lkml.org 
[lkml]   [2015]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: sign-file and detached PKCS#7 firmware signatures
Date
Luis R. Rodriguez <mcgrof@suse.com> wrote:

> I'll also mention:
>
> ---
> The $DIGEST_ALGORITHM needs to be supported on the running kernel and
> can differ from CONFIG_MODULE_SIG_HASH.
> ---
>
> As I do no think that is quite obvious to a system integrator at first.

Actually, this isn't necessarily so for the firmware.

It *is* for the module signing, but you can always load the module to give you
the digest algorithm (or public key algorithm) for the firmware.

Though you would still have to be careful with firmware loaded during the
initramfs phase.

David


\
 
 \ /
  Last update: 2015-05-19 21:21    [W:0.143 / U:0.260 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site