_ID_FIRMWAREUPDATE_RSA3072": "FirmwareUpdateTestKey_Priv_RSA3072.pem",

     # KEY_ID_CONTAINER is used for signing container header with mono signature
     "KEY_ID_CONTAINER_RSA2048": "ContainerTestKey_Priv_RSA2048.pem",
     "KEY_ID_CONTAINER_RSA3072": "ContainerTestKey_Priv_RSA3072.pem",

     # CONTAINER_COMP1_KEY_ID is used for signing container components
     "KEY_ID_CONTAINER_COMP_RSA2048": "ContainerCompTestKey_Priv_RSA2048.pem",
     "KEY_ID_CONTAINER_COMP_RSA3072": "ContainerCompTestKey_Priv_RSA3072.pem",

     # KEY_ID_OS1_PUBLIC, KEY_ID_OS2_PUBLIC is used for referencing \
     # Boot OS public keys
     "KEY_ID_OS1_PUBLIC_RSA2048": "OS1_TestKey_Pub_RSA2048.pem",
     "KEY_ID_OS1_PUBLIC_RSA3072": "OS1_TestKey_Pub_RSA3072.pem",

     "KEY_ID_OS2_PUBLIC_RSA2048": "OS2_TestKey_Pub_RSA2048.pem",
     "KEY_ID_OS2_PUBLIC_RSA3072": "OS2_TestKey_Pub_RSA3072.pem",

     }

 MESSAGE_SBL_KEY_DIR = """!!! PRE-REQUISITE: Path to SBL_KEY_DIR has.
 to be set with SBL KEYS DIRECTORY !!! \n!!! Generate keys.
 using GenerateKeys.py available in BootloaderCorePkg/Tools.
 directory !!! \n !!! Run $python.
 BootloaderCorePkg/Tools/GenerateKeys.py -k $PATH_TO_SBL_KEY_DIR !!!\n
 !!! Set SBL_KEY_DIR environ with path to SBL KEYS DIR !!!\n"
 !!! Windows $set SBL_KEY_DIR=$PATH_TO_SBL_KEY_DIR !!!\n
 !!! Linux $export SBL_KEY_DIR=$PATH_TO_SBL_KEY_DIR !!!\n"""


 def get_openssl_path():
     if os.name == 'nt':
         if 'OPENSSL_PATH' not in os.environ:
             openssl_dir = "C:\\Openssl\\bin\\"
             if os.path.exists(openssl_dir):
                 os.environ['OPENSSL_PATH'] = openssl_dir
             else:
                 os.environ['OPENSSL_PATH'] = "C:\\Openssl\\"
                 if 'OPENSSL_CONF' not in os.environ:
                     openssl_cfg = "C:\\Openssl\\openssl.cfg"
                     if os.path.exists(openssl_cfg):
                         os.environ['OPENSSL_CONF'] = openssl_cfg
         openssl = os.path.join(
                     os.environ.get('OPENSSL_PATH', ''),
                     'openssl.exe')
     else:
         # Get openssl path for Linux cases
         openssl = shutil.which('openssl')

     return openssl


 def run_process(arg_list, print_cmd=False, capture_out=False):
     sys.stdout.flush()
     if print_cmd:
         print(' '.join(arg_list))

     exc = None
     result = 0
     output = ''
     try:
         if capture_out:
             output = subprocess.check_output(arg_list).decode()
         else:
             result = subprocess.call(arg_list)
     except Exception as ex:
         result = 1
         exc = ex

     if result:
         if not print_cmd:
             print('Error in running process:\n  %s' % ' '.join(arg_list))
         if exc is None:
             sys.exit(1)
         else:
             raise exc

     return output


 def check_file_pem_format(priv_key):
     # Check for file .pem format
     key_name = os.path.basename(priv_key)
     if os.path.splitext(key_name)[1] == ".pem":
         return True
     else:
         return False


 def get_key_id(priv_key):
     # Extract base name if path is provided.
     key_name = os.path.basename(priv_key)
     # Check for KEY_ID in key naming.
     if key_name.startswith('KEY_ID'):
         return key_name
     else:
         return None


 def get_sbl_key_dir():
     # Check Key store setting SBL_KEY_DIR path
     if 'SBL_KEY_DIR' not in os.environ:
         exception_string = "ERROR: SBL_KEY_DIR is not defined." \
                         " Set SBL_KEY_DIR with SBL Keys directory!!\n"
         raise Exception(exception_string + MESSAGE_SBL_KEY_DIR)

     sbl_key_dir = os.environ.get('SBL_KEY_DIR')
     if not os.path.exists(sbl_key_dir):
         exception_string = "ERROR:SBL_KEY_DIR set " + sbl_key_dir \
                         + " is not valid." \
                         " Set the correct SBL_KEY_DIR path !!\n" \
                         + MESSAGE_SBL_KEY_DIR
         raise Exception(exception_string)
     else:
         return sbl_key_dir


 def get_key_from_store(in_key):

