Author: wmb Date: 2009-08-28 23:40:06 +0200 (Fri, 28 Aug 2009) New Revision: 1337
Modified: cpu/x86/pc/olpc/crypto.fth cpu/x86/pc/olpc/security.fth cpu/x86/pc/olpc/versions.fth cpu/x86/pc/olpc/via/versions.fth Log: OLPC trac 9045 - added support for delegated keys - sig02: format.
Modified: cpu/x86/pc/olpc/crypto.fth =================================================================== --- cpu/x86/pc/olpc/crypto.fth 2009-08-28 20:10:46 UTC (rev 1336) +++ cpu/x86/pc/olpc/crypto.fth 2009-08-28 21:40:06 UTC (rev 1337) @@ -19,8 +19,10 @@
: signature-bad? ( data$ sig$ key$ hashname$ -- mismatch? ) $cstr - verify-bss /verify-bss erase ( data$ sig$ key$ 'hashname ) - verify-base verify-stack sp-call >r 3drop 4drop r> ( result ) + verify-bss /verify-bss erase ( 0 data$ sig$ key$ 'hashname ) + verify-base verify-stack sp-call >r ( 0 data$ sig$ key$ 'hashname ) + 3drop 4drop begin 0= until ( ) + r> ( result ) ;
\ This is a hack that saves a lot of memory. The crypto verifier @@ -33,7 +35,7 @@ variable hashlen d# 128 buffer: hashbuf : crypto-hash ( data$ hashname$ -- result$ ) - 2>r hashbuf d# 128 hashlen 0 2r> ( data$ sig$ key$ hashname$ ) + 2>r 0 -rot hashbuf d# 128 hashlen 0 2r> ( 0 data$ sig$ key$ hashname$ ) signature-bad? abort" Hash failed" ( ) hashbuf hashlen @ ;
Modified: cpu/x86/pc/olpc/security.fth =================================================================== --- cpu/x86/pc/olpc/security.fth 2009-08-28 20:10:46 UTC (rev 1336) +++ cpu/x86/pc/olpc/security.fth 2009-08-28 21:40:06 UTC (rev 1337) @@ -196,90 +196,6 @@ sig-buf tuck - false ( sig$ false ) ;
-\ parse-sig parses a "sig01:" format signature string, returning its -\ hashname and signature substrings. It converts the signature -\ substring from ASCII hex to binary bytes. - -: parse-sig ( sig01$ -- true | hashname$ sig$ false ) - dup d# 89 < if 2drop true exit then - bl left-parse-string " sig01:" $= 0= if 2drop true exit then ( rem$ ) - bl left-parse-string dup d# 6 <> if 4drop true exit then 2swap ( hash$ rem$ ) - bl left-parse-string nip d# 64 <> if 4drop true exit then ( hash$ rem$ ) - newline left-parse-string 2swap nip 0<> if 4drop true exit then ( hash$ data$ ) - dup /sig 2* <> if ( ." Bad signature length" cr ) 2drop true exit then ( hash$ data$ ) - - hex-decode if 2drop true else false then -; - -\ zip-extent looks inside a memory-resident ZIP archive and returns -\ the address,length of a given component of that archive. This -\ assumes that the components are "stored", not "deflated". It -\ depends on the existence of a support package named "/lzip" to -\ do the work. - -: zip-extent ( name$ -- adr len ) - expand$ open-dev ?dup 0= if " " exit then - >r - " offset" r@ $call-method load-base + - " size" r@ $call-method drop - r> close-dev -; - -\ sig$ and img$ find the signature and signed-image components of -\ a ZIP bundle image that is already in memory. - -: sig$ ( -- adr len ) " /lzip:\data.sig" zip-extent ; -: img$ ( -- adr len ) " /lzip:\data.img" zip-extent ; - -\ bundle-name$ returns the full OFW pathname of a signed image -\ bundle, piecing it together from the device (DN), path (PN), -\ filename head (CN), and filename body (FN) macros. - -: bundle-name$ ( -- $ ) " ${DN}${PN}${CN}${FN}.zip" expand$ ; - -\ bundle-present? determines the existence (or not) of a signed image -\ bundle whose name is constructed from the current settings of the -\ device (DN), path (PN), filename head (CN), and filename body (FN). - -: .trying ( name$ -- name$ ) - " Trying " ?lease-debug 2dup ?lease-debug-cr -; -: bundle-present? ( fn$ -- flag ) - fn-buf place - bundle-name$ .trying - ['] (boot-read) catch if 2drop false exit then - true -; - -\ hashname remembers the most recently used hashname to guard against -\ attacks based on reuse of the same (presumably compromized) hash. - -\ signature-invalid? checks the validity of data$ against the ASCII signature -\ record sig01$, using the public key that thiskey$ points to. -\ It also verifies that the hashname contained in sig01$ is the -\ expected one. - -: signature-invalid? ( data$ sig01$ exp-hashname$ -- error? ) - 2>r - parse-sig if - ." Bad signature format" cr - 2r> 2drop true exit - then ( data$ hashname$ sig$ r: exp$ ) - - \ Check for duplicate hashname attacks - 2swap 2dup 2r> $= 0= if ( data$ sig$ hashname$ ) - ." Wrong hash name" cr - 4drop 2drop true exit - then ( data$ sig$ hashname$ ) - - thiskey$ 2swap signature-bad? ( error? ) - dup if - " Signature invalid" ?lease-error-cr - else - " Signature valid" ?lease-debug-cr - then -; - \ cut$ splits a string into an initial substring of length n \ (head$) and the residual substring (tail$). If the input \ string is shorter than n, head$ is the input string and tail$ is @@ -291,12 +207,23 @@ over r@ - r> ( tail$ head$ ) ;
