Skip to content

Add support for multiple same-type signatures with key ID parsing #2305

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

maulik-arm
Copy link

@maulik-arm maulik-arm commented May 14, 2025

This PR adds support for signing and verifying images with multiple signatures of the same type (e.g., multiple EC256 signatures), enhancing flexibility in secure boot scenarios. It also introduces Key ID TLV parsing to enable the bootloader to select the correct key from a set of built-in keys.

Motivation

Previously, MCUboot only allowed a single signature per image per signature type. This limited use cases where multiple stakeholders need to sign the same image or when fallback keys are required.
This PR removes that limitation by allowing multiple signatures of the same type.


Use Cases

  • Multi-party signing: e.g., 2 (potentially independent) parties can sign the same image, enabling chain-of-trust across organizational boundaries.
  • Key rotation or backup: include signatures from both the current and next key, or a recovery key.

Changes Included

1. bootutil: Parse key ID TLV for built-in keys

  • Adds support for parsing Key ID TLVs in the image when MCUBOOT_BUILTIN_KEY is enabled.
  • This enables selection of the correct built-in key for verification.

2. imgtool: Add support for multiple signatures and key ID TLVs

  • Enables signing an image with multiple keys of the same type.
  • Adds CLI support for passing multiple --key arguments.
  • Allows optional specification of a key ID per signature, which gets encoded in the TLV.
  • Updates imgtool test suite to verify both multiple signatures and key ID inclusion.

3. bootutil: Add support for verifying multiple same-type signatures

  • Updates signature verification logic to loop through all same-type signature TLVs.
  • When MCUBOOT_BUILTIN_KEY or MCUBOOT_HW_KEY is enabled, the key ID is used to select the appropriate key for verification.

Notes

  • Backwards compatible: Images with a single signature continue to work as before.
  • Only takes effect when config 'MCUBOOT_IMAGE_MULTI_SIG_SUPPORT' is enabled.
  • Designed to work with existing MCUboot signature verification flow with minimal disruption.

When MCUBOOT_BUILTIN_KEY is enabled, the key id TLV entry is added
to the image. Parse this entry while validating the image to identify
the key used to sign the image.

This enables future support for scenarios such as multiple built-in keys
or multi-signature.

Signed-off-by: Maulik Patel <[email protected]>
Change-Id: Ibe26bc2b09e63350f4214719606a5aa4bc1be93c
This patch adds support for multiple signatures to single image.
This is useful for scenarios where multiple keys are used to sign
images, allowing for greater flexibility and security in the
image verification process.
The tool command line interface is extended to support multiple
signatures.

The imgtool test suite is updated to test the new functionality.

Change-Id: I285b426671f6ad76472f0a2f8fb3a330f8882c3d
Signed-off-by: Maulik Patel <[email protected]>
This commit adds functionality to the bootutil library to support
multiple sign verfication of same type when 'MCUBOOT_BUILTIN_KEY' or
'MCUBOOT_HW_KEY' is enabled.

Signed-off-by: Maulik Patel <[email protected]>
Change-Id: I05c97ac385c5816c812c51feb010028df8412fe5
Since the key id concept in the PSA specific, rename the variables
accordingly.

Signed-off-by: Maulik Patel <[email protected]>
Change-Id: I8a8a5ceba5554211f185cc4045a6081b6d407507
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant