boot: zephyr: Add ECDSA support using mbedTLS #2537
+30
−12
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nordicjm
requested changes
Nov 21, 2025
| config BOOT_ECDSA_MBEDTLS | ||
| bool "Use mbedTLS" | ||
| select BOOT_USE_MBEDTLS | ||
| select MBEDTLS |
Collaborator
There was a problem hiding this comment.
not really sure how you expect this to work? Given that it doesn't:
/opt/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(image_ecdsa.c.obj): in function `bootutil_ecdsa_init':
/tmp/aa/bootloader/mcuboot/boot/bootutil/include/bootutil/crypto/ecdsa.h:490: undefined reference to `mbedtls_ecdsa_init'
/opt/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(image_ecdsa.c.obj): in function `bootutil_ecdsa_verify':
/tmp/aa/bootloader/mcuboot/boot/bootutil/include/bootutil/crypto/ecdsa.h:577: undefined reference to `mbedtls_ecp_group_load'
/opt/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /tmp/aa/bootloader/mcuboot/boot/bootutil/include/bootutil/crypto/ecdsa.h:582: undefined reference to `mbedtls_ecp_point_read_binary'
/opt/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /tmp/aa/bootloader/mcuboot/boot/bootutil/include/bootutil/crypto/ecdsa.h:587: undefined reference to `mbedtls_ecp_check_pubkey'
/opt/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: /tmp/aa/bootloader/mcuboot/boot/bootutil/include/bootutil/crypto/ecdsa.h:592: undefined reference to `mbedtls_ecdsa_read_signature'
/opt/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(image_ecdsa.c.obj): in function `bootutil_ecdsa_drop':
/tmp/aa/bootloader/mcuboot/boot/bootutil/include/bootutil/crypto/ecdsa.h:495: undefined reference to `mbedtls_ecdsa_free'
/opt/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(keys.c.obj):/tmp/aa/bootloader/mcuboot/boot/zephyr/keys.c:52: undefined reference to `ecdsa_pub_key'
/opt/zephyr-sdk-0.17.0/arm-zephyr-eabi/bin/../lib/gcc/arm-zephyr-eabi/12.2.0/../../../../arm-zephyr-eabi/bin/ld.bfd: app/libapp.a(keys.c.obj):(.rodata.bootutil_keys+0x4): undefined reference to `ecdsa_pub_key_len'
Author
There was a problem hiding this comment.
Previously, I used sysbuild with:
CONFIG_CUSTOM_MBEDTLS_CFG_FILE=y CONFIG_MBEDTLS_CFG_FILE="config-ec.h"
to provide the missing mbedTLS functions.
I have now updated the Kconfig to select all required mbedTLS options directly, without relying on a custom mbedTLS config file. All dependencies are handled via Kconfig, including when BOOT_ENCRYPT_IMAGE is enabled. I am not entirely sure if all requirements are covered, so feedback is welcome.
nordicjm
reviewed
Dec 1, 2025
| select MBEDTLS_ECDSA_C if MBEDTLS_BUILTIN | ||
| select MBEDTLS_ECP_DP_SECP256R1_ENABLED if MBEDTLS_BUILTIN | ||
| select MBEDTLS_ASN1_PARSE_C if MBEDTLS_BUILTIN | ||
| select MBEDTLS_ECP_NIST_OPTIM if MBEDTLS_BUILTIN |
Collaborator
There was a problem hiding this comment.
changes look OK but commits need squashing
prene-se
force-pushed
the
feature/ecdsambedtls-zephyr
branch
from
67140a4 to
9b43df5
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds a new Kconfig option
BOOT_ECDSA_MBEDTLSto enable ECDSA signature verification using mbedTLS as an alternative to TINYCRYPT, PSA, or CC310 backends.