Re: [U-Boot] [PATCH v3 03/12] image: Add RSA support for image signing
Hi Tom, On Thu, Jun 27, 2013 at 8:48 AM, Tom Rini wrote: > On Thu, Jun 27, 2013 at 08:45:34AM -0700, Simon Glass wrote: > > Hi Tom, > > > > On Thu, Jun 27, 2013 at 5:50 AM, Tom Rini wrote: > > > > > -BEGIN PGP SIGNED MESSAGE- > > > Hash: SHA1 > > > > > > On 06/27/2013 02:44 AM, Simon Glass wrote: > > > > Hi Masahiro, > > > > > > > > On Wed, Jun 26, 2013 at 9:08 PM, Masahiro Yamada > > > > mailto:yamad...@jp.panasonic.com>> > > > > wrote: > > > > > > > > Hello, Simon. > > > > > > > > > > > > When compiling the master branch, I got an error while a > > > > tools/mkimage build. > > > > > > > > > > > > u-boot/lib/rsa/rsa-sign.c:26:25: fatal error: openssl/rsa.h: No > > > > such file or directory > > > > > > > > > > > > I think this erorr is caused by commit 19c402a. > > > > > > > > > > > > I searched and installed the necessary package and I could resolve > > > > this error. > > > > > > > > $ apt-file search openssl/rsa.h libssl-dev: > > > > /usr/include/openssl/rsa.h $ sudo apt-get install libssl-dev > > > > > > > > > > > > Let me ask a question. > > > > > > > > Going forward do we always need the openssl development package > > > > for creating mkimage tool? Or is it possible to disable RSA feature > > > > by some CONFIG option? > > > > > > > > > > > > This is to support verified boot using FIT. Yes it would be > > > > possible to make it an option. I had it that way for a while, but > > > > then I worried that it would create two versions of mkimage, one > > > > of which is incapable of signing images. That means that mkimage > > > > would need to be built for a board with verified boot enabled in > > > > order to get full functionality. > > > > > > > > Perhaps another way would be to check for the header and (if not > > > > present), silently build without signing support? > > > > > > Hurk, dang it.. Yes, I think we need to build and go with an error > > > message on attempted use. Skimming the code, we can't rely on > > > CONFIG_FIT_SIGNATURE being inherited from the config, on the host > > > side, yes? > > > > > > > Yes I can make this check CONFIG_FIT_SIGNATURE - as mentioned I had it > that > > way originally but worred about creating different versions of mkimage. > > > > There is actually code there for this which we can use: > > > > #ifdef CONFIG_FIT_SIGNATURE > > fprintf(stderr, "Signing / verified boot options: [-k keydir] [-K dtb] [ > -c > > ] [-r]\n" > > " -k => set directory containing private keys\n" > > " -K => write public keys to this .dtb file\n" > > " -c => add comment in signature node\n" > > " -F => re-sign existing FIT image\n" > > " -r => mark keys used as 'required' in dtb\n"); > > #else > > fprintf(stderr, "Signing / verified boot not supported > > (CONFIG_FIT_SIGNATURE undefined)\n"); > > #endif > > > > Let me know if this is the preferred option and I will prepare a patch. > > The Makefile fragments I saw implied we couldn't use this approach on > the host. But if we can, lets. > That still seems to work OK. Will send a patch. Regards, Simon ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] [PATCH v3 03/12] image: Add RSA support for image signing
On Thu, Jun 27, 2013 at 08:45:34AM -0700, Simon Glass wrote: > Hi Tom, > > On Thu, Jun 27, 2013 at 5:50 AM, Tom Rini wrote: > > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA1 > > > > On 06/27/2013 02:44 AM, Simon Glass wrote: > > > Hi Masahiro, > > > > > > On Wed, Jun 26, 2013 at 9:08 PM, Masahiro Yamada > > > mailto:yamad...@jp.panasonic.com>> > > > wrote: > > > > > > Hello, Simon. > > > > > > > > > When compiling the master branch, I got an error while a > > > tools/mkimage build. > > > > > > > > > u-boot/lib/rsa/rsa-sign.c:26:25: fatal error: openssl/rsa.h: No > > > such file or directory > > > > > > > > > I think this erorr is caused by commit 19c402a. > > > > > > > > > I searched and installed the necessary package and I could resolve > > > this error. > > > > > > $ apt-file search openssl/rsa.h libssl-dev: > > > /usr/include/openssl/rsa.h $ sudo apt-get install libssl-dev > > > > > > > > > Let me ask a question. > > > > > > Going forward do we always need the openssl development package > > > for creating mkimage tool? Or is it possible to disable RSA feature > > > by some CONFIG option? > > > > > > > > > This is to support verified boot using FIT. Yes it would be > > > possible to make it an option. I had it that