Skip to content

Commit 224ee0d

Browse files
nordic-mik7nordic-mik7
committed
tests: Extend SUIT tests for fetch, copy and write with decryption
This commit extends integration tests for fetch, copy and write SUIT directives with test cases for payload decryption. Common test module decrypt_test_utils.c was added with default constants and utilities for decryption tests to use. Refactor of decrypt_filter/src/main.c was made because of this common module. Ref: NCSDK-31276 Signed-off-by: Michal Kozikowski <michal.kozikowski@nordicsemi.no>
1 parent 509fa66 commit 224ee0d

File tree

15 files changed

+653
-171
lines changed

15 files changed

+653
-171
lines changed

‎tests/subsys/suit/common/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
add_subdirectory(mci_test)
88
add_subdirectory(validator_test)
9+
add_subdirectory(decrypt_utils)
910
zephyr_include_directories(${CMAKE_CURRENT_LIST_DIR}/include)
1011

1112
if (CONFIG_MBEDTLS)

‎tests/subsys/suit/common/decrypt_utils/CMakeLists.txt

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright (c) 2025 Nordic Semiconductor ASA
2+
#
3+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
4+
#
5+
6+
if (CONFIG_SUIT_STREAM_FILTER_DECRYPT)
7+
zephyr_library_named(suit_decrypt_test_utils)
8+
zephyr_include_directories(.)
9+
zephyr_library_sources(decrypt_test_utils.c)
10+
zephyr_library_link_libraries(suit_metadata)
11+
12+
13+
if (CONFIG_MBEDTLS)
14+
# Link MCI (incl. crypto) module with mbedTLS library, that provides PSA crypto APIs.
15+
zephyr_library_link_libraries(mbedTLS)
16+
endif() # CONFIG_MBEDTLS
17+
18+
endif()

