Add function to rotate the root keys

This adds a function to rotate the root keys stored in the bootloader
by overwriting them with new keys.

This is intended to be an intermediate firmware release, dedicated to
rotating the keys. Only official firmware releases are able to rotate
the root keys.

When booted, it will rotate the keys and then reboot into the
bootloader, so that regular firmware can be installed.

src/CMakeLists.txt

@@ -17,6 +17,7 @@
 set(DBB-FIRMWARE-SOURCES
   ${CMAKE_SOURCE_DIR}/src/bip32.c
   ${CMAKE_SOURCE_DIR}/src/firmware_main_loop.c
+  ${CMAKE_SOURCE_DIR}/src/keyrotation.c
   ${CMAKE_SOURCE_DIR}/src/keystore.c
   ${CMAKE_SOURCE_DIR}/src/random.c
   ${CMAKE_SOURCE_DIR}/src/hardfault.c

src/firmware.c

@@ -26,6 +26,8 @@
 #include "workflow/idle_workflow.h"
 #include "workflow/orientation_screen.h"
 
+#include "keyrotation.h"
+
 uint32_t __stack_chk_guard = 0;
 
 int main(void)
@@ -40,6 +42,9 @@ int main(void)
     common_main();
     bitbox02_smarteeprom_init();
     traceln("%s", "Device initialized");
+
+    keyrotation();
+
     orientation_screen_blocking();
     idle_workflow_blocking();
     firmware_main_loop();

