diff --git a/pyproject.toml b/pyproject.toml index f9c438c..59ce61a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -15,7 +15,6 @@ dependencies = [ "argcomplete >= 1.8.2", "colorama >= 0.3.7", "crcmod >= 1.7", - "ecdsa >= 0.19.1", "pycryptodome >= 3.15.0", "pynrfjprog == 10.19.0", "pyserial >= 3.0.1", diff --git a/tockloader/tbfh.py b/tockloader/tbfh.py index 0d2f8a9..e01427d 100644 --- a/tockloader/tbfh.py +++ b/tockloader/tbfh.py @@ -5,10 +5,9 @@ import traceback import Crypto -from Crypto.Signature import pkcs1_15 -from Crypto.PublicKey import RSA +from Crypto.Signature import pkcs1_15, DSS +from Crypto.PublicKey import RSA, ECC from Crypto.Hash import SHA512, SHA256, HMAC -import ecdsa from .exceptions import TockLoaderException @@ -1712,9 +1711,9 @@ def verify(self, keys, integrity_blob): # verify this credential one way or another. for i, key in enumerate(keys): try: - signature = key.verify( - signature, integrity_blob, hashfunc=hashlib.sha256 - ) + hash = Crypto.Hash.SHA256.new(integrity_blob) + Crypto.Signature.DSS.new(key, "fips-186-3").verify(hash, signature) + # Signature verified! self.verified = "yes" except Exception as e: print(e) @@ -1911,9 +1910,10 @@ def compute(self, public_key, private_key, integrity_blob, cleartext_id): self.verified = "yes" elif self.credentials_type == self.CREDENTIALS_TYPE_ECDSAP256: # Load the private key from the .pem file. - pri_key = ecdsa.SigningKey.from_pem(private_key) + pri_key = Crypto.PublicKey.ECC.import_key(private_key, curve_name="p256") # Compute the signature. - signature = pri_key.sign(integrity_blob, hashfunc=hashlib.sha256) + hash = Crypto.Hash.SHA256.new(integrity_blob) + signature = Crypto.Signature.DSS.new(pri_key, "fips-186-3").sign(hash) # Store the signature. self.buffer = signature elif self.credentials_type == self.CREDENTIALS_TYPE_HMACSHA256: @@ -2134,7 +2134,7 @@ def verify_credentials(self, public_keys, integrity_blob): except: pass try: - key = ecdsa.VerifyingKey.from_pem(public_key) + key = Crypto.PublicKey.ECC.import_key(public_key) keys.append(key) except: pass