     # Check in_key is path to  key
     if os.path.exists(in_key):
         return in_key

     # Get Slimboot key dir path
     sbl_key_dir = get_sbl_key_dir()

     # Extract if in_key is key_id
     priv_key = get_key_id(in_key)
     if priv_key is not None:
         if (priv_key in SIGNING_KEY):
             # Generate key file name from key id
             priv_key_file = SIGNING_KEY[priv_key]
         else:
             exception_string = "KEY_ID" + priv_key + "is not found " \
                             "is not found in supported KEY IDs!!"
             raise Exception(exception_string)
     elif check_file_pem_format(in_key):
         # check if file name is provided in pem format
         priv_key_file = in_key
     else:
         priv_key_file = None
         raise Exception('key provided %s is not valid!' % in_key)

     # Create a file path
     # Join Key Dir and priv_key_file
     try:
         priv_key = os.path.join(sbl_key_dir, priv_key_file)
     except Exception:
         raise Exception('priv_key is not found %s!' % priv_key)

     # Check for priv_key construted based on KEY ID exists in specified path
     if not os.path.isfile(priv_key):
         exception_string = "!!! ERROR: Key file corresponding to" \
                         + in_key + "do not exist in Sbl key " \
                         "directory at" + sbl_key_dir + "!!! \n" \
                         + MESSAGE_SBL_KEY_DIR
         raise Exception(exception_string)

     return priv_key

 #
 # Sign an file using openssl
 #
 # priv_key   [Input]        Key Id or Path to Private key
 # hash_type  [Input]        Signing hash
 # sign_scheme[Input]        Sign/padding scheme
 # in_file    [Input]        Input file to be signed
 # out_file   [Input/Output] Signed data file
 #


 def single_sign_file(priv_key, hash_type, sign_scheme, in_file, out_file):

     _hash_type_string = {
         "SHA2_256": 'sha256',
         "SHA2_384": 'sha384',
         "SHA2_512": 'sha512',
     }

     _hash_digest_Size = {
         # Hash_string : Hash_Size
         "SHA2_256": 32,
         "SHA2_384": 48,
         "SHA2_512": 64,
         "SM3_256": 32,
     }

     _sign_scheme_string = {
         "RSA_PKCS1": 'pkcs1',
         "RSA_PSS": 'pss',
     }

     priv_key = get_key_from_store(priv_key)

     # Temporary files to store hash generated
     hash_file_tmp = out_file+'.hash.tmp'
     hash_file = out_file+'.hash'

     # Generate hash using openssl dgst in hex format
     cmdargs = [get_openssl_path(),
                'dgst',
                '-'+'%s' % _hash_type_string[hash_type],
                '-out', '%s' % hash_file_tmp, '%s' % in_file]
     run_process(cmdargs)

     # Extract hash form dgst command output and convert to ascii
     with open(hash_file_tmp, 'r') as fin:
         hashdata = fin.read()
     fin.close()

     try:
         hashdata = hashdata.rsplit('=', 1)[1].strip()
     except Exception:
         raise Exception('Hash Data not found for signing!')

     if len(hashdata) != (_hash_digest_Size[hash_type] * 2):
         raise Exception('Hash Data size do match with for hash type!')

     hashdata_bytes = bytearray.fromhex(hashdata)
     open(hash_file, 'wb').write(hashdata_bytes)

     print("Key used for Singing %s !!" % priv_key)

     # sign using Openssl pkeyutl
     cmdargs = [get_openssl_path(),
                'pkeyutl', '-sign', '-in', '%s' % hash_file,
                '-inkey', '%s' % priv_key, '-out',
                '%s' % out_file, '-pkeyopt',
                'digest:%s' % _hash_type_string[hash_type],
                '-pkeyopt', 'rsa_padding_mode:%s' %
                _sign_scheme_string[sign_scheme]]

     run_process(cmdargs)

     return

 #
 # Extract public key using openssl
 #
 # in_key        [Input]         Private key or public key in pem format
 # pub_key_file  [Input/Output]  Public Key to a file
 #
 # return        keydata (mod, exp) in bin format
 #


 def single_sign_gen_pub_key(in_key, pub_key_file=None):

     in_key = get_key_from_store(in_key)