src/keyrotation.c

@@ -0,0 +1,168 @@
+// Copyright 2023 Shift Crypto AG
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "keyrotation.h"
+
+#include "driver_init.h"
+#include <flags.h>
+#include <memory/mpu.h>
+
+#include <screen.h>
+#include <system.h>
+
+#include <string.h>
+
+// clang-format off
+#if PRODUCT_BITBOX_BTCONLY == 1
+static const uint8_t _old_root_pubkeys[3][64] = {
+    {
+        0xe7, 0x30, 0x92, 0x3f, 0x19, 0x04, 0xd3, 0xe8, 0x3e, 0x0a, 0xb0, 0x7f, 0x05, 0x0d, 0x8e, 0x4e,
+        0x60, 0x4c, 0x46, 0xba, 0x36, 0xae, 0xbb, 0xdb, 0x9a, 0x4d, 0x3c, 0x96, 0x60, 0x5b, 0x9e, 0xc3,
+        0x94, 0x71, 0x03, 0x5c, 0x0f, 0x87, 0x34, 0xbd, 0xcb, 0xe1, 0x8f, 0x0c, 0xaa, 0x6f, 0x6e, 0x3d,
+        0x8b, 0x7f, 0xa0, 0x5e, 0x42, 0x5a, 0xc2, 0x21, 0x5e, 0x6e, 0x97, 0x97, 0x5f, 0x48, 0x03, 0x8b,
+    },
+    {
+        0xfd, 0x11, 0xed, 0xc3, 0xb6, 0xd8, 0xe5, 0x0b, 0xe8, 0x6b, 0x2e, 0x33, 0xee, 0xb0, 0x3b, 0x32,
+        0x23, 0x91, 0x4c, 0x12, 0xe4, 0x9d, 0x0e, 0x64, 0xd9, 0x74, 0x03, 0xa7, 0x31, 0xc4, 0x30, 0x6a,
+        0x44, 0xab, 0x6a, 0x99, 0x3e, 0x9d, 0xaa, 0x44, 0xda, 0x0e, 0x5a, 0x0a, 0x8b, 0x3e, 0x02, 0xe9,
+        0xa4, 0x6e, 0x2c, 0xb6, 0x14, 0x57, 0xce, 0x78, 0x81, 0xa8, 0x71, 0x55, 0xee, 0x23, 0x67, 0x44,
+    },
+    {
+        0x75, 0x98, 0x7e, 0x69, 0xa5, 0xed, 0xa5, 0x3f, 0x79, 0x63, 0x16, 0xfa, 0x47, 0x00, 0xf9, 0x9a,
+        0x86, 0x36, 0xb0, 0xa5, 0x6c, 0x57, 0x28, 0xee, 0x8a, 0xd3, 0xb3, 0xcc, 0x8f, 0x37, 0xe6, 0xac,
+        0xfc, 0xa6, 0x08, 0x23, 0x14, 0x4a, 0xea, 0xb2, 0xe4, 0xa7, 0x62, 0x97, 0x89, 0xd0, 0x3e, 0xa4,
+        0xd2, 0xd1, 0x8a, 0xbf, 0x0f, 0xd7, 0xa0, 0x07, 0xd7, 0x96, 0xa1, 0x65, 0x57, 0x28, 0x4b, 0x3f,
+    },
+};
+
+static const uint8_t _new_root_pubkeys[3][64] = {
+    {
+        0x6a, 0x3b, 0xb7, 0xc9, 0x6c, 0x6a, 0xae, 0xa9, 0xa4, 0x0c, 0x97, 0xd3, 0xe9, 0x4f, 0x7b, 0x34,
+        0x53, 0x61, 0x04, 0xdf, 0xe9, 0xd5, 0xe2, 0xad, 0xc3, 0xd8, 0x8e, 0x52, 0xd5, 0x3a, 0x5f, 0x71,
+        0xd3, 0xb6, 0x59, 0xdf, 0x5c, 0x9f, 0x38, 0x3e, 0x37, 0xbb, 0x99, 0x67, 0x61, 0x7f, 0x05, 0x4d,
+        0xd0, 0x74, 0xd5, 0xb2, 0x0f, 0x5c, 0x2f, 0xa7, 0xc7, 0xec, 0x62, 0x63, 0xf5, 0xce, 0x5a, 0xd5,
+    },
+    {
+        0x80, 0x1b, 0x5e, 0xd2, 0x10, 0x8c, 0x40, 0xa5, 0x09, 0x11, 0x31, 0x66, 0xbf, 0xdf, 0x5b, 0x16,
+        0x45, 0x3a, 0x9e, 0x5b, 0xf6, 0xcd, 0x74, 0x62, 0x08, 0x14, 0x6d, 0xba, 0x20, 0x5c, 0xbc, 0x9e,
+        0x74, 0x28, 0x71, 0xe5, 0x6d, 0x10, 0x54, 0xc9, 0x34, 0x49, 0x6d, 0xd3, 0x52, 0x98, 0x57, 0x6f,
+        0xaf, 0x6a, 0x67, 0x44, 0x62, 0x53, 0x04, 0x93, 0x25, 0xef, 0x9b, 0xa3, 0x76, 0x7d, 0x8f, 0x57,