‎tests/subsys/suit/common/decrypt_utils/decrypt_test_utils.c

+133
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
/*
2+
* Copyright (c) 2025 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
*/
6+
7+
8+
#include "decrypt_test_utils.h"
9+
10+
/* This module holds common utilities for SUIT decrypt filter tests.
11+
* It defines default encryption key data, plaintext and ciphertext along with other
12+
* suit_encryption_info struct members that can be used while testing.
13+
*
14+
* WARNING: All of the const values defined in this module CAN be changed freely.
15+
* This also means that any test depending on them should expect it.
16+
*/
17+
18+
19+
/**
20+
* The master key used by these tests can be imported into the local KMS backend by running:
21+
*
22+
* nrfkms import_keyvalue -k TEST_AES_KEY -t aes -v aHWJdIkl5hdXw4SS1nTdVYE/q7ycMOZm2mR6qx/KvKw=
23+
*
24+
* The KEK below is derived from context "test"
25+
* To acquire it run:
26+
* nrfkms export_derived -k TEST_AES_KEY -c test --format native
27+
* hexdump -e '16/1 "0x%02x, " "\n"' kms_output/derived_key_native_test_from_TEST_AES_KEY.bin
28+
*/
29+
const uint8_t decrypt_test_key_data[] = {
30+
0xf8, 0xfa, 0x8e, 0x7b, 0xed, 0x32, 0xd0, 0xc7, 0x15, 0x1f, 0xd9, 0xab, 0x0d,
31+
0x8d, 0xed, 0x95, 0x26, 0xa8, 0x6a, 0x15, 0x34, 0x16, 0x01, 0xcf, 0x9c, 0x6b,
32+
0xba, 0x00, 0x6a, 0xab, 0xaa, 0x9a,
33+
};
34+
35+
const uint8_t decrypt_test_plaintext[] = {
36+
"This is a sample plaintext for testing the decryption filter",
37+
};
38+
39+
const uint8_t decrypt_test_aad[] = {
40+
"sample aad"
41+
};
42+
43+
/**
44+
* Encryption and using wrapped CEK achieved by running:
45+
*
46+
* echo "This is a sample plaintext for testing the decryption filter" > plaintext.txt
47+
* nrfkms wrap -k TEST_AES_KEY -c test -f plaintext.txt --format native -t aes --aad "sample aad"
48+
*
49+
* Wrapped CEK stored in the resulting wrapped_aek-aes-... file
50+
*
51+
* Ciphertext and NONCE (IV) taken from the encrypted_asset-... file, which is in format
52+
* |nonce (12 bytes)|ciphertext|tag (16 bytes)|
53+
*
54+
*/
55+
const uint8_t decrypt_test_wrapped_cek[] = {
56+
0x7d, 0xd6, 0xf4, 0xd3, 0x52, 0x44, 0x5a, 0x3a, 0x67, 0xb8, 0xcc,
57+
0x74, 0x5b, 0x4b, 0x6f, 0x70, 0x62, 0xc3, 0xf2, 0x7b, 0x6b, 0x14,
58+
0xf1, 0x06, 0x57, 0xa3, 0x68, 0x32, 0x44, 0xc3, 0x85, 0x77, 0x86,
59+
0xe7, 0xda, 0x15, 0xbf, 0xf8, 0x9e, 0x63,
60+
};
61+
62+
const uint8_t decrypt_test_ciphertext_aes_kw[] = {
63+
/* tag (16 bytes) */
64+
0xdc, 0xe6, 0x95, 0xac, 0x0f, 0x61, 0x87, 0x17, 0x51, 0x48, 0xb4, 0xa1,
65+
0x8e, 0x09, 0x89, 0xb4,
66+
/* ciphertext */
67+
0x8b, 0xfb, 0xd9, 0xe4, 0xcf, 0xde, 0xf8, 0xcf, 0xe5, 0x69, 0x9d, 0x6d,
68+
0x92, 0x8a, 0x04, 0xf8, 0x26, 0x22, 0xd5, 0xd8, 0xe8, 0x77, 0x18, 0x5a,
