Add nat20crypto module to linux examples by werwurm · Pull Request #100 · aurora-opensource/libnat20

werwurm · 2026-05-04T22:51:06Z

The nat20crypto module implements the libnat20 crypto interface
in terms of linux kernel crypto primitives.
The module implements

deterministic ECDSA with curves P256 and P384.
Bytewise SHA-2 224/256/384/512
HMAC
HKDF

ED25519 is currently not supported.

Add a kernel module that provides libnat20 functionality to linux kernel modules. Also add a configuration to build a minimal linux image with buildroot and run in on qemu and a workflow to test build nat20lib.ko

…RIDE_DIR

This module creates a new character device class intended to implement the nat20 service protocol implementing DICE based device state attestation and an embedded CA.

The nat20crypto module implements the libnat20 crypto interface in terms of linux kernel crypto primitives. The module implements - deterministic ECDSA with curves P256 and P384. - Bytewise SHA-2 224/256/384/512 - HMAC - HKDF ED25519 is currently not supported.

github-actions · 2026-05-04T22:53:42Z

LCOV of commit `f5285c6` during lcov-test-coverage-report #199

Summary coverage rate:
  lines......: 95.7% (3013 of 3147 lines)
  functions..: 99.1% (230 of 232 functions)
  branches...: 87.2% (1646 of 1887 branches)

Files changed coverage rate: n/a

Copilot

Pull request overview

This PR adds a new nat20crypto Linux kernel module example that implements the libnat20 crypto interface using Linux kernel primitives (notably SHA-2 and ECC), and wires it into the Buildroot-based Linux examples and CI so it is built and packaged alongside existing NAT20 components.

Changes:

Introduce the examples/linux/nat20crypto kernel module (digest + deterministic ECDSA + key handling glue).
Add a Buildroot package (nat20crypto) and enable it in the QEMU Buildroot defconfig.
Extend developer tooling (envsetup.sh) and CI workflow to rebuild/build and verify nat20crypto.ko.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
examples/linux/nat20crypto/nat20crypto.c	Implements the nat20 crypto context (digest, kdf, ECDSA signing, pubkey export, key lifecycle) on Linux.
examples/linux/nat20crypto/Makefile	Adds standalone build/install targets for the nat20crypto kernel module.
examples/linux/nat20crypto/Kbuild	Defines module build flags/includes and extra symbols dependency on nat20lib.
examples/linux/nat20crypto/include/nat20crypto.h	Exposes module entry points (`open/close/make_secret`) for consumers.
examples/linux/br_external/utils/envsetup.sh	Adds `NAT20CRYPTO_OVERRIDE_SRCDIR` and `brrebuild nat20crypto` support.
examples/linux/br_external/package/nat20crypto/nat20crypto.mk	Adds Buildroot packaging/build instructions for the nat20crypto kernel module.
examples/linux/br_external/package/nat20crypto/Config.in	Adds Buildroot Kconfig option for enabling nat20crypto.
examples/linux/br_external/configs/qemu_br_defconfig	Enables `BR2_PACKAGE_NAT20CRYPTO=y` in the QEMU Buildroot config.
examples/linux/br_external/Config.in	Registers the nat20crypto package Kconfig entry in the external tree.
.github/workflows/linux-kmod-build.yml	Builds and verifies `nat20crypto.ko` in CI.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…/linux_example_nat20device

…urm/linux_example_nat20crypto

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

…ple_nat20device

…urm/linux_example_nat20crypto

seidelrj · 2026-05-08T13:51:11Z

+        /* This variant is used for ECC keys. */
+        struct {
+            size_t ndigits;
+            uint64_t digits[6];


where does the 6 come from? is it 48 bytes for ECC-384?

seidelrj · 2026-05-08T13:57:44Z

+                                         .size = context_size,
+                                         .buffer = context_buffer,
+                                     },
+                                     32,


sizeof(derived)?

seidelrj · 2026-05-08T14:03:25Z

+        };
+        /* This variant is used for CDIs. */
+        struct {
+            uint8_t bits[32];


constant for the 32 bytes (256 bit key). then the constant can be used for created the buffers in the kdf function.

seidelrj · 2026-05-08T14:04:05Z

+                rc = n20_error_crypto_no_resources_e;
+                goto out;
+            }
+            memcpy(new_cdi_key->bits, derived, 32);


sizeof(derived)?

seidelrj · 2026-05-08T14:05:13Z

+        case n20_crypto_key_type_secp256r1_e:
+        case n20_crypto_key_type_secp384r1_e: {
+            n20_slice_t x_octets = {
+                .size = 32,


sizeof(derived)?

seidelrj · 2026-05-08T14:29:05Z

+        }
+
+        /* Mod Invert k */
+        vli_mod_inv(k_inv, k, curve->n, ndigits);


i feel like that its crazy that linux doesn't have a built-in ecc sign function and you have to do the math yourself.