way for a while, but > > > then I worried that it would create two versions of mkimage, one > > > of which is incapable of signing images. That means that mkimage > > > would need to be built for a board with verified boot enabled in > > > order to get full functionality. > > > > > > Perhaps another way would be to check for the header and (if not > > > present), silently build without signing support? > > > > Hurk, dang it.. Yes, I think we need to build and go with an error > > message on attempted use. Skimming the code, we can't rely on > > CONFIG_FIT_SIGNATURE being inherited from the config, on the host > > side, yes? > > > > Yes I can make this check CONFIG_FIT_SIGNATURE - as mentioned I had it that > way originally but worred about creating different versions of mkimage. > > There is actually code there for this which we can use: > > #ifdef CONFIG_FIT_SIGNATURE > fprintf(stderr, "Signing / verified boot options: [-k keydir] [-K dtb] [ -c > ] [-r]\n" > " -k => set directory containing private keys\n" > " -K => write public keys to this .dtb file\n" > " -c => add comment in signature node\n" > " -F => re-sign existing FIT image\n" > " -r => mark keys used as 'required' in dtb\n"); > #else > fprintf(stderr, "Signing / verified boot not supported > (CONFIG_FIT_SIGNATURE undefined)\n"); > #endif > > Let me know if this is the preferred option and I will prepare a patch. The Makefile fragments I saw implied we couldn't use this approach on the host. But if we can, lets. -- Tom signature.asc Description: Digital signature ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] [PATCH v3 03/12] image: Add RSA support for image signing
Hi Tom, On Thu, Jun 27, 2013 at 5:50 AM, Tom Rini wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On 06/27/2013 02:44 AM, Simon Glass wrote: > > Hi Masahiro, > > > > On Wed, Jun 26, 2013 at 9:08 PM, Masahiro Yamada > > mailto:yamad...@jp.panasonic.com>> > > wrote: > > > > Hello, Simon. > > > > > > When compiling the master branch, I got an error while a > > tools/mkimage build. > > > > > > u-boot/lib/rsa/rsa-sign.c:26:25: fatal error: openssl/rsa.h: No > > such file or directory > > > > > > I think this erorr is caused by commit 19c402a. > > > > > > I searched and installed the necessary package and I could resolve > > this error. > > > > $ apt-file search openssl/rsa.h libssl-dev: > > /usr/include/openssl/rsa.h $ sudo apt-get install libssl-dev > > > > > > Let me ask a question. > > > > Going forward do we always need the openssl development package > > for creating mkimage tool? Or is it possible to disable RSA feature > > by some CONFIG option? > > > > > > This is to support verified boot using FIT. Yes it would be > > possible to make it an option. I had it that way for a while, but > > then I worried that it would create two versions of mkimage, one > > of which is incapable of signing images. That means that mkimage > > would need to be built for a board with verified boot enabled in > > order to get full functionality. > > > > Perhaps another way would be to check for the header and (if not > > present), silently build without signing support? > > Hurk, dang it.. Yes, I think we need to build and go with an error > message on attempted use. Skimming the code, we can't rely on > CONFIG_FIT_SIGNATURE being inherited from the config, on the host > side, yes? > Yes I can make this check CONFIG_FIT_SIGNATURE - as mentioned I had it that way originally but worred about creating different versions of mkimage. There is actually code there for this which we can use: #ifdef CONFIG_FIT_SIGNATURE fprintf(stderr, "Signing / verified boot options: [-k keydir] [-K dtb] [ -c ] [-r]\n" " -k => set directory containing private keys\n" " -K => write public keys to this .dtb file\n" " -c => add comment in signature node\n" " -F => re-sign existing FIT image\n" " -r => mark keys used as 'required' in dtb\n"); #else fprintf(stderr, "Signing / verified boot not supported (CONFIG_FIT_SIGNATURE undefined)\n"); #endif Let me know if this is the preferred option and I will prepare a patch. Regards, Simon ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] [PATCH v3 03/12] image: Add RSA support for image signing