69+
0x01, 0x13, 0xba, 0xd5, 0x23, 0x72, 0xae, 0x80, 0x44, 0xed, 0xea, 0xdf,
70+
0x74, 0x79, 0x8a, 0x83, 0x52, 0x72, 0x2f, 0x43, 0x06, 0xe9, 0xd4, 0xbb,
71+
0x54, 0x8a, 0x0d, 0xea, 0x7f, 0xe6, 0x48, 0xf0, 0xfd, 0x0e, 0xbb, 0xaa,
72+
0xa3,
73+
};
74+
75+
const uint8_t decrypt_test_iv_aes_kw[] = {
76+
0x61, 0xb4, 0x70, 0x53, 0xa5, 0xe2, 0x05, 0x68, 0xfe, 0x77, 0x12, 0x89,
77+
};
78+
79+
/**
80+
* Encryption without wrapping CEK achieved by running:
81+
*
82+
* echo "This is a sample plaintext for testing the decryption filter" > plaintext.txt
83+
* nrfkms encrypt -k TEST_AES_KEY -c test -f plaintext.txt --aad "sample aad" --format native
84+
*
85+
* Ciphertext and NONCE (IV) taken from the encrypted_data_using_TEST_AES_KEY-test.bin file,
86+
* which is in format |nonce (12 bytes)|tag (16 bytes)|ciphertext|
87+
*/
88+
89+
const uint8_t decrypt_test_ciphertext_direct[] = {
90+
/* tag (16 bytes) */
91+
0x4d, 0x21, 0x30, 0xb7, 0xce, 0x8a, 0xd6, 0x00, 0xe4, 0x04, 0xbb, 0x32,
92+
0x72, 0x7a, 0xbb, 0x7c,
93+
/* ciphertext */
94+
0xf0, 0x72, 0xdb, 0x63, 0x03, 0xdd, 0x24, 0x69,
95+
0xd4, 0xbf, 0xd7, 0xa0, 0xec, 0xfa, 0x66, 0x58, 0x95, 0x2b, 0xc1, 0xc2,
96+
0x9d, 0x82, 0x02, 0x1a, 0xd7, 0x5b, 0xc0, 0x01, 0xce, 0x0b, 0x79, 0x53,
97+
0xe7, 0xdb, 0x0d, 0x35, 0xab, 0xef, 0x81, 0xc8, 0x68, 0xc5, 0xa7, 0x22,
98+
0x90, 0xea, 0xd0, 0x7f, 0x36, 0xed, 0x14, 0xbe, 0x30, 0xf2, 0x81, 0x56,
99+
0x7e, 0x2e, 0x5f, 0xd8, 0x7c,
100+
};
101+
102+
const uint8_t decrypt_test_iv_direct[] = {
103+
0x60, 0x90, 0x6d, 0xb2, 0xfe, 0xc3, 0xc8, 0x5a, 0xf0, 0x28, 0xb1, 0xb6,
104+
};
105+
106+
const suit_manifest_class_id_t decrypt_test_sample_class_id = {
107+
{0x5b, 0x46, 0x9f, 0xd1, 0x90, 0xee, 0x53, 0x9c, 0xa3, 0x18, 0x68, 0x1b, 0x03, 0x69, 0x5e,
108+
0x36}};
109+
110+
psa_status_t decrypt_test_init_encryption_key(const uint8_t *data, size_t size,
111+
psa_key_id_t *key_id, psa_key_id_t alg, uint8_t *cbor_key_id)
112+
{
113+
psa_status_t status;
114+
115+
/* Configure the key attributes */
116+
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
117+
118+
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT);
119+
psa_set_key_lifetime(&key_attributes, PSA_KEY_LIFETIME_VOLATILE);
120+
psa_set_key_algorithm(&key_attributes, alg);
121+
psa_set_key_type(&key_attributes, PSA_KEY_TYPE_AES);
122+
psa_set_key_bits(&key_attributes, 256);
123+
124+
status = psa_import_key(&key_attributes, data, size, key_id);
125+
126+
/* Encode KEK key ID as CBOR unsigned int */
127+
cbor_key_id[1] = ((*key_id >> 24) & 0xFF);
128+
cbor_key_id[2] = ((*key_id >> 16) & 0xFF);
129+
cbor_key_id[3] = ((*key_id >> 8) & 0xFF);
130+
cbor_key_id[4] = ((*key_id >> 0) & 0xFF);
131+
132+
return status;
133+
}

