Messages in this thread | | | Date | Tue, 19 May 2015 01:13:04 +0200 | From | "Luis R. Rodriguez" <> | Subject | Re: sign-file and detached PKCS#7 firmware signatures |
| |
On Fri, May 15, 2015 at 08:07:55PM +0100, David Howells wrote: > Hi Luis, > > As David Woodhouse pointed out to me, you don't need sign-file if you're just > going to create a detached PKCS#7 message as your signature. You can just use > "openssl smime" directly. > > The reason that sign-file is needed for module signing is that the signature > is added to the module with a little bit of metadata to indicate its presence > - but if you're having detached signatures, that isn't relevant. > > You can do this with two steps: > > (1) Require that an X.509 certificate is made available to the kernel to > provide the public key. One way to do this is to convert it to DER form > and place it in the source directory as <name>.x509 when you build the > kernel.
OK.
> (2) Document that to produce a signature for a firmware blob, you just run > the following command: > > openssl smime -sign \ > -in $FIRMWARE_BLOB_NAME \ > -outform DER \ > -inkey $PRIVATE_KEY_FILE_IN_PEM_FORM \ > -signer $X509_CERT_FILE_IN_PEM_FORM \ > -nocerts \ > -md $DIGEST_ALGORITHM \
There's a missing -binary argument here, other than that this works fine.
> >$PKCS7_MESSAGE_FILE_IN_DER_FORM
I however cannot figure out how to use openssl to verify this signature.
> Note that if you have crypto hardware available that openssl can use, you > can do that in this command. > > > To summarise, what you have to present to the kernel is the following: > > (A) A DER-encoded X.509 certificate containing the public key. > > (B) A DER-encoded PKCS#7 message containing the signatures. > > (C) A binary blob that is the detached data for the PKCS#7 message.
Will respin.
Lui
| |