     # Expect key to be in PEM format
     is_prv_key = False
     cmdline = [get_openssl_path(), 'rsa', '-pubout', '-text', '-noout',
                '-in', '%s' % in_key]
     # Check if it is public key or private key
     text = open(in_key, 'r').read()
     if '-BEGIN RSA PRIVATE KEY-' in text:
         is_prv_key = True
     elif '-BEGIN PUBLIC KEY-' in text:
         cmdline.extend(['-pubin'])
     else:
         raise Exception('Unknown key format "%s" !' % in_key)

     if pub_key_file:
         cmdline.extend(['-out', '%s' % pub_key_file])
         capture = False
     else:
         capture = True

     output = run_process(cmdline, capture_out=capture)
     if not capture:
         output = text = open(pub_key_file, 'r').read()
     data = output.replace('\r', '')
     data = data.replace('\n', '')
     data = data.replace('  ', '')

     # Extract the modulus
     if is_prv_key:
         match = re.search('modulus(.*)publicExponent:\\s+(\\d+)\\s+', data)
     else:
         match = re.search('Modulus(?:.*?):(.*)Exponent:\\s+(\\d+)\\s+', data)
     if not match:
         raise Exception('Public key not found!')
     modulus = match.group(1).replace(':', '')
     exponent = int(match.group(2))

     mod = bytearray.fromhex(modulus)
     # Remove the '00' from the front if the MSB is 1
     if mod[0] == 0 and (mod[1] & 0x80):
         mod = mod[1:]
     exp = bytearray.fromhex('{:08x}'.format(exponent))

     keydata = mod + exp

     return keydata
	#!/usr/bin/env python
	# @ SingleSign.py
	# Single signing script
	#
	# Copyright (c) 2020 - 2021, Intel Corporation. All rights reserved.<BR>
	# SPDX-License-Identifier: BSD-2-Clause-Patent
	#
	##

	import os
	import sys
	import re
	import shutil
	import subprocess

	SIGNING_KEY = {
	# Key Id \| Key File Name start \|
	# =================================================================
	# KEY_ID_MASTER is used for signing Slimboot Key Hash Manifest \
	# container (KEYH Component)
	"KEY_ID_MASTER_RSA2048": "MasterTestKey_Priv_RSA2048.pem",
	"KEY_ID_MASTER_RSA3072": "MasterTestKey_Priv_RSA3072.pem",

	# KEY_ID_CFGDATA is used for signing external Config data blob)
	"KEY_ID_CFGDATA_RSA2048": "ConfigTestKey_Priv_RSA2048.pem",
	"KEY_ID_CFGDATA_RSA3072": "ConfigTestKey_Priv_RSA3072.pem",

	# KEY_ID_FIRMWAREUPDATE is used for signing capsule firmware update image)
	"KEY_ID_FIRMWAREUPDATE_RSA2048": "FirmwareUpdateTestKey_Priv_RSA2048.pem",
	"KEY_ID_FIRMWAREUPDATE_RSA3072": "FirmwareUpdateTestKey_Priv_RSA3072.pem",

	# KEY_ID_CONTAINER is used for signing container header with mono signature
	"KEY_ID_CONTAINER_RSA2048": "ContainerTestKey_Priv_RSA2048.pem",
	"KEY_ID_CONTAINER_RSA3072": "ContainerTestKey_Priv_RSA3072.pem",

	# CONTAINER_COMP1_KEY_ID is used for signing container components
	"KEY_ID_CONTAINER_COMP_RSA2048": "ContainerCompTestKey_Priv_RSA2048.pem",
	"KEY_ID_CONTAINER_COMP_RSA3072": "ContainerCompTestKey_Priv_RSA3072.pem",

	# KEY_ID_OS1_PUBLIC, KEY_ID_OS2_PUBLIC is used for referencing \
	# Boot OS public keys
	"KEY_ID_OS1_PUBLIC_RSA2048": "OS1_TestKey_Pub_RSA2048.pem",
	"KEY_ID_OS1_PUBLIC_RSA3072": "OS1_TestKey_Pub_RSA3072.pem",

	"KEY_ID_OS2_PUBLIC_RSA2048": "OS2_TestKey_Pub_RSA2048.pem",
	"KEY_ID_OS2_PUBLIC_RSA3072": "OS2_TestKey_Pub_RSA3072.pem",

