Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH RFC 0/4] Add firmware signature file check | Date | Tue, 06 Nov 2012 00:05:25 +0000 |
| |
David Howells <dhowells@redhat.com> wrote:
> Takashi Iwai <tiwai@suse.de> wrote: > > > this is a patch series to add the support for firmware signature > > check. At this time, the kernel checks extra signature file (*.sig) > > for each firmware, instead of embedded signature. > > It's just a quick hack using the existing module signing mechanism, > > thus provided only as a proof of concept for now. > > There is another way to do this. If you look at the patches I proposed to > wrap keys in PE binaries, you'll find that that can handle PKCS#7 format > messages as that's what's in the sort of signed PE binary we're dealing with.
See:
http://git.kernel.org/?p=linux/kernel/git/dhowells/linux-modsign.git;a=shortlog;h=refs/heads/devel-pekey
> You could use this to put the firmware inside a signed-data PKCS#7 message.
Note that the ASN.1 decoder in the kernel would need altering to handle messages larger than 64KB.
David
| |