Wolfhsm no keystore

[bigbrett]

Main Change

wolfHSM client mode (and server mode with cert-chain verify) now builds without a local wolfBoot keystore. Public keys live on the HSM, referenced by key ID or resolved from a verified certificate chain. The old hybrid path that loaded keys from keystore.c and pushed them to the HSM as ephemeral keys is removed.

• No keystore linked with wolfHSM: WOLFHSM_CLIENT=1 (or WOLFHSM_SERVER=1 with CERT_CHAIN_VERIFY=1) no longer compiles/links src/keystore.o. Defines WOLFBOOT_NO_KEYSTORE, which skips the keystore permission-mask check and pubkey-hash lookups since key authorization is enforced by the HSM.

Other changes

• Removed WOLFBOOT_USE_WOLFHSM_PUBKEY_ID and the WOLFHSM_CLIENT_LOCAL_KEYS make option. Clients now always use HSM-resident keys. This simplifies the #ifspaghetti in src/image.c.

• Parameterizable client ID: new WOLFHSM_CLIENT_ID make variable (default 1) replaces hardcoded IDs all of the various HALs.

• Server mode requires cert chain: WOLFHSM_SERVER=1 without
  CERT_CHAIN_VERIFY=1 now fails the build with a clear error (was always disallowed, now just added explicit error)

• ML-DSA wolfHSM fixes: added missing server-side ML-DSA key export and post-verify key eviction for client and server cert-chain modes.

• Doc updates

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR removes support for “local keystore public keys” in wolfHSM client mode and introduces a WOLFBOOT_NO_KEYSTORE build path to avoid compiling/linking the built-in keystore when wolfHSM is the source of trust.

Changes:

• Make wolfHSM client builds always use HSM-resident public keys and drop WOLFBOOT_USE_WOLFHSM_PUBKEY_ID configuration.
• Add WOLFBOOT_NO_KEYSTORE build logic and guard keystore-dependent code paths accordingly.
• Update wolfHSM documentation to reflect the new configuration behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/image.c	Adjusts signature verification and authenticity checks to support HSM-only keying and optional “no keystore” builds.
options.mk	Forces --nolocalkeys and removes conditional WOLFBOOT_USE_WOLFHSM_PUBKEY_ID behavior for wolfHSM client builds.
docs/wolfHSM.md	Removes WOLFBOOT_USE_WOLFHSM_PUBKEY_ID docs and clarifies key sourcing in client mode.
Makefile	Adds WOLFHSM_NO_KEYSTORE logic and defines WOLFBOOT_NO_KEYSTORE to omit keystore linkage when applicable.

Comments suppressed due to low confidence (1)

src/image.c:1

• When WOLFBOOT_NO_KEYSTORE is defined, the per-partition key authorization check is entirely bypassed. If the HSM policy is guaranteed to enforce equivalent constraints, that should be made explicit in code via a compile-time constraint (e.g., require WOLFBOOT_CERT_CHAIN_VERIFY and/or a specific HSM policy flag when WOLFBOOT_NO_KEYSTORE is set). Otherwise, consider introducing an HSM-backed partition/key-usage check so you don’t lose this authorization control in no-keystore builds.

/* image.c

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #798

Scan targets checked: wolfboot-bugs, wolfboot-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #798

Scan targets checked: wolfboot-bugs, wolfboot-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #798

Scan targets checked: wolfboot-bugs, wolfboot-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
2 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Low] Removed make option WOLFHSM_CLIENT_LOCAL_KEYS left dangling; new WOLFHSM_CLIENT_ID not registered — tools/config.mk:95,137 (and config/examples/sim-wolfHSM-client-ecc.config:28, sim-wolfHSM-client-mldsa.config:49)
• [Low] Potential hybrid-signing build break in wolfHSM no-keystore mode — src/image.c:2455-2459
• [Info] $(error) continuation line embeds leading whitespace into the message — options.mk:1423-1426
• [Info] WOLFHSM_SERVER misconfiguration $(error) also aborts clean targets — options.mk:1420-1426

Review generated by Skoll

[dgarske]

#798 (review)

[bigbrett]

@dgarske

[Low] Potential hybrid-signing build break in wolfHSM no-keystore mode — src/image.c:2455-2459

wolfHSM was not intended to be useable with hybrid signatures, since that would require a secondary public key ID to be registered for all woflHSM HALs. It is definitely something we can do and support, but was not within the scope of this PR.

[Low] Removed make option WOLFHSM_CLIENT_LOCAL_KEYS left dangling; new WOLFHSM_CLIENT_ID not registered — tools/config.mk:95,137 (and config/examples/sim-wolfHSM-client-ecc.config:28, sim-wolfHSM-client-mldsa.config:49)

This is the one thing my local skolling didn't seem to find (though innocuous). Fixed in my latest commit. I will re-request review when CI clears.

Also pushed an unrelated commit as I forgot to rename the Makefile variable to match the macro name