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 06/27/2013 02:44 AM, Simon Glass wrote: > Hi Masahiro, > > On Wed, Jun 26, 2013 at 9:08 PM, Masahiro Yamada > mailto:yamad...@jp.panasonic.com>> > wrote: > > Hello, Simon. > > > When compiling the master branch, I got an error while a > tools/mkimage build. > > > u-boot/lib/rsa/rsa-sign.c:26:25: fatal error: openssl/rsa.h: No > such file or directory > > > I think this erorr is caused by commit 19c402a. > > > I searched and installed the necessary package and I could resolve > this error. > > $ apt-file search openssl/rsa.h libssl-dev: > /usr/include/openssl/rsa.h $ sudo apt-get install libssl-dev > > > Let me ask a question. > > Going forward do we always need the openssl development package > for creating mkimage tool? Or is it possible to disable RSA feature > by some CONFIG option? > > > This is to support verified boot using FIT. Yes it would be > possible to make it an option. I had it that way for a while, but > then I worried that it would create two versions of mkimage, one > of which is incapable of signing images. That means that mkimage > would need to be built for a board with verified boot enabled in > order to get full functionality. > > Perhaps another way would be to check for the header and (if not > present), silently build without signing support? Hurk, dang it.. Yes, I think we need to build and go with an error message on attempted use. Skimming the code, we can't rely on CONFIG_FIT_SIGNATURE being inherited from the config, on the host side, yes? - -- Tom -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJRzDUoAAoJENk4IS6UOR1WOF8P/in1joGCy0NcOJ3g3PKRRi5Y eUgwTbOaQ3x82dJ3820YEkxSpaJIxiw+l0cvbWVH9TR6wO/7EiVjNLmFwauhuVBU BAf9ghleHjd3T6utxEzDk0z9O2E9f8aliSQ1d31oK1NrM/IvhW06udv6V0shFRCN i3uD4bkWPgv+qChZ+94ma4rc3SDz393lG2dwn0L9TZ/Kv3qOaoEr1qTDSS2fRXqg 2Yd1vFD3mT9ZEMQwfteoThuXWZfyWFYfh9wsUjwjHonJNauwKkZgWFHnZpYCv6tJ TQEOH7pVpO7RAMFw/7f/tXdk/U2Qnmq/GH0Gy/p9E7UYb4IqXNGrXBOjhEGizH+c gA4bAxjooHoVayUf/m3m6g5WUd1uv6cKhcS5WppmaduPdPncB8wPKxksT/ti1NKi 4yDdFLsudPvO+0R94MT+5dgV4Album8aoICmSgzxRy+3x9lGGxEGHeCleDtwnLTR dQEnmUEweKvwL1MNJZ6TBtqekbf/hKVbgn4EqEi0fb4CLKCVFOGT3YSu8oWDaZEQ q0C08/hn6lNgbGqTQL83I0lahp2HiPjHZMvUVVcE0lzOIowkTLLxvsZLfLhlCdXv LxG26Pi0rG/CU8BnYQ/W00X4HPi20UDOt9nLyINq63ctKLWKMMA3B7IkcpBGbT2U dA8uceK04MStQdxiB3kh =wI1Q -END PGP SIGNATURE- ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] [PATCH v3 03/12] image: Add RSA support for image signing
Hi Masahiro, On Wed, Jun 26, 2013 at 9:08 PM, Masahiro Yamada wrote: > Hello, Simon. > > > When compiling the master branch, > I got an error while a tools/mkimage build. > > > u-boot/lib/rsa/rsa-sign.c:26:25: fatal error: openssl/rsa.h: No such > file or directory > > > I think this erorr is caused by commit 19c402a. > > > I searched and installed the necessary package and > I could resolve this error. > > $ apt-file search openssl/rsa.h > libssl-dev: /usr/include/openssl/rsa.h > $ sudo apt-get install libssl-dev > > > Let me ask a question. > > Going forward do we always need the openssl development package > for creating mkimage tool? > Or is it possible to disable RSA feature by some CONFIG option? > This is to support verified boot using FIT. Yes it would be possible to make it an option. I had it that way for a while, but then I worried that it would create two versions of mkimage, one of which is incapable of signing images. That means that mkimage would need to be built for a board with verified boot enabled in order to get full functionality. Perhaps another way would be to check for the header and (if not present), silently build without signing support? Regards, Simon > > > Best Regards > Masahiro Yamada > > ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
Re: [U-Boot] [PATCH v3 03/12] image: Add RSA support for image signing
Hello, Simon. When compiling the master branch, I got an error while a tools/mkimage build. u-boot/lib/rsa/rsa-sign.c:26:25: fatal error: openssl/rsa.h: No such file or directory I think this erorr is caused by commit 19c402a. I searched and installed the necessary package and I could resolve this error. $ apt-file search openssl/rsa.h libssl-dev: /usr/include/openssl/rsa.h $ sudo apt-get install libssl-dev Let me ask a question. Going forward do we always need the openssl development package for creating mkimage tool? Or is it possible to disable RSA feature by some CONFIG option? Best Regards Masahiro Yamada ___ U-Boot mailing list U-Boot@lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
[U-Boot] [PATCH v3 03/12] image: Add RSA support for image signing
RSA provides a public key encryption facility which is ideal for image
signing and verification.
