lkml.org 
[lkml]   [2015]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [RFD] linux-firmware key arrangement for firmware signing
    Date
    Luis R. Rodriguez <mcgrof@suse.com> wrote:

    > This begs the question on how we'd manage keys for firmware signing on
    > linux-firmare. Since the keys are x509 keys we need a CA. Based on some
    > initial discussions it would seem we'd need the Linux Foundation to create a
    > key, this would be embedded in the kernel and that key would be used to sign
    > Kyle's key. Kyle would in turn use his key for signing linux-firmware
    > files. David, Kyle, did I summarize this correctly ?

    Yes.

    > I think we need one change here, we'd need to ensure that such key could
    > only be used for vetting firmware files, not modules loaded. The
    > firmware_class could for instance still use all the keys in
    > system_trusted_keyring, which would include the UEFI key db, but it does not
    > seems reasonable to expect keys used for fw signing to also go into
    > system_trusted_keyring to also be used for module signing.

    X.509 certificates can take attributes that define what the key held therein
    may be used for.

    You actually have four categories of key usage, I think:

    (1) Signing modules.

    (2) Signing firmware.

    (3) Signing kernel binaries for kexec.

    (4) Signing other keys that can then be chained to (1) - (3).

    For instance, the LF might use their key to sign Kyle's key. Kyle might want
    to replace his key yearly, say, because the more examples of things signed
    with it, the more exposed it becomes. So the kernel would need to carry the
    LF key, say, and then the appropriate one of Kyle's keys could be loaded
    dynamically.

    David


    \
     
     \ /
      Last update: 2015-05-20 18:01    [W:4.063 / U:0.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site