From ac037e69bf35f7ffccb106a61e118fd4eae048ee Mon Sep 17 00:00:00 2001 From: Amit Aryeh Levy Date: Wed, 10 Dec 2025 21:48:35 -0800 Subject: [PATCH 1/2] Use pycrypto instead of ecdsa The ecdsa package is not for production use and pycrypto already includes the appropriate algorithms for ECDSA signatures. So just use those and get rid of the insecure dependency. --- pyproject.toml | 1 - tockloader/tbfh.py | 18 +++++++++--------- 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index f9c438c..59ce61a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -15,7 +15,6 @@ dependencies = [ "argcomplete >= 1.8.2", "colorama >= 0.3.7", "crcmod >= 1.7", - "ecdsa >= 0.19.1", "pycryptodome >= 3.15.0", "pynrfjprog == 10.19.0", "pyserial >= 3.0.1", diff --git a/tockloader/tbfh.py b/tockloader/tbfh.py index 0d2f8a9..ca32b51 100644 --- a/tockloader/tbfh.py +++ b/tockloader/tbfh.py @@ -5,10 +5,9 @@ import traceback import Crypto -from Crypto.Signature import pkcs1_15 -from Crypto.PublicKey import RSA +from Crypto.Signature import pkcs1_15, DSS +from Crypto.PublicKey import RSA, ECC from Crypto.Hash import SHA512, SHA256, HMAC -import ecdsa from .exceptions import TockLoaderException @@ -1712,9 +1711,9 @@ def verify(self, keys, integrity_blob): # verify this credential one way or another. for i, key in enumerate(keys): try: - signature = key.verify( - signature, integrity_blob, hashfunc=hashlib.sha256 - ) + hash = Crypto.Hash.SHA256.new(integrity_blob) + Crypto.Signature.DSS.new(key, 'fips-186-3').verify(hash, signature) + # Signature verified! self.verified = "yes" except Exception as e: print(e) @@ -1911,9 +1910,10 @@ def compute(self, public_key, private_key, integrity_blob, cleartext_id): self.verified = "yes" elif self.credentials_type == self.CREDENTIALS_TYPE_ECDSAP256: # Load the private key from the .pem file. - pri_key = ecdsa.SigningKey.from_pem(private_key) + pri_key = Crypto.PublicKey.ECC.import_key(private_key, curve_name="p256") # Compute the signature. - signature = pri_key.sign(integrity_blob, hashfunc=hashlib.sha256) + hash = Crypto.Hash.SHA256.new(integrity_blob) + signature = Crypto.Signature.DSS.new(pri_key, 'fips-186-3').sign(hash) # Store the signature. self.buffer = signature elif self.credentials_type == self.CREDENTIALS_TYPE_HMACSHA256: @@ -2134,7 +2134,7 @@ def verify_credentials(self, public_keys, integrity_blob): except: pass try: - key = ecdsa.VerifyingKey.from_pem(public_key) + key = Crypto.PublicKey.ECC.import_key(public_key) keys.append(key) except: pass From c7da1277a92f31a818db1e902667f8e896f98366 Mon Sep 17 00:00:00 2001 From: autoblack Date: Thu, 11 Dec 2025 16:30:25 +0000 Subject: [PATCH 2/2] fixup: Format Python code with Black --- tockloader/tbfh.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tockloader/tbfh.py b/tockloader/tbfh.py index ca32b51..e01427d 100644 --- a/tockloader/tbfh.py +++ b/tockloader/tbfh.py @@ -1712,7 +1712,7 @@ def verify(self, keys, integrity_blob): for i, key in enumerate(keys): try: hash = Crypto.Hash.SHA256.new(integrity_blob) - Crypto.Signature.DSS.new(key, 'fips-186-3').verify(hash, signature) + Crypto.Signature.DSS.new(key, "fips-186-3").verify(hash, signature) # Signature verified! self.verified = "yes" except Exception as e: @@ -1913,7 +1913,7 @@ def compute(self, public_key, private_key, integrity_blob, cleartext_id): pri_key = Crypto.PublicKey.ECC.import_key(private_key, curve_name="p256") # Compute the signature. hash = Crypto.Hash.SHA256.new(integrity_blob) - signature = Crypto.Signature.DSS.new(pri_key, 'fips-186-3').sign(hash) + signature = Crypto.Signature.DSS.new(pri_key, "fips-186-3").sign(hash) # Store the signature. self.buffer = signature elif self.credentials_type == self.CREDENTIALS_TYPE_HMACSHA256: