12

Are there any open source crypto libraries that can be used in embedded systems or in other memory constrained places like a boot rom? I am looking for libraries that I can compile only the algorithms I want and leave the rest out. What is the standard procedure to get crypto implementations for say, including in a boot ROM?

I am specifically looking for these implementations so I can verify signed binaries,

  • RSA,
  • DSA, or
  • ECDSA
Improve this question
1

3 Answers 3

Reset to default
2

You could download the source of the OpenSSL libcrypto from here and just use - with appropriate attributions - the parts that you need in your boot ROM.

Supported algorithms, (According to Wikipedea):

  • Ciphers
    • AES, Blowfish, Camellia, SEED, CAST-128, DES, IDEA, RC2, RC4, RC5, Triple DES, GOST 28147-89
  • Cryptographic hash functions
    • MD5, MD4, MD2, SHA-1, SHA-2, RIPEMD-160, MDC-2, GOST R 34.11-94
  • Public-key cryptography
    • RSA, DSA, Diffie–Hellman key exchange, Elliptic curve, GOST R 34.10-2001

It is Apache/BSD licensed so you should be OK using it in other products but beware of the cipher/cryptography export restrictions in some countries.

Improve this answer
2
  • Is that what people usually do? I was hoping there would be specialized RSA or EC libraries.
    – user220201
    Commented Jul 30, 2015 at 12:46
  • It depends on the nature of the project and the budget, etc., if you are doing Open Source then almost always if you are on a commercial project with a good budget and using something like VxWorks or QNX then there are libraries available from them.
    – Steve Barnes
    Commented Jul 30, 2015 at 17:22
1

Easy-ecc worked for me and it beats everything else by two orders of magnitude in terms of simplicity.

https://github.com/esxgx/easy-ecc

My second choice would be libtomcrypt (+ libtommath), although last time I've tried it I wasn't able quickly cut it to less than 100 kB binary on 32-bit DSP, so it may be not viable for bootloader.

Improve this answer
1

I'll tentatively suggest mbed TLS, formerly known as PolarSSL. Tentatively because I've never actually used it in an embedded project.

It's maintained by ARM, and was designed to fit well on low-end platforms. The source code is fairly clean, portable C. You can easily pick the sources files you're interested in and omit the rest. RSA and ECDSA are supported, but not traditional DSA.

For open source projects, the library is licensed under the GNU GPL (not the LGPL), which is restrictive, but there are exceptions that allow linking with non-GPL open source code. A license that allows closed-source distribution is also available for a fee.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.