+    },
+    {
+        0x86, 0x59, 0xb0, 0x20, 0xdc, 0xee, 0x70, 0x42, 0x05, 0x05, 0xd4, 0xe6, 0x10, 0xea, 0xdd, 0xc1,
+        0xd3, 0x62, 0x33, 0x16, 0x8d, 0xbe, 0x9e, 0x32, 0xa1, 0xfa, 0xfa, 0xcc, 0x09, 0xd9, 0xca, 0x52,
+        0x37, 0xa8, 0xaf, 0x78, 0x08, 0x90, 0x3f, 0x76, 0x54, 0x57, 0x09, 0x15, 0x0b, 0x78, 0x0b, 0xfb,
+        0x60, 0xd5, 0xd4, 0x77, 0xb0, 0x5f, 0x5e, 0xe0, 0x3b, 0xd6, 0x56, 0x6e, 0xde, 0xff, 0x2a, 0x1e,
+    },
+};
+
+#elif PRODUCT_BITBOX_MULTI == 1
+static const uint8_t _old_root_pubkeys[3][64] = {
+    {
+        0x2b, 0x8a, 0x21, 0x9f, 0x01, 0x57, 0xf3, 0x12, 0x3e, 0x3c, 0x69, 0xd5, 0x40, 0x0e, 0xff, 0xfe,
+        0xd9, 0x55, 0x3f, 0x64, 0xd2, 0x5e, 0xec, 0x10, 0x65, 0x7d, 0x0e, 0x77, 0x6a, 0x8e, 0x17, 0xe2,
+        0xac, 0x2c, 0x3d, 0x19, 0xca, 0xfd, 0x18, 0x9b, 0x62, 0x36, 0x68, 0xc4, 0x10, 0x1b, 0x9b, 0x96,
+        0x74, 0xf5, 0xe6, 0xe6, 0x43, 0xa3, 0x82, 0x8e, 0x6a, 0xb9, 0x3b, 0x46, 0xe9, 0xc3, 0x87, 0x73,
+    },
+    {
+        0x1e, 0xb6, 0xe7, 0xad, 0x36, 0x1c, 0x40, 0x6b, 0xdd, 0xf4, 0x47, 0x17, 0x7b, 0x38, 0x21, 0x52,
+        0x7a, 0x7a, 0x25, 0x75, 0x99, 0x5c, 0x6f, 0x49, 0xc2, 0xd8, 0xe0, 0x9b, 0x89, 0x7a, 0x70, 0xb7,
+        0xab, 0x9c, 0x53, 0xa4, 0xcf, 0xbe, 0x29, 0x13, 0x33, 0x27, 0x1e, 0xd6, 0x75, 0x6b, 0xd3, 0xad,
+        0x20, 0x77, 0x08, 0x2d, 0xe7, 0x1a, 0xcd, 0xc8, 0xb8, 0x7c, 0x39, 0x2d, 0x94, 0x64, 0xef, 0x51,
+    },
+    {
+        0x9f, 0x39, 0x3d, 0x4a, 0xb6, 0xe8, 0xb0, 0xda, 0xc7, 0xc0, 0x43, 0x62, 0xc5, 0x20, 0xe1, 0xbc,
+        0x1b, 0x32, 0x7d, 0x92, 0xee, 0x25, 0x6b, 0xc4, 0x07, 0xf6, 0x82, 0xff, 0xac, 0x12, 0x0d, 0xec,
+        0x6b, 0x80, 0x23, 0x28, 0x62, 0xb9, 0x7d, 0xfd, 0x3d, 0xcf, 0x21, 0xdb, 0xb3, 0xf5, 0x4e, 0x4c,
+        0x1b, 0xec, 0x2b, 0x99, 0x40, 0x61, 0x3e, 0xef, 0xe7, 0x9e, 0x6a, 0x2b, 0x10, 0xbe, 0xda, 0xc2,
+    },
+};
+
+static const uint8_t _new_root_pubkeys[3][64] = {
+    {
+       0x65, 0x5f, 0x8c, 0xe0, 0x91, 0x20, 0x07, 0xfc, 0xe9, 0xe6, 0x95, 0xff, 0x95, 0x83, 0x00, 0xc8,
+       0x94, 0xcf, 0x98, 0x4c, 0xb4, 0xa9, 0x43, 0xc8, 0xba, 0xc4, 0xd3, 0xf2, 0x4d, 0x38, 0xf8, 0xa1,
+       0xb5, 0x1f, 0x92, 0x77, 0x27, 0x89, 0xc8, 0x1f, 0x64, 0x3b, 0x8a, 0xbb, 0xea, 0x93, 0x7d, 0x27,
+       0x1a, 0x1c, 0x91, 0x51, 0x82, 0x79, 0xd5, 0xc5, 0x3a, 0x81, 0xed, 0x29, 0xe4, 0xf1, 0x21, 0x38,
+    },
+    {
+       0x03, 0x62, 0xd4, 0xa4, 0xf5, 0x05, 0x4a, 0x8b, 0xc2, 0x12, 0x66, 0xce, 0x5f, 0xe7, 0xb0, 0x24,
+       0x80, 0x27, 0x35, 0xba, 0xb9, 0x26, 0x31, 0xf4, 0x6a, 0x37, 0xbd, 0x6a, 0xfa, 0xaa, 0xeb, 0xfd,
+       0x9d, 0x58, 0x78, 0x0c, 0xed, 0x5a, 0x2d, 0x1a, 0x82, 0xce, 0x64, 0xc0, 0x64, 0x5e, 0xdd, 0x83,
