Change in coreboot[master]: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide
Michał Żygowski has uploaded this change for review. ( https://review.coreboot.org/c/coreboot/+/43483 )
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide ......................................................................
Documentation/vendorcode/eltan/security.md: Fix bugs in the guide
ELTAN verified boot seems to be using vboot 2.1 key format not vboot 1.0. Generating vboot 1.0 keys results in public key of incorrect size (according to the verified boot implementation in vendorcode) which results in errors during booting.
Fix the cbfstool extraction command to take account for stage file which may have certain sections removed.
Add note about endianess of digest generated by openssl.
Signed-off-by: Michał Żygowski michal.zygowski@3mdeb.com Change-Id: I27cf8e3f8e22876f671092fe4d3265a98564d996 --- M Documentation/vendorcode/eltan/security.md 1 file changed, 8 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/83/43483/1
diff --git a/Documentation/vendorcode/eltan/security.md b/Documentation/vendorcode/eltan/security.md index 9dd47c0..1c05cd5 100644 --- a/Documentation/vendorcode/eltan/security.md +++ b/Documentation/vendorcode/eltan/security.md @@ -42,7 +42,7 @@ Create private key in RSA2048 format: `openssl genrsa -F4 -out <private_key_file> 2048`
Create public key using private key: -`futility --vb1 create <private_key_file> <public_key_file_without_extension>` +`futility --vb21 create <private_key_file> <public_key_file_without_extension>`
The public key will be included into coreboot and used for verified boot only.
@@ -79,9 +79,15 @@ The total number of items must match `VENDORCODE_ELTAN_OEM_MANIFEST_ITEMS`.
For every part the SHA (SHA-256) must be calculated. First extract the binary from the coreboot -image using: `cbfstool <coreboot_file_name> extract -n <cbfs_name> -f <item_binary_file_name>` +image using: `cbfstool <coreboot_file_name> extract -n <cbfs_name> -f <item_binary_file_name> -m x86 -U` +Note the `-m x86 -U` flags are required for correct extraction of stages. Certain stages are +put in CBFS without certain program sections so extraction process must also remove these sections. + followed by: `openssl dgst -sha256 -binary -out <hash_file_name> <item_binary_file_name>`
+The SHA256 digest will be in big endian so it must be converted to little endian with: +`< <hash_file_name> xxd -p -c1 | tac | xxd -p -r > <hash_file_name_le>` + Replace -sha256 with -sha512 when `VENDORCODE_ELTAN_VBOOT_USE_SHA512` is enabled.
All the hashes must be combined to a hash binary. The hashes need to be placed in the same order as
Paul Menzel has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/43483 )
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide ......................................................................
Patch Set 1:
(6 comments)
https://review.coreboot.org/c/coreboot/+/43483/1//COMMIT_MSG Commit Message:
https://review.coreboot.org/c/coreboot/+/43483/1//COMMIT_MSG@12 PS1, Line 12: during booting *during boot* or *when booting*
https://review.coreboot.org/c/coreboot/+/43483/1//COMMIT_MSG@14 PS1, Line 14: Fix the cbfstool extraction command to take account for stage file … to take the stage file into account, which may …
https://review.coreboot.org/c/coreboot/+/43483/1//COMMIT_MSG@17 PS1, Line 17: openssl OpenSSL
https://review.coreboot.org/c/coreboot/+/43483/1/Documentation/vendorcode/el... File Documentation/vendorcode/eltan/security.md:
https://review.coreboot.org/c/coreboot/+/43483/1/Documentation/vendorcode/el... PS1, Line 83: Note the `-m x86 -U` flags are required for correct extraction of stages. Certain stages are Add a blank line above?
https://review.coreboot.org/c/coreboot/+/43483/1/Documentation/vendorcode/el... PS1, Line 83: Note the
Note, the …
https://review.coreboot.org/c/coreboot/+/43483/1/Documentation/vendorcode/el... PS1, Line 89: < Is this needed?
Hello build bot (Jenkins), Frans Hendriks, Wim Vervoorn,
I'd like you to reexamine a change. Please visit
https://review.coreboot.org/c/coreboot/+/43483
to look at the new patch set (#2).
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide ......................................................................
Documentation/vendorcode/eltan/security.md: Fix bugs in the guide
ELTAN verified boot seems to be using vboot 2.1 key format not vboot 1.0. Generating vboot 1.0 keys results in public key of incorrect size (according to the verified boot implementation in vendorcode) which results in errors when booting.