‎tests/subsys/suit/common/decrypt_utils/decrypt_test_utils.h

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/*
2+
* Copyright (c) 2025 Nordic Semiconductor ASA
3+
*
4+
* SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
*/
6+
7+
#include <psa/crypto.h>
8+
#include <suit_metadata.h>
9+
10+
/* This module holds common utilities for SUIT decrypt filter tests.
11+
* It defines default encryption key data, plaintext and ciphertext along with other
12+
* suit_encryption_info struct members that can be used while testing.
13+
*
14+
* WARNING: All of the const values defined in this module CAN be changed freely.
15+
* This also means that any test depending on them should expect it.
16+
*/
17+
18+
19+
/* Default initalization for suit_encryption_info struct.
20+
* 'cek_key_id_cbor' - should be taken from init_encryption_key() call.
21+
*/
22+
#define DECRYPT_TEST_ENC_INFO_DEFAULT_INIT(cek_key_id_cbor) \
23+
{ \
24+
.enc_alg_id = suit_cose_aes256_gcm, \
25+
.IV = { \
26+
.value = decrypt_test_iv_direct, \
27+
.len = sizeof(decrypt_test_iv_direct), \
28+
}, \
29+
.aad = { \
30+
.value = decrypt_test_aad, \
31+
.len = strlen(decrypt_test_aad), \
32+
}, \
33+
.kw_alg_id = suit_cose_direct, \
34+
.kw_key.direct = {.key_id = {.value = (cek_key_id_cbor), \
35+
.len = sizeof((cek_key_id_cbor))},} \
36+
}
37+
38+
#define DECRYPT_TEST_KEY_LENGTH 32
39+
extern const uint8_t decrypt_test_key_data[DECRYPT_TEST_KEY_LENGTH];
40+
41+
#define DECRYPT_TEST_PLAINTEXT_LENGTH 61
42+
extern const uint8_t decrypt_test_plaintext[DECRYPT_TEST_PLAINTEXT_LENGTH];
43+
44+
#define DECRYPT_TEST_AAD_LENGTH 11
45+
extern const uint8_t decrypt_test_aad[DECRYPT_TEST_AAD_LENGTH];
46+
47+
#define DECRYPT_TEST_WRAPPED_CEK_LENGTH 40
48+
extern const uint8_t decrypt_test_wrapped_cek[DECRYPT_TEST_WRAPPED_CEK_LENGTH];
49+
50+
#define DECRYPT_TEST_CIPHERTEXT_AES_KW_LENGTH (DECRYPT_TEST_PLAINTEXT_LENGTH + 16)
51+
extern const uint8_t decrypt_test_ciphertext_aes_kw[DECRYPT_TEST_CIPHERTEXT_AES_KW_LENGTH];
52+
53+
#define DECRYPT_TEST_IV_AES_KW_LENGTH 12
54+
extern const uint8_t decrypt_test_iv_aes_kw[DECRYPT_TEST_IV_AES_KW_LENGTH];
55+
56+
#define DECRYPT_TEST_CIPHERTEXT_DIRECT_LENGTH (DECRYPT_TEST_PLAINTEXT_LENGTH + 16)
57+
extern const uint8_t decrypt_test_ciphertext_direct[DECRYPT_TEST_CIPHERTEXT_DIRECT_LENGTH];
58+
59+
#define DECRYPT_TEST_IV_DIRECT_LENGTH 12
60+
extern const uint8_t decrypt_test_iv_direct[DECRYPT_TEST_IV_DIRECT_LENGTH];
61+
62+
extern const suit_manifest_class_id_t decrypt_test_sample_class_id;
63+
64+
psa_status_t decrypt_test_init_encryption_key(const uint8_t *data, size_t size,
65+
psa_key_id_t *key_id, psa_key_id_t alg, uint8_t *cbor_key_id);