It kind of makes sense.This kind of functionality should really be delegated to secure elements. Checking signatures is different because it doesn't involve confidential key material.

timhirsh

Approving .github/workflows/linux-kmod-build.yml.

werwurm added 10 commits April 29, 2026 09:34

Add nat20lib kernel module example and br environment.

67ca3fc

Add a kernel module that provides libnat20 functionality to linux kernel modules. Also add a configuration to build a minimal linux image with buildroot and run in on qemu and a workflow to test build nat20lib.ko

Fixup lint and add Makefiles to license checker.

4070f76

Make bootstrap executable

de1ea2a

Use prebuild toolchain and stop building qemu from scratch.

36bc192

address comments and also resolve circular dependency when using OVER…

44c8f8f

…RIDE_DIR

Do not use relative paths

6627ce3

Add module nat20device to linux examples.

edbd436

This module creates a new character device class intended to implement the nat20 service protocol implementing DICE based device state attestation and an embedded CA.

Add nat20device to linux-kmod-build github action.

2fd948f

nat20device fixups

b9669af

werwurm requested a review from Copilot May 5, 2026 00:05

Copilot started reviewing on behalf of werwurm May 5, 2026 00:05 View session

Set override SRCDIR for dependencies.

49d4901

Copilot AI reviewed May 5, 2026

View reviewed changes

werwurm added 12 commits May 5, 2026 13:50

Address comments.

4b64988

Merge branch 'refs/heads/werwurm/linux_example_nat20lib' into werwurm…

b1899da

…/linux_example_nat20device

address comments

fee93e2

Serialize read and write access and document concurrency contracts.

e5a7001

Add macro for max instances

b491dbb

Merge branch 'refs/heads/werwurm/linux_example_nat20device' into werw…

6062a0b

…urm/linux_example_nat20crypto

Update license in package config.

1afed43

tidy

0eae0d8

Add SECURITY.md and fix some issues.

47f9055

fix error handling contract.

6a47870

address comments

54014fd

fixup KBuild

f645788

werwurm requested a review from Copilot May 6, 2026 23:06

Copilot started reviewing on behalf of werwurm May 6, 2026 23:07 View session

Copilot AI reviewed May 6, 2026

View reviewed changes

werwurm added 4 commits May 6, 2026 16:24

fixups

b621371

fix error path

b7b57a6

fix non standard deterministic DSA construction

502f49c

Change shash initialization order

f5e6efd

werwurm requested a review from Copilot May 7, 2026 15:14

Copilot started reviewing on behalf of werwurm May 7, 2026 15:15 View session

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread examples/linux/nat20crypto/nat20crypto.c Outdated

Comment thread examples/linux/nat20crypto/nat20crypto.c Outdated

Comment thread examples/linux/nat20crypto/nat20crypto.c

Comment thread examples/linux/nat20crypto/Makefile Outdated

werwurm added 6 commits May 7, 2026 09:16

typo

3ded408

Merge branch 'werwurm/linux_example_nat20lib' into werwurm/linux_exam…

1957cd9

…ple_nat20device

Merge branch 'main' into werwurm/linux_example_nat20device

7fd4b5b

Merge branch 'refs/heads/werwurm/linux_example_nat20device' into werw…

424d872

…urm/linux_example_nat20crypto

address comments

94a513c

Merge branch 'main' into werwurm/linux_example_nat20crypto

49f3f1a

werwurm changed the base branch from werwurm/linux_example_nat20device to main May 7, 2026 20:42

werwurm marked this pull request as ready for review May 7, 2026 20:48

werwurm requested a review from a team as a code owner May 7, 2026 20:48

werwurm requested review from seidelrj, smacdude and timhirsh May 7, 2026 20:48

seidelrj requested changes May 8, 2026

View reviewed changes

timhirsh approved these changes May 8, 2026

View reviewed changes

address comments

f5285c6

werwurm requested a review from seidelrj May 11, 2026 18:27

Conversation

werwurm commented May 4, 2026

Uh oh!

github-actions Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LCOV of commit f5285c6 during lcov-test-coverage-report #199

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

timhirsh left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented May 4, 2026 •

edited

Loading

LCOV of commit `f5285c6` during lcov-test-coverage-report #199