-: sig01$>key$ ( sig01$ -- true | binary-key$ false ) - bl left-parse-string " sig01:" $= 0= if 2drop true exit then ( rem$ ) - bl left-parse-string 2drop \ Discard hash name ( rem$ ) - bl left-parse-string 2nip \ Get key signature ( key$ ) - /sig 2* min hex-decode if 2drop true exit then ( binary-key$ ) - false +: sig$>key$ ( sig0N$ -- true | binary-key$ false ) + bl left-parse-string ( rem$ signame$ ) + 2dup " sig01:" $= if ( rem$ signame$ ) + 2drop ( rem$ ) + else ( rem$ signame$ ) + " sig02:" $= 0= if ( rem$ ) + 2drop true ( true ) + exit + then ( rem$ ) + then ( rem$ ) + bl left-parse-string 2drop ( rem$ ) \ Discard hash name + bl left-parse-string 2nip ( key$ ) \ Get key signature + /sig 2* min hex-decode if ( key$ ) + 2drop true ( true ) + exit + then ( binary-key$ ) + false ( binary-key$ false ) ;
\ True if short$ matches the end of long$ @@ -316,19 +243,14 @@ 2r> 4drop false ;
-: in-pubkey-list? ( sig01$ -- flag ) - sig01$>key$ if false exit then ( key$ ) - key-in-list? ( flag ) +: in-pubkey-list? ( sig0N$ -- flag ) + sig$>key$ if false exit then ( key$ ) + key-in-list? ( flag ) ;
-: our-pubkey? ( sig01$ -- flag ) - sig01$>key$ if false exit then ( key$ ) - thiskey$ tail$= ( flag ) -; - -\ Look for a line that starts with "sig01: " whose key signature +\ Look for a line that starts with "sig0N: " whose key signature \ matches the trailing bytes of a public key in our current list. -: next-sig01-in-list$ ( sig$ -- true | rem$ sig01$ false ) +: next-sig-in-list$ ( sig$ -- true | rem$ sig0N$ false ) begin dup while ( rem$ ) newline left-parse-string ( rem$' line$ ) 2dup in-pubkey-list? if false exit then ( rem$ line$ ) @@ -338,36 +260,27 @@ 2drop true ;
-\ Look for a line that starts with "sig01: " whose key signature +\ Look for a line that starts with "sig0N: " whose key signature \ matches the trailing bytes of our currently-selected public key. -: next-sig01$ ( sig$ -- true | rem$ sig01$ false ) - begin dup while ( rem$ ) - newline left-parse-string ( rem$' line$ ) - 2dup our-pubkey? if false exit then ( rem$ line$ ) - 2drop ( rem$ ) - repeat ( rem$ ) +\ This differs from next-sig-in-list$ in that next-sig-in-list$ +\ looks for a signature that matches any public key in our list, +\ whereas this looks for a second signature that matches the public +\ key that next-sig-in-list$ already found. +: next-sig$ ( sig$ -- true | rem$ sig0N$ false ) + begin dup while ( rem$ ) + newline left-parse-string ( rem$' line$ ) + 2dup sig$>key$ 0= if ( rem$ line$ binary-key$ ) + thiskey$ tail$= if ( rem$ line$ ) + false ( rem$ sig0N$ false ) + exit + then ( rem$ line$ ) + then ( rem$ line$ ) + 2drop ( rem$ ) + repeat ( rem$ ) " No signature for our key" ?lease-error-cr 2drop true ;
-\ Find a sig01: line and check its sha256/rsa signature -: sha-valid? ( data$ sig01$ -- okay? ) - next-sig01-in-list$ if 2drop false exit then ( data$ rem$ sig01$ ) - 2nip " sha256" signature-invalid? 0= -; - -\ Find two sig01: lines, the first with sha256 and the second with rmd160, -\ and check their signatures -: fw-valid? ( data$ sig$ -- okay? ) - 2swap 2>r ( sig$ r: data$ ) - next-sig01-in-list$ if 2r> 2drop false exit then ( rem$ sig01$ ) - 2r@ 2swap sha-valid? 0= if ( rem$ r: data$ ) - 2r> 4drop false exit - then ( rmd-sig$ r: data$ ) - next-sig01$ if 2r> 2drop false exit then ( rem$ sig01$ ) - 2nip 2r> 2swap " rmd160" signature-invalid? 0= -; - \ numfield is a factor used for parsing 2-digit fields from date/time strings. : numfield ( exp$ min max -- exp$' ) >r >r ( exp$ r: max min ) @@ -409,7 +322,7 @@
\ earliest is the earliest acceptable date value (in seconds). \ It is the date that the first test version of this code was - \ deployed. If a laptop has any earlier date that than, that + \ deployed. If a laptop has any earlier date, the \ date is presumed bogus.