Images are signed using a private key by mkimage. Then at run-time, the
images are verified using a private key.
This implementation uses openssl for the host part (mkimage). To avoid
bringing large libraries into the U-Boot binary, the RSA public key
is encoded using a simple numeric representation in the device tree.
Signed-off-by: Simon Glass
---
Changes in v3: None
Changes in v2:
- Add sanity checks on key sizes in RSA (improves security)
- Avoid using malloc in RSA routines (for smaller SPL code size)
- Build signing support unconditionally in mkimage
- Fix checkpatch checks about parenthesis alignment
- Fix spelling of multiply in rsa-verify.c
- Only build RSA support into mkimage if CONFIG_RSA is defined
- Support RSA library version without ERR_remove_thread_state()
Makefile | 1 +
README | 10 ++
common/image-sig.c | 7 +
config.mk| 1 +
include/rsa.h| 108
lib/rsa/Makefile | 48 ++
lib/rsa/rsa-sign.c | 460 +++
lib/rsa/rsa-verify.c | 385 ++
tools/Makefile | 13 +-
9 files changed, 1031 insertions(+), 2 deletions(-)
create mode 100644 include/rsa.h
create mode 100644 lib/rsa/Makefile
create mode 100644 lib/rsa/rsa-sign.c
create mode 100644 lib/rsa/rsa-verify.c
diff --git a/Makefile b/Makefile
index eb751f4..90f2bb9 100644
--- a/Makefile
+++ b/Makefile
@@ -247,6 +247,7 @@ OBJS := $(addprefix $(obj),$(OBJS))
HAVE_VENDOR_COMMON_LIB = $(if $(wildcard board/$(VENDOR)/common/Makefile),y,n)
LIBS-y += lib/libgeneric.o
+LIBS-y += lib/rsa/librsa.o
LIBS-y += lib/lzma/liblzma.o
LIBS-y += lib/lzo/liblzo.o
LIBS-y += lib/zlib/libz.o
diff --git a/README b/README
index 3e586c3..f91e431 100644
--- a/README
+++ b/README
@@ -2557,6 +2557,16 @@ CBFS (Coreboot Filesystem) support
Note: There is also a sha1sum command, which should perhaps
be deprecated in favour of 'hash sha1'.
+- Signing support:
+ CONFIG_RSA
+
+ This enables the RSA algorithm used for FIT image verification
+ in U-Boot. See doc/uImage/signature for more information.
+
+ The signing part is build into mkimage regardless of this
+ option.
+
+
- Show boot progress:
CONFIG_SHOW_BOOT_PROGRESS
diff --git a/common/image-sig.c b/common/image-sig.c
index 9b222da..9928bfc 100644
--- a/common/image-sig.c
+++ b/common/image-sig.c
@@ -27,8 +27,15 @@ DECLARE_GLOBAL_DATA_PTR;
#endif /* !USE_HOSTCC*/
#include
#include
+#include
struct image_sig_algo image_sig_algos[] = {
+ {
+ "sha1,rsa2048",
+ rsa_sign,
+ rsa_add_verify_data,
+ rsa_verify,
+ }
};
struct image_sig_algo *image_get_sig_algo(const char *name)
diff --git a/config.mk b/config.mk
index 9003268..a5e26e3 100644
--- a/config.mk
+++ b/config.mk
@@ -96,6 +96,7 @@ HOSTCFLAGS+= $(call os_x_before, 10, 4,
"-traditional-cpp")
HOSTLDFLAGS+= $(call os_x_before, 10, 5, "-multiply_defined suppress")
else
HOSTCC = gcc
+HOSTLIBS += -lssl -lcrypto
endif
ifeq ($(HOSTOS),cygwin)
diff --git a/include/rsa.h b/include/rsa.h
new file mode 100644
index 000..a5dd676
--- /dev/null
+++ b/include/rsa.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2013, Google Inc.
+ *
+ * (C) Copyright 2008 Semihalf
+ *
+ * (C) Copyright 2000-2006
+ * Wolfgang Denk, DENX Software Engineering, w...@denx.de.
+ *
+ * See file CREDITS for list of people who contributed to this
+ * project.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+
+#ifndef _RSA_H
+#define _RSA_H
+
+#include
+#include
+
+#if IMAGE_ENABLE_SIGN
+/**
+ * sign() - calculate and return signature for given input data
+ *
+ * @info: Specifies key and FIT information
+ * @data: Pointer to the input data
+ * @data_len: Data length
+ * @sigp: Set to an allocated buffer holding the signature
+ * @sig_len: Set to length of the calculated hash
+ *
+ * This computes input data signature according to selected algorithm.
+ * Resulting signature value is placed in an allocated buffer, th