‎tests/subsys/suit/copy/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,4 @@ zephyr_library_link_libraries(suit_memptr_storage_interface)
1717
zephyr_library_link_libraries(suit_sink_selector_interface)
1818
zephyr_library_link_libraries(suit_storage_interface)
1919
zephyr_library_link_libraries(suit_manifest_variables)
20+
zephyr_library_link_libraries(suit_decrypt_test_utils)

‎tests/subsys/suit/copy/prj.conf

+2
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,5 @@ CONFIG_FLASH_MAP=y
3535

3636
CONFIG_SUIT_IPUC=y
3737
CONFIG_MOCK_SDFW_ARBITER=y
38+
39+
CONFIG_SUIT_STREAM_FILTER_DECRYPT=y

‎tests/subsys/suit/copy/src/main.c

+99
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
#include <mocks_sdfw.h>
1717
#include <suit_manifest_variables.h>
1818
#include <suit_storage.h>
19+
#include <decrypt_test_utils.h>
1920

2021
#define WRITE_ADDR 0x1A00080000
2122
#define TEST_MFST_VAR_NVM_ID 1
@@ -653,3 +654,101 @@ ZTEST(copy_tests, test_mfst_nvm_var_to_mram_NOK)
653654
zassert_equal(ret, SUIT_SUCCESS,
654655
"Failed to release destination component handle after the test: %d", ret);
655656
}
657+
658+
ZTEST(copy_tests, test_integrated_fetch_and_copy_to_msink_encrypted_OK)
659+
{
660+
memptr_storage_handle_t handle;
661+
struct zcbor_string source = {
662+
.value = decrypt_test_ciphertext_direct,
663+
.len = sizeof(decrypt_test_ciphertext_direct)
664+
};
665+
666+
suit_component_t src_handle;
667+
/* [h'CAND_IMG', h'02'] */
668+
uint8_t valid_src_value[] = {0x82, 0x49, 0x68, 'C', 'A', 'N', 'D',
669+
'_', 'I', 'M', 'G', 0x41, 0x02};
670+
671+
struct zcbor_string valid_src_component_id = {
672+
.value = valid_src_value,
673+
.len = sizeof(valid_src_value),
674+
};
675+
676+
psa_key_id_t cek_key_id;
677+
uint8_t cek_key_id_cbor[] = {
678+
0x1A, 0x00, 0x00, 0x00, 0x00,
679+
};
680+
681+
psa_status_t status = psa_crypto_init();
682+
683+
zassert_equal(status, PSA_SUCCESS, "Failed to init psa crypto");
684+
685+
status = decrypt_test_init_encryption_key(decrypt_test_key_data,
686+
sizeof(decrypt_test_key_data), &cek_key_id,
687+
PSA_ALG_GCM, cek_key_id_cbor);
688+
zassert_equal(status, PSA_SUCCESS, "Failed to import key");
689+
690+
struct suit_encryption_info enc_info =
691+
DECRYPT_TEST_ENC_INFO_DEFAULT_INIT(cek_key_id_cbor);
692+
693+
int ret = suit_plat_create_component_handle(&valid_src_component_id, false, &src_handle);
694+
695+
zassert_equal(ret, SUIT_SUCCESS, "create_component_handle failed - error %i", ret);
696+
697+
ret = suit_plat_fetch_integrated(src_handle, &source, &valid_manifest_component_id, NULL);
698+
zassert_equal(ret, SUIT_SUCCESS, "suit_plat_fetch failed - error %i", ret);
699+
700+
ret = suit_plat_component_impl_data_get(src_handle, &handle);
701+
zassert_equal(ret, SUIT_SUCCESS, "suit_plat_component_impl_data_get failed - error %i",
702+
ret);
703+
704+
const uint8_t *payload;
705+
size_t payload_size = 0;
706+
707+
ret = suit_memptr_storage_ptr_get(handle, &payload, &payload_size);
708+
zassert_equal(ret, SUIT_PLAT_SUCCESS, "storage.get failed - error %i", ret);
709+
zassert_equal_ptr(decrypt_test_ciphertext_direct, payload,
710+
"Retrieved payload doesn't mach ciphertext_direct");
711+
zassert_equal(sizeof(decrypt_test_ciphertext_direct), payload_size,
712+
"Retrieved payload_size doesn't mach size of ciphertext_direct");
713+
zassert_not_null(payload, "Retrieved payload is NULL");
714+
715+
/* Create handle that will be used as destination */
716+
suit_component_t dst_handle;
717+
/* [h'MEM', h'02', h'1A00080000', h'191000'] */
718+
uint8_t valid_dst_value[] = {0x84, 0x44, 0x63, 'M', 'E', 'M', 0x41, 0x02, 0x45,
719+
0x1A, 0x00, 0x08, 0x00, 0x00, 0x43, 0x19, 0x10, 0x00};
720+
721+
struct zcbor_string valid_dst_component_id = {
722+
.value = valid_dst_value,
723+
.len = sizeof(valid_dst_value),
724+
};
725+
726+
ret = suit_plat_create_component_handle(&valid_dst_component_id, false, &dst_handle);
727+
zassert_equal(ret, SUIT_SUCCESS, "create_component_handle failed - error %i", ret);
728+
729+
ret = suit_plat_copy(dst_handle, src_handle, &valid_manifest_component_id, &enc_info);
730+
zassert_equal(ret, SUIT_SUCCESS, "suit_plat_copy failed - error %i", ret);
731+
732+
ret = suit_plat_component_impl_data_get(dst_handle, &handle);
733+
zassert_equal(ret, SUIT_SUCCESS, "suit_plat_component_impl_data_get failed - error %i",
734+
ret);
735+
736+
ret = suit_memptr_storage_ptr_get(handle, &payload, &payload_size);
737+
zassert_equal(ret, SUIT_PLAT_SUCCESS, "storage.get failed - error %i", ret);
738+
zassert_equal(memcmp(decrypt_test_plaintext, payload, strlen(decrypt_test_plaintext)), 0,
739+
"Retrieved decrypted payload doesn't mach decrypt_test_plaintext");
740+
zassert_equal(sizeof(decrypt_test_plaintext), payload_size,
741+
"Retrieved payload_size doesn't mach size of decrypt_test_plaintext");
742+
743+
ret = suit_plat_release_component_handle(dst_handle);
744+
zassert_equal(ret, SUIT_SUCCESS, "dst_handle release failed - error %i", ret);
745+
746+
ret = suit_plat_release_component_handle(src_handle);
747+
zassert_equal(ret, SUIT_SUCCESS, "src_handle release failed - error %i", ret);
748+
749+
ret = suit_memptr_storage_release(handle);
750+
zassert_equal(ret, SUIT_PLAT_SUCCESS, "memptr_storage handle release failed - error %i",
751+
ret);
752+
753+
psa_destroy_key(cek_key_id);
754+
}

‎tests/subsys/suit/decrypt_filter/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,4 @@ target_include_directories(suit_mci INTERFACE ${ZEPHYR_NRF_MODULE_DIR}/subsys/su
1818
zephyr_library_link_libraries(suit_stream_filters_interface)
1919
zephyr_library_link_libraries(suit_stream_sources_interface)
2020
zephyr_library_link_libraries(suit_mci)
21+
zephyr_library_link_libraries(suit_decrypt_test_utils)

0 commit comments

Comments
 (0)