current-seconds [ " 20070101T000000Z" expiration-to-seconds drop ] literal - 0< @@ -420,6 +333,9 @@ \ earlier than this machine's current time (from the real time clock).
: expired? ( expiration$ -- bad? ) + \ Check for non-expiring case + 2dup " 00000000T000000Z" $= if 2drop false exit then + expiration-to-seconds if true exit then ( seconds )
\ If the date is bad, leases are deemed to have expired @@ -428,9 +344,6 @@ current-seconds - 0< ;
-d# 1024 constant /sec-line-max -/sec-line-max buffer: sec-line-buf - \ machine-id-buf is a buffer into which the machine signature string, \ including serial number, UUID, and expiration time, is place. \ That string is the signed object for lease and developer key verification. @@ -478,10 +391,259 @@ : my-sn$ ( -- adr len ) machine-id-buf d# 11 ;
+\ parse-sig parses a "sig01:" format signature string, returning its +\ hashname and signature substrings. It converts the signature +\ substring from ASCII hex to binary bytes. + +: parse-sig ( sig01$ -- true | hashname$ sig$ false ) + dup d# 89 < if 2drop true exit then + bl left-parse-string " sig01:" $= 0= if 2drop true exit then ( rem$ ) + bl left-parse-string dup d# 6 <> if 4drop true exit then 2swap ( hash$ rem$ ) + bl left-parse-string nip d# 64 <> if 4drop true exit then ( hash$ rem$ ) + newline left-parse-string 2swap nip 0<> if 4drop true exit then ( hash$ data$ ) + dup /sig 2* <> if ( ." Bad signature length" cr ) 2drop true exit then ( hash$ data$ ) + + hex-decode if 2drop true else false then +; + +\ zip-extent looks inside a memory-resident ZIP archive and returns +\ the address,length of a given component of that archive. This +\ assumes that the components are "stored", not "deflated". It +\ depends on the existence of a support package named "/lzip" to +\ do the work. + +: zip-extent ( name$ -- adr len ) + expand$ open-dev ?dup 0= if " " exit then + >r + " offset" r@ $call-method load-base + + " size" r@ $call-method drop + r> close-dev +; + +\ sig$ and img$ find the signature and signed-image components of +\ a ZIP bundle image that is already in memory. + +: sig$ ( -- adr len ) " /lzip:\data.sig" zip-extent ; +: img$ ( -- adr len ) " /lzip:\data.img" zip-extent ; + +\ bundle-name$ returns the full OFW pathname of a signed image +\ bundle, piecing it together from the device (DN), path (PN), +\ filename head (CN), and filename body (FN) macros. + +: bundle-name$ ( -- $ ) " ${DN}${PN}${CN}${FN}.zip" expand$ ; + +\ bundle-present? determines the existence (or not) of a signed image +\ bundle whose name is constructed from the current settings of the +\ device (DN), path (PN), filename head (CN), and filename body (FN). + +: .trying ( name$ -- name$ ) + " Trying " ?lease-debug 2dup ?lease-debug-cr +; +: bundle-present? ( fn$ -- flag ) + fn-buf place + bundle-name$ .trying + ['] (boot-read) catch if 2drop false exit then + true +; + +\ hashname remembers the most recently used hashname to guard against +\ attacks based on reuse of the same (presumably compromized) hash. + +0 [if] +\ signature-invalid? checks the validity of data$ against the ASCII signature +\ record sig0N$, using the public key that thiskey$ points to. +\ It also verifies that the hashname contained in sig01$ is the +\ expected one. + +: signature-invalid? ( data$ sig0N$ exp-hashname$ -- error? ) + 2>r + parse-sig if + ." Bad signature format" cr + 2r> 2drop true exit + then ( data$ hashname$ sig$ r: exp$ ) + + \ Check for duplicate hashname attacks + 2swap 2dup 2r> $= 0= if ( data$ sig$ hashname$ ) + ." Wrong hash name" cr + 4drop 2drop true exit + then ( data$ sig$ hashname$ ) + + 2>r 2>r 2>r 0 2r> 2r> 2r> ( 0 data$ sig$ hashname$ ) + pubkey$ 2swap signature-bad? ( error? ) + dup if + " Signature invalid" ?lease-error-cr + else + " Signature valid" ?lease-debug-cr + then +; +[then] + +0 0 2value exp-hashname$ +0 0 2value signed-data$ + +\ sig01: hashname keyid signature +: sig01-good? ( line$ -- good? ) + \ Check that the hashname is as expected + bl left-parse-string ( line$ this-hashname$ ) + exp-hashname$ $= 0= if ( line$ ) + 2drop false exit + then ( line$' ) + + \ Check that the keyid matches our pubkey + bl left-parse-string ( line$' keyid$ ) + /sig 2* min hex-decode if ( line$ ) + 2drop false exit + then ( line$ binary-key$ ) + + key-in-list? 0= if ( line$ ) + 2drop false exit + then ( line$ ) + + \ Check that the signature occupies the rest of the line + bl left-parse-string ( line$' sig$ ) + 2swap nip 0<> if ( sig$ ) + \ Trailing junk at the end + 2drop false exit + then ( sig$ ) + + dup /sig 2* <> if ( sig$ ) + 2drop false exit + then ( sig$ ) + + hex-decode if ( ) + false exit + then ( binary-sig$ ) + + \ Cryptographically verify the data against the signature + 2>r 0 signed-data$ 2r> thiskey$ exp-hashname$ signature-bad? 0= +; + +h# 10e constant /key +/key buffer: keybuf + +0 0 2value sig02-key$ + +0 0 2value expiry$ + +: sig02-good? ( line$ -- good? ) + d# 100 0 do + \ Check that the hashname is as expected + bl left-parse-string ( line$' this-hashname$ ) + exp-hashname$ $= 0= if ( line$ ) + 2drop false unloop exit + then ( line$' ) + + \ Check that the keyid matches our pubkey, but only if it's + \ the first one + bl left-parse-string ( line$' pubkey$ ) + hex-decode if ( line$ ) + 2drop false unloop exit + then ( line$ binary-key$ ) + + i if ( line$ binary-key$ ) + dup /key <> if ( line$ binary-key$ ) + 4drop false unloop exit + then ( line$ binary-key$ ) + tuck keybuf swap move ( line$ binary-keylen ) + keybuf swap ( line$ binary-key$' ) + else ( line$ binary-keyid$ ) + key-in-list? 0= if ( line$ ) + 2drop false unloop exit + then ( line$ ) + thiskey$ ( line$ key$ ) + then ( line$ key$ ) + to sig02-key$ ( line$ ) + + \ Check the expiration date + bl left-parse-string to expiry$ ( line$' ) + expiry$ expired? if ( line$ ) + 2drop false unloop exit + then ( line$ ) + + \ Get the signature + bl left-parse-string ( line$ sig$) + + dup /sig 2* <> if ( line$ sig$ ) + 4drop false unloop exit + then ( line sig$ ) + + hex-decode if ( line$ ) + 2drop false unloop exit + then ( line$ binary-sig$ ) + + 2>r ( line$' r: binary-sig$ ) + + \ If it's the final signature, check the signed data + dup 0= if ( line$ r: sig$ ) + 2drop ( r: sig$ ) + 0 signed-data$ " :" expiry$ " :" my-sn$ 2r> ( 0 data$ .. sig$ ) + sig02-key$ exp-hashname$ signature-bad? 0= ( good? ) + unloop exit + then ( line$ r: sig$ ) + + \ Otherwise check the next key in the list + 2dup bl left-parse-string 2drop ( line$ line$' r: sig$ ) \ Discard the hashname + bl left-parse-string 2nip 2>r ( line$ r: sig$ key$ ) + + 0 " "n" 2r> " :key01: " expiry$ " :" my-sn$ 2r> ( 0 data$ .. sig$ ) + sig02-key$ exp