lkml.org 
[lkml]   [2015]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: sign-file and detached PKCS#7 firmware signatures
On Fri, May 15, 2015 at 08:07:55PM +0100, David Howells wrote:
> Hi Luis,
>
> As David Woodhouse pointed out to me, you don't need sign-file if you're just
> going to create a detached PKCS#7 message as your signature. You can just use
> "openssl smime" directly.
>
> The reason that sign-file is needed for module signing is that the signature
> is added to the module with a little bit of metadata to indicate its presence
> - but if you're having detached signatures, that isn't relevant.
>
> You can do this with two steps:
>
> (1) Require that an X.509 certificate is made available to the kernel to
> provide the public key. One way to do this is to convert it to DER form
> and place it in the source directory as <name>.x509 when you build the
> kernel.

OK.

> (2) Document that to produce a signature for a firmware blob, you just run
> the following command:
>
> openssl smime -sign \
> -in $FIRMWARE_BLOB_NAME \
> -outform DER \
> -inkey $PRIVATE_KEY_FILE_IN_PEM_FORM \
> -signer $X509_CERT_FILE_IN_PEM_FORM \
> -nocerts \
> -md $DIGEST_ALGORITHM \

There's a missing -binary argument here, other than that this works fine.

> >$PKCS7_MESSAGE_FILE_IN_DER_FORM

I however cannot figure out how to use openssl to verify this signature.

> Note that if you have crypto hardware available that openssl can use, you
> can do that in this command.
>
>
> To summarise, what you have to present to the kernel is the following:
>
> (A) A DER-encoded X.509 certificate containing the public key.
>
> (B) A DER-encoded PKCS#7 message containing the signatures.
>
> (C) A binary blob that is the detached data for the PKCS#7 message.

Will respin.

Lui


\
 
 \ /
  Last update: 2015-05-19 01:21    [W:0.069 / U:4.524 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site