Support for CUSTOM_ENCRYPT_KEY that allows customer to supply their own implementation

Author: dgarske

docs/encrypted_partitions.md

@@ -36,6 +36,28 @@ wolfBoot upon next boot.
 Aside from setting the temporary key, the update mechanism remains the same for distributing, uploading and
 installing firmware updates through wolfBoot.
 
+### Custom encryption key storage
+
+You can use the `CUSTOM_ENCRYPT_KEY` option to implement your own functions for:
+`wolfBoot_get_encrypt_key`, `wolfBoot_set_encrypt_key`, `wolfBoot_erase_encrypt_key`,
+and `wolfBoot_initialize_encryption`.
+
+To enable:
+
+1) Add `CUSTOM_ENCRYPT_KEY=1` to your `.config`
+2) Add your own .c file using `OBJS_EXTRA`. For example, for your own
+   `src/custom_encrypt_key.c` add this to your `.config`:
+   `OBJS_EXTRA=src/custom_encrypt_key.o`
+
+Your custom implementation must provide these functions:
+
+```c
+int wolfBoot_set_encrypt_key(const uint8_t *key, const uint8_t *nonce);
+int wolfBoot_get_encrypt_key(uint8_t *key, uint8_t *nonce);
+int wolfBoot_erase_encrypt_key(void);
+int wolfBoot_initialize_encryption(void);
+```
+
 ### Libwolfboot API
 
 The API to communicate with the bootloader from the application is expanded when this feature is enabled,

options.mk

@@ -563,6 +563,9 @@ ifeq ($(ENCRYPT),1)
       endif
     endif
   endif
+  ifeq ($(CUSTOM_ENCRYPT_KEY),1)
+    CFLAGS+=-D"CUSTOM_ENCRYPT_KEY"
+  endif
 endif
 
 ifeq ($(EXT_FLASH),1)

src/libwolfboot.c

@@ -81,6 +81,7 @@ extern void aes_set_iv(uint8_t *nonce, uint32_t address);
 #endif
 
 #if defined (__WOLFBOOT) || defined (UNIT_TEST)
+#ifndef CUSTOM_ENCRYPT_KEY
 int wolfBoot_initialize_encryption(void)
 {
     if (!encrypt_initialized) {
@@ -91,6 +92,7 @@ int wolfBoot_initialize_encryption(void)
     }
     return 0;
 }
+#endif /* !CUSTOM_ENCRYPT_KEY */
 #endif
 
 #else
@@ -1491,6 +1493,7 @@ static int RAMFUNCTION hal_set_key(const uint8_t *k, const uint8_t *nonce)
     return ret;
 #endif
 }
+#ifndef CUSTOM_ENCRYPT_KEY
 /**
  * @brief Set the encryption key.
  *
@@ -1545,7 +1548,8 @@ int RAMFUNCTION wolfBoot_get_encrypt_key(uint8_t *k, uint8_t *nonce)
 #endif
     return 0;
 }
-#endif
+#endif /* UNIT_TEST */
+
 /**
  * @brief Erase the encryption key.
  *
@@ -1575,6 +1579,7 @@ int RAMFUNCTION wolfBoot_erase_encrypt_key(void)
 #endif
     return 0;
 }
+#endif /* !CUSTOM_ENCRYPT_KEY */
 
 #if defined(__WOLFBOOT) || defined(UNIT_TEST)