Fail to Encrypt image (ESPTOOL-683)

[hdpklm]

Answers checklist.

• I have read the documentation ESP-IDF Programming Guide and the issue is not addressed there.
• I have updated my IDF branch (master or release) to the latest version and checked that the issue is present there.
• I have searched the issue tracker for a similar issue and not found a similar issue.

IDF version.

ESP-IDF v5.2-dev-24-gf404fe96b1-dirty

Operating System used.

Windows

How did you build your project?

Command line with idf.py

If you are using Windows, please specify command line type.

None

What is the expected behavior?

Hello

I try to generate a bin key for encrypt images with this command

espsecure digest_private_key --keyfile secure_boot_signing_key.pem key.bin

I get this error

# my secret key begin with 
-----BEGIN RSA PRIVATE KEY-----

# and not by 
-----BEGIN PRIVATE KEY-----

espsecure digest_private_key --keyfile secure_boot_signing_key.pem key.bin
espsecure.py v4.5.1
Traceback (most recent call last):
  File "C:\Python39\lib\runpy.py", line 197, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "C:\Python39\lib\runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "C:\Python39\lib\site-packages\espsecure\__main__.py", line 8, in <module>
    espsecure._main()
  File "C:\Python39\lib\site-packages\espsecure\__init__.py", line 1790, in _main
    main()
  File "C:\Python39\lib\site-packages\espsecure\__init__.py", line 1780, in main
    operation_func(args)
  File "C:\Python39\lib\site-packages\espsecure\__init__.py", line 1023, in digest_private_key
    sk = _load_ecdsa_signing_key(args.keyfile)
  File "C:\Python39\lib\site-packages\espsecure\__init__.py", line 205, in _load_ecdsa_signing_key
    sk = ecdsa.SigningKey.from_pem(keyfile.read())
  File "C:\Python39\lib\site-packages\ecdsa\keys.py", line 962, in from_pem
    private_key_index = string.index(b"-----BEGIN PRIVATE KEY-----")
ValueError: subsection not found

I try to change the header "-----BEGIN PRIVATE KEY-----" of security file but I get this error

espsecure digest_private_key --keyfile secure_boot_signing_key.pem key.bin
espsecure.py v4.5.1
Traceback (most recent call last):
  File "C:\Python39\lib\runpy.py", line 197, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "C:\Python39\lib\runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "C:\Python39\Scripts\espsecure.exe\__main__.py", line 7, in <module>
  File "C:\Python39\lib\site-packages\espsecure\__init__.py", line 1790, in _main
    main()
  File "C:\Python39\lib\site-packages\espsecure\__init__.py", line 1780, in main
    operation_func(args)
  File "C:\Python39\lib\site-packages\espsecure\__init__.py", line 1023, in digest_private_key
    sk = _load_ecdsa_signing_key(args.keyfile)
  File "C:\Python39\lib\site-packages\espsecure\__init__.py", line 205, in _load_ecdsa_signing_key
    sk = ecdsa.SigningKey.from_pem(keyfile.read())
  File "C:\Python39\lib\site-packages\ecdsa\keys.py", line 964, in from_pem
    return cls.from_der(
  File "C:\Python39\lib\site-packages\ecdsa\keys.py", line 1116, in from_der
    raise der.UnexpectedDER(
ecdsa.der.UnexpectedDER: expected version '1' at start of DER privkey, got 0

What is the actual behavior?

...

Steps to reproduce.

na

Build or installation Logs.

No response

More Information.

No response

[AdityaHPatwardhan]

@hdpklm By default RSA key is in pkcs1 format and openssl requires the key in pkcs8 format.
It can be done as follows.

openssl pkcs8 -topk8 -nocrypt -in secure_boot_sigining_key.pem -out secure_boot_sigining_key_new.pem

but I agree this should probably be handled by the espsecure.py or at least some hint should be provided.

I am afraid raising an issue here in esp-idf would not help as espsecure is an external script which is a part of the esptool repository.
I will check if this issue can be transferred to https://github.com/espressif/esptool/issues

[AdityaHPatwardhan]

Hi @hdpklm I think there are two different issues here

1. espsecure digest_private_key --keyfile secure_boot_signing_key.pem key.bin
   This command won't work with an RSA key as RSA key is not supported for secure boot v1. and this command only generates the digest for secure boot v1. I think the documentation can have a point clearly mentioning this. Please use the command digest_sbv2_public_key instead of this command.

2. Fix the crash in above case, instead of crashing it should return appropriate error.

CC @dobairoland