From 646257d1f4004855d486024527a4784bf57c4c4d Mon Sep 17 00:00:00 2001 From: Heiko Schocher Date: Mon, 3 Mar 2014 12:19:26 +0100 Subject: rsa: add sha256-rsa2048 algorithm based on patch from andreas@oetken.name: http://patchwork.ozlabs.org/patch/294318/ commit message: I currently need support for rsa-sha256 signatures in u-boot and found out that the code for signatures is not very generic. Thus adding of different hash-algorithms for rsa-signatures is not easy to do without copy-pasting the rsa-code. I attached a patch for how I think it could be better and included support for rsa-sha256. This is a fast first shot. aditionally work: - removed checkpatch warnings - removed compiler warnings - rebased against current head Signed-off-by: Heiko Schocher Cc: andreas@oetken.name Cc: Simon Glass --- test/vboot/vboot_test.sh | 66 ++++++++++++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 28 deletions(-) (limited to 'test/vboot/vboot_test.sh') diff --git a/test/vboot/vboot_test.sh b/test/vboot/vboot_test.sh index bb2c605..3e2856e 100755 --- a/test/vboot/vboot_test.sh +++ b/test/vboot/vboot_test.sh @@ -61,47 +61,57 @@ openssl req -batch -new -x509 -key ${keys}/dev.key -out ${keys}/dev.crt pushd ${dir} >/dev/null -# Compile our device tree files for kernel and U-Boot (CONFIG_OF_CONTROL) -dtc -p 0x1000 sandbox-kernel.dts -O dtb -o sandbox-kernel.dtb -dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb +function do_test { + echo do $sha test + # Compile our device tree files for kernel and U-Boot + dtc -p 0x1000 sandbox-kernel.dts -O dtb -o sandbox-kernel.dtb + dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb -# Create a number kernel image with zeroes -head -c 5000 /dev/zero >test-kernel.bin + # Create a number kernel image with zeroes + head -c 5000 /dev/zero >test-kernel.bin -# Build the FIT, but don't sign anything yet -echo Build FIT with signed images -${mkimage} -D "${dtc}" -f sign-images.its test.fit >${tmp} + # Build the FIT, but don't sign anything yet + echo Build FIT with signed images + ${mkimage} -D "${dtc}" -f sign-images-$sha.its test.fit >${tmp} -run_uboot "unsigned signatures:" "dev-" + run_uboot "unsigned signatures:" "dev-" -# Sign images with our dev keys -echo Sign images -${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb -r test.fit >${tmp} + # Sign images with our dev keys + echo Sign images + ${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb \ + -r test.fit >${tmp} -run_uboot "signed images" "dev+" + run_uboot "signed images" "dev+" -# Create a fresh .dtb without the public keys -dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb + # Create a fresh .dtb without the public keys + dtc -p 0x1000 sandbox-u-boot.dts -O dtb -o sandbox-u-boot.dtb -echo Build FIT with signed configuration -${mkimage} -D "${dtc}" -f sign-configs.its test.fit >${tmp} + echo Build FIT with signed configuration + ${mkimage} -D "${dtc}" -f sign-configs-$sha.its test.fit >${tmp} -run_uboot "unsigned config" "sha1+ OK" + run_uboot "unsigned config" $sha"+ OK" -# Sign images with our dev keys -echo Sign images -${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb -r test.fit >${tmp} + # Sign images with our dev keys + echo Sign images + ${mkimage} -D "${dtc}" -F -k dev-keys -K sandbox-u-boot.dtb \ + -r test.fit >${tmp} -run_uboot "signed config" "dev+" + run_uboot "signed config" "dev+" -# Increment the first byte of the signature, which should cause failure -sig=$(fdtget -t bx test.fit /configurations/conf@1/signature@1 value) -newbyte=$(printf %x $((0x${sig:0:2} + 1))) -sig="${newbyte} ${sig:2}" -fdtput -t bx test.fit /configurations/conf@1/signature@1 value ${sig} + # Increment the first byte of the signature, which should cause failure + sig=$(fdtget -t bx test.fit /configurations/conf@1/signature@1 value) + newbyte=$(printf %x $((0x${sig:0:2} + 1))) + sig="${newbyte} ${sig:2}" + fdtput -t bx test.fit /configurations/conf@1/signature@1 value ${sig} -run_uboot "signed config with bad hash" "Bad Data Hash" + run_uboot "signed config with bad hash" "Bad Data Hash" +} + +sha=sha1 +do_test +sha=sha256 +do_test popd >/dev/null -- cgit v1.1 From 29a23f9d6c533f8371be3ae0268c4c75866291b2 Mon Sep 17 00:00:00 2001 From: Heiko Schocher Date: Mon, 3 Mar 2014 12:19:30 +0100 Subject: tools, fit_check_sign: verify a signed fit image add host tool "fit_check_sign" which verifies, if a fit image is signed correct. Signed-off-by: Heiko Schocher Cc: Simon Glass --- test/vboot/vboot_test.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'test/vboot/vboot_test.sh') diff --git a/test/vboot/vboot_test.sh b/test/vboot/vboot_test.sh index 3e2856e..3c6efa7 100755 --- a/test/vboot/vboot_test.sh +++ b/test/vboot/vboot_test.sh @@ -47,6 +47,7 @@ O=$(readlink -f ${O}) dtc="-I dts -O dtb -p 2000" uboot="${O}/u-boot" mkimage="${O}/tools/mkimage" +fit_check_sign="${O}/tools/fit_check_sign" keys="${dir}/dev-keys" echo ${mkimage} -D "${dtc}" @@ -99,6 +100,25 @@ function do_test { run_uboot "signed config" "dev+" + echo check signed config on the host + if ! ${fit_check_sign} -f test.fit -k sandbox-u-boot.dtb >${tmp}; then + echo + echo "Verified boot key check on host failed, output follows:" + cat ${tmp} + false + else + if ! grep -q "dev+" ${tmp}; then + echo + echo "Verified boot key check failed, output follows:" + cat ${tmp} + false + else + echo "OK" + fi + fi + + run_uboot "signed config" "dev+" + # Increment the first byte of the signature, which should cause failure sig=$(fdtget -t bx test.fit /configurations/conf@1/signature@1 value) newbyte=$(printf %x $((0x${sig:0:2} + 1))) -- cgit v1.1