Fix the cbfstool extraction command to take the stage file into account, which may have certain sections removed.
Add note about endianess of digest generated by OpenSSL.
Signed-off-by: Michał Żygowski michal.zygowski@3mdeb.com Change-Id: I27cf8e3f8e22876f671092fe4d3265a98564d996 --- M Documentation/vendorcode/eltan/security.md 1 file changed, 11 insertions(+), 2 deletions(-)
git pull ssh://review.coreboot.org:29418/coreboot refs/changes/83/43483/2
Michał Żygowski has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/43483 )
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide ......................................................................
Patch Set 2:
(6 comments)
https://review.coreboot.org/c/coreboot/+/43483/1//COMMIT_MSG Commit Message:
https://review.coreboot.org/c/coreboot/+/43483/1//COMMIT_MSG@12 PS1, Line 12: during booting
*during boot* or *when booting*
Done
https://review.coreboot.org/c/coreboot/+/43483/1//COMMIT_MSG@14 PS1, Line 14: Fix the cbfstool extraction command to take account for stage file
… to take the stage file into account, which may …
Done
https://review.coreboot.org/c/coreboot/+/43483/1//COMMIT_MSG@17 PS1, Line 17: openssl
OpenSSL
Done
https://review.coreboot.org/c/coreboot/+/43483/1/Documentation/vendorcode/el... File Documentation/vendorcode/eltan/security.md:
https://review.coreboot.org/c/coreboot/+/43483/1/Documentation/vendorcode/el... PS1, Line 83: Note the
Note, the …
Done
https://review.coreboot.org/c/coreboot/+/43483/1/Documentation/vendorcode/el... PS1, Line 83: Note the `-m x86 -U` flags are required for correct extraction of stages. Certain stages are
Add a blank line above?
Done
https://review.coreboot.org/c/coreboot/+/43483/1/Documentation/vendorcode/el... PS1, Line 89: <
Is this needed?
Yes, it is needed to direct the hash file to stdin. I have changed the order to improve the readability.
Frans Hendriks has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/43483 )
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide ......................................................................
Patch Set 2:
(1 comment)
https://review.coreboot.org/c/coreboot/+/43483/2/Documentation/vendorcode/el... File Documentation/vendorcode/eltan/security.md:
https://review.coreboot.org/c/coreboot/+/43483/2/Documentation/vendorcode/el... PS2, Line 45: `futility --vb21 create <private_key_file> <public_key_file_without_extension>` vb1 is correct parameter. Correct format for VBOOT library is composed in verified_boot_check_manifest()
Michał Żygowski has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/43483 )
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide ......................................................................
Patch Set 2:
(1 comment)
https://review.coreboot.org/c/coreboot/+/43483/2/Documentation/vendorcode/el... File Documentation/vendorcode/eltan/security.md:
https://review.coreboot.org/c/coreboot/+/43483/2/Documentation/vendorcode/el... PS2, Line 45: `futility --vb21 create <private_key_file> <public_key_file_without_extension>`
vb1 is correct parameter. […]
Weird, when created with vb1 parameter, the verified boot complained on incorrect key size. Even when set with Kconfig to correct size, I got complaints on incorrect key format. I could get it working only with vb21 parameter
Frans Hendriks has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/43483 )
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide ......................................................................
Patch Set 2:
(1 comment)
https://review.coreboot.org/c/coreboot/+/43483/2/Documentation/vendorcode/el... File Documentation/vendorcode/eltan/security.md:
https://review.coreboot.org/c/coreboot/+/43483/2/Documentation/vendorcode/el... PS2, Line 45: `futility --vb21 create <private_key_file> <public_key_file_without_extension>`
Weird, when created with vb1 parameter, the verified boot complained on incorrect key size. […]
Is size the generated key 552 bytes? Do you get error message "ERROR: Illegal public key!"
Stefan Reinauer has abandoned this change. ( https://review.coreboot.org/c/coreboot/+/43483?usp=email )
Change subject: Documentation/vendorcode/eltan/security.md: Fix bugs in the guide ......................................................................
Abandoned
-
Frans Hendriks (Code Review) -
Michał Żygowski (Code Review)
-
Paul Menzel (Code Review)
-
Stefan Reinauer (Code Review)