X-CUBE-CRYPTOLIB: ECDSA invalid public key format

[SRB]

Hi,

I'm using STM32CubeExpansion_Crypto_V4.0.1 library for verifying a signed firmware file on STM32F7 controller. The key-pair has been generated using openssl command-line. The firmware has been signed using the private key (PEM). The signature has been stripped off the container headers and 64-byte sign generated. The public key has been converted to binary format (C array of 64 bytes) and embedded in the bootloader. However, the call to cmox_ecdsa_verify() fails with code 'CMOX_ECC_ERR_INVALID_PUBKEY (0x00060008) /*!< Invalid Public Key value */'.

Sequence of function calls, with few params:

cmox_ecc_construct(..., CMOX_ECC256_MATH_FUNCS, staticBuff[2048],... )

cmox_ecdsa_verify(..., CMOX_ECC_CURVE_SECP256K1, pubKeyBin[64],...)

cmox_ecc_cleanup()

The signature verification works fine on openssl command-line, with a dummy file. Would appreciate any pointers on this issue. Thank you.

[Jocelyn RICARD]

Hello @SRB​ ,

are you sure you are using right curve ?

The more common used curve is SECP256R1 which translate to prime256v1 in openssl.

Best regards

Jocelyn

[SRB]

Hi Jocelyn,

Thanks, yes, it's SECP256R1. When I checked using sign & verify functions of cmox_ecdsa API, it worked. Shall compare using other online tools and post an update.

[Mr_M_from_G]

Same issue for me.

The first post shows that the op used CMOX_ECC_CURVE_SECP256K1 -> ! K1 !

I have the issue that a cmox_ecdsa_verify with K1 fails although a cmox_ecdsa_sign produces the identical signature.
With R1 there are no issues.

In case of interest I can send an example but it is based on ECC/ECDSA_SignVerify/Src/main.c from STM32CubeExpansion_Crypto_V4.2.0, so only the input values have changed.

[Mr_M_from_G]

My fault, I was using one curve with keys generated for another...