+       0x1a, 0x5b, 0xaa, 0x7a, 0xde, 0x1c, 0xf9, 0xc5, 0xf9, 0x4d, 0xfa, 0x4d, 0xd0, 0xc9, 0xc6, 0xef,
+    },
+    {
+       0x0d, 0x23, 0xf4, 0x9d, 0xc1, 0x01, 0x6f, 0x83, 0x7a, 0x2f, 0xb7, 0xa4, 0x95, 0x1b, 0x95, 0x22,
+       0xca, 0xc0, 0xbf, 0xc2, 0x78, 0x17, 0x3b, 0x2d, 0x9f, 0xa8, 0x40, 0xe5, 0xeb, 0xa4, 0x29, 0xf3,
+       0x32, 0x5b, 0x49, 0xd5, 0x3a, 0x57, 0x8d, 0x78, 0x9b, 0xa6, 0xcd, 0x7c, 0x83, 0xb1, 0x37, 0x6d,
+       0x84, 0x00, 0x32, 0x14, 0x7a, 0xe5, 0x90, 0xf9, 0x9e, 0xc7, 0x34, 0xad, 0x6e, 0xb9, 0xfd, 0x96,
+    },
+};
+#else
+#error "unknown product"
+#endif
+// clang-format on
+
+void keyrotation(void)
+{
+    for (uint32_t ptr = 0; ptr < FLASH_BOOT_LEN; ptr++) {
+        if (!memcmp((void*)ptr, _old_root_pubkeys, 64 * 3)) {
+            /* Disable MPU */
+
+            // Disable interrupts
+            __disable_irq();
+
+            // Wait for all memory accesses and instructions to complete
+            __DSB();
+            __ISB();
+
+            MPU->CTRL = MPU_DISABLE;
+
+            // Wait for all memory accesses and instructions to complete
+            __DSB();
+            __ISB();
+
+            // Enable interrupts
+            __enable_irq();
+            /**************/
+
+            /* Disable boot protection */
+
+            // Check if NVMCTRL is ready
+            while (NVMCTRL->STATUS.bit.READY == 0) {
+            }
+
+            // Execute the SBPDIS command to disable BOOTPROT
+            NVMCTRL->CTRLB.reg = NVMCTRL_CTRLB_CMD_SBPDIS | NVMCTRL_CTRLB_CMDEX_KEY;
+
+            // Wait for the operation to complete
+            while (NVMCTRL->STATUS.bit.READY == 0) {
+            }
+
+            if (flash_unlock(&FLASH_0, 0, FLASH_REGION_PAGE_NUM) != FLASH_REGION_PAGE_NUM) {
+                screen_print_debug("first flash_unlock failed", 1500);
+            }
+            if (flash_unlock(&FLASH_0, 32 * 1024, FLASH_REGION_PAGE_NUM) != FLASH_REGION_PAGE_NUM) {
+                screen_print_debug("second flash_unlock failed", 1500);
+            }
+            if (flash_write(&FLASH_0, ptr, &_new_root_pubkeys[0][0], 64*3) != ERR_NONE) {
+                screen_print_debug("flash_write: rotation failed", 5000);
+            }
+            reboot();
+            break;
+        }
+    }
+    screen_print_debug("rotation failed - not found", 5000);
+    reboot();
+}

src/keyrotation.h

@@ -0,0 +1,20 @@
+// Copyright 2023 Shift Crypto AG
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef _KEYROTATION_H_
+#define _KEYROTATION_H_
+
+void keyrotation(void);
+
+#endif