wolfBoot/.github/workflows/test-cryptocb-simulator.yml at master · wolfSSL/wolfBoot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
name: test simulator with crypto callback (cryptocb)

on:
  push:
    branches: [ 'master', 'main', 'release/**' ]
  pull_request:
    branches: [ '**' ]

jobs:
  cryptocb_simulator_tests:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/wolfssl/wolfboot-ci-sim:v1.0
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Trust workspace
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      # 64 bit simulator, cryptocb enabled
      #
      - name: make clean
        run: |
          make keysclean

      - name: Select config (64 bit simulator)
        run: |
          cp config/examples/sim.config .config

      - name: Build tools
        run: |
          make -C tools/keytools && make -C tools/bin-assemble

      # Classical algorithms (each tested once with SPMATH=1)
      # Note: ECC uses wc_ecc_verify_hash_ex which bypasses cryptocb PK dispatch,
      # so we only verify hash for ECC. ED25519 and RSA dispatch PK through cryptocb.
      #
      - name: Build wolfboot.elf (ED25519, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=ED25519 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (ED25519)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ED25519-verify"

      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (ECC256, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=ECC256 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (ECC256)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"

      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (ECC384, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=ECC384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (ECC384)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"

      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (ECC521, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=ECC521 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (ECC521)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"

      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (RSA2048, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=RSA2048 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (RSA2048)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"

      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (RSA3072, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=RSA3072 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (RSA3072)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"

      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (RSA4096, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=RSA4096 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (RSA4096)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "RSA"

      # SHA-384 hash coverage (paired with algorithms that naturally use 384-bit)
      #
      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (ECC384 + SHA384, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=ECC384 HASH=SHA384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (ECC384 + SHA384)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-384"

      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (RSA4096 + SHA384, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=RSA4096 HASH=SHA384 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (RSA4096 + SHA384)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-384" "RSA"

      # SHA3-384 hash coverage
      #
      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (ECC384 + SHA3-384, cryptocb)
        run: |
          make clean && make test-sim-internal-flash-with-update SIGN=ECC384 HASH=SHA3 SPMATH=1 WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (ECC384 + SHA3-384)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA3-384"

      # AES encrypted partition coverage (external flash + AES128-CTR)
      #
      - name: Cleanup to change key type
        run: |
          make keysclean

      - name: Build wolfboot.elf (ED25519 + AES128 encrypt, cryptocb)
        run: |
          cp config/examples/sim-encrypt-update.config .config
          make clean && make test-sim-external-flash-with-enc-update WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run cryptocb sunnyday test (ED25519 + AES128 encrypt)
        run: |
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ED25519-verify" "AES-CTR"

      # PQ algorithms (each uses its own config, build + test inline)
      #
      - name: Build and test LMS (cryptocb)
        run: |
          cp config/examples/sim-lms.config .config
          make keysclean && make clean
          make keytools
          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"

      - name: Build and test XMSS (cryptocb)
        run: |
          cp config/examples/sim-xmss.config .config
          make keysclean && make clean
          make keytools
          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256"

      - name: Build and test ML-DSA level 2 (cryptocb)
        run: |
          cp config/examples/sim-ml-dsa.config .config
          make keysclean && make clean
          make keytools
          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"

      - name: Build and test ML-DSA level 3 (cryptocb)
        run: |
          cp config/examples/sim-ml-dsa3.config .config
          make keysclean && make clean
          make keytools
          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"

      - name: Build and test ML-DSA level 5 (cryptocb)
        run: |
          cp config/examples/sim-ml-dsa5.config .config
          make keysclean && make clean
          make keytools
          make test-sim-internal-flash-with-update WOLFBOOT_TEST_SIM_CRYPTOCB=1
          tools/scripts/sim-cryptocb-sunnyday-update.sh "SHA-256" "ML-DSA-verify"

      # Hybrid auth: ML_DSA + ECDSA
      #
      - name: make clean (hybrid)
        run: |
          make keysclean

      - name: Select config (hybrid ML_DSA + ECC)
        run: |
          cp config/examples/sim-ml-dsa-ecc-hybrid.config .config

      - name: Build tools (hybrid)
        run: |
          make -C tools/keytools && make -C tools/bin-assemble

      - name: Build wolfboot.elf (hybrid, cryptocb)
        run: |
          make clean && make WOLFBOOT_TEST_SIM_CRYPTOCB=1

      - name: Run hybrid boot test with cryptocb verification
        run: |
          ./wolfboot.elf get_version > sim_cryptocb.log 2>/dev/null
          grep -q "sim-cryptocb: hash SHA-256" sim_cryptocb.log || (echo "hash SHA-256 not found" && cat sim_cryptocb.log && exit 1)
          grep -q "sim-cryptocb: pk ML-DSA-verify" sim_cryptocb.log || (echo "pk ML-DSA-verify not found" && cat sim_cryptocb.log && exit 1)
          echo "Hybrid cryptocb verification passed"