	}

	MESSAGE_SBL_KEY_DIR = """!!! PRE-REQUISITE: Path to SBL_KEY_DIR has.
	to be set with SBL KEYS DIRECTORY !!! \n!!! Generate keys.
	using GenerateKeys.py available in BootloaderCorePkg/Tools.
	directory !!! \n !!! Run $python.
	BootloaderCorePkg/Tools/GenerateKeys.py -k $PATH_TO_SBL_KEY_DIR !!!\n
	!!! Set SBL_KEY_DIR environ with path to SBL KEYS DIR !!!\n"
	!!! Windows $set SBL_KEY_DIR=$PATH_TO_SBL_KEY_DIR !!!\n
	!!! Linux $export SBL_KEY_DIR=$PATH_TO_SBL_KEY_DIR !!!\n"""


	def get_openssl_path():
	if os.name == 'nt':
	if 'OPENSSL_PATH' not in os.environ:
	openssl_dir = "C:\\Openssl\\bin\\"
	if os.path.exists(openssl_dir):
	os.environ['OPENSSL_PATH'] = openssl_dir
	else:
	os.environ['OPENSSL_PATH'] = "C:\\Openssl\\"
	if 'OPENSSL_CONF' not in os.environ:
	openssl_cfg = "C:\\Openssl\\openssl.cfg"
	if os.path.exists(openssl_cfg):
	os.environ['OPENSSL_CONF'] = openssl_cfg
	openssl = os.path.join(
	os.environ.get('OPENSSL_PATH', ''),
	'openssl.exe')
	else:
	# Get openssl path for Linux cases
	openssl = shutil.which('openssl')

	return openssl


	def run_process(arg_list, print_cmd=False, capture_out=False):
	sys.stdout.flush()
	if print_cmd:
	print(' '.join(arg_list))

	exc = None
	result = 0
	output = ''
	try:
	if capture_out:
	output = subprocess.check_output(arg_list).decode()
	else:
	result = subprocess.call(arg_list)
	except Exception as ex:
	result = 1
	exc = ex

	if result:
	if not print_cmd:
	print('Error in running process:\n %s' % ' '.join(arg_list))
	if exc is None:
	sys.exit(1)
	else:
	raise exc

	return output


	def check_file_pem_format(priv_key):
	# Check for file .pem format
	key_name = os.path.basename(priv_key)
	if os.path.splitext(key_name)[1] == ".pem":
	return True
	else:
	return False


	def get_key_id(priv_key):
	# Extract base name if path is provided.
	key_name = os.path.basename(priv_key)
	# Check for KEY_ID in key naming.
	if key_name.startswith('KEY_ID'):
	return key_name
	else:
	return None


	def get_sbl_key_dir():
	# Check Key store setting SBL_KEY_DIR path
	if 'SBL_KEY_DIR' not in os.environ:
	exception_string = "ERROR: SBL_KEY_DIR is not defined." \
	" Set SBL_KEY_DIR with SBL Keys directory!!\n"
	raise Exception(exception_string + MESSAGE_SBL_KEY_DIR)

	sbl_key_dir = os.environ.get('SBL_KEY_DIR')
	if not os.path.exists(sbl_key_dir):
	exception_string = "ERROR:SBL_KEY_DIR set " + sbl_key_dir \
	+ " is not valid." \
	" Set the correct SBL_KEY_DIR path !!\n" \
	+ MESSAGE_SBL_KEY_DIR
	raise Exception(exception_string)
	else:
	return sbl_key_dir


	def get_key_from_store(in_key):

	# Check in_key is path to key
	if os.path.exists(in_key):
	return in_key

	# Get Slimboot key dir path
	sbl_key_dir = get_sbl_key_dir()

	# Extract if in_key is key_id
	priv_key = get_key_id(in_key)
	if priv_key is not None:
	if (priv_key in SIGNING_KEY):
	# Generate key file name from key id
	priv_key_file = SIGNING_KEY[priv_key]
	else:
	exception_string = "KEY_ID" + priv_key + "is not found " \
	"is not found in supported KEY IDs!!"
	raise Exception(exception_string)
	elif check_file_pem_format(in_key):
	# check if file name is provided in pem format
	priv_key_file = in_key
	else:
	priv_key_file = None
	raise Exception('key provided %s is not valid!' % in_key)

	# Create a file path
	# Join Key Dir and priv_key_file
	try:
	priv_key = os.path.join(sbl_key_dir, priv_key_file)
	except Exception:
	raise Exception('priv_key is not found %s!' % priv_key)

	# Check for priv_key construted based on KEY ID exists in specified path
	if not os.path.isfile(priv_key):
	exception_string = "!!! ERROR: Key file corresponding to" \
	+ in_key + "do not exist in Sbl key " \
	"directory at" + sbl_key_dir + "!!! \n" \
	+ MESSAGE_SBL_KEY_DIR
	raise Exception(exception_string)

	return priv_key

	#
	# Sign an file using openssl
	#
	# priv_key [Input] Key Id or Path to Private key
	# hash_type [Input] Signing hash
	# sign_scheme[Input] Sign/padding scheme
	# in_file [Input] Input file to be signed
	# out_file [Input/Output] Signed data file
	#


	def single_sign_file(priv_key, hash_type, sign_scheme, in_file, out_file):

	_hash_type_string = {
	"SHA2_256": 'sha256',
	"SHA2_384": 'sha384',
	"SHA2_512": 'sha512',
	}

	_hash_digest_Size = {
	# Hash_string : Hash_Size
	"SHA2_256": 32,
	"SHA2_384": 48,
	"SHA2_512": 64,
	"SM3_256": 32,
	}

	_sign_scheme_string = {
	"RSA_PKCS1": 'pkcs1',
	"RSA_PSS": 'pss',
	}

	priv_key = get_key_from_store(priv_key)

	# Temporary files to store hash generated
	hash_file_tmp = out_file+'.hash.tmp'
	hash_file = out_file+'.hash'

	# Generate hash using openssl dgst in hex format
	cmdargs = [get_openssl_path(),
	'dgst',
	'-'+'%s' % _hash_type_string[hash_type],
	'-out', '%s' % hash_file_tmp, '%s' % in_file]
	run_process(cmdargs)

	# Extract hash form dgst command output and convert to ascii
	with open(hash_file_tmp, 'r') as fin:
	hashdata = fin.read()
	fin.close()

	try:
	hashdata = hashdata.rsplit('=', 1)[1].strip()
	except Exception:
	raise Exception('Hash Data not found for signing!')

	if len(hashdata) != (_hash_digest_Size[hash_type] * 2):
	raise Exception('Hash Data size do match with for hash type!')

	hashdata_bytes = bytearray.fromhex(hashdata)
	open(hash_file, 'wb').write(hashdata_bytes)

	print("Key used for Singing %s !!" % priv_key)

	# sign using Openssl pkeyutl
	cmdargs = [get_openssl_path(),
	'pkeyutl', '-sign', '-in', '%s' % hash_file,
	'-inkey', '%s' % priv_key, '-out',
	'%s' % out_file, '-pkeyopt',
	'digest:%s' % _hash_type_string[hash_type],
	'-pkeyopt', 'rsa_padding_mode:%s' %
	_sign_scheme_string[sign_scheme]]

	run_process(cmdargs)

	return

	#
	# Extract public key using openssl
	#
	# in_key [Input] Private key or public key in pem format
	# pub_key_file [Input/Output] Public Key to a file
	#
	# return keydata (mod, exp) in bin format
	#


	def single_sign_gen_pub_key(in_key, pub_key_file=None):

	in_key = get_key_from_store(in_key)

	# Expect key to be in PEM format
	is_prv_key = False
	cmdline = [get_openssl_path(), 'rsa', '-pubout', '-text', '-noout',
	'-in', '%s' % in_key]
	# Check if it is public key or private key
	text = open(in_key, 'r').read()
	if '-BEGIN RSA PRIVATE KEY-' in text:
	is_prv_key = True
	elif '-BEGIN PUBLIC KEY-' in text:
	cmdline.extend(['-pubin'])
	else:
	raise Exception('Unknown key format "%s" !' % in_key)

	if pub_key_file:
	cmdline.extend(['-out', '%s' % pub_key_file])
	capture = False
	else:
	capture = True

	output = run_process(cmdline, capture_out=capture)
	if not capture:
	output = text = open(pub_key_file, 'r').read()
	data = output.replace('\r', '')
	data = data.replace('\n', '')
	data = data.replace(' ', '')

	# Extract the modulus
	if is_prv_key:
	match = re.search('modulus(.*)publicExponent:\\s+(\\d+)\\s+', data)
	else:
	match = re.search('Modulus(?:.?):(.)Exponent:\\s+(\\d+)\\s+', data)
	if not match:
	raise Exception('Public key not found!')
	modulus = match.group(1).replace(':', '')
	exponent = int(match.group(2))

	mod = bytearray.fromhex(modulus)
	# Remove the '00' from the front if the MSB is 1
	if mod[0] == 0 and (mod[1] & 0x80):
	mod = mod[1:]
	exp = bytearray.fromhex('{:08x}'.format(exponent))

	keydata = mod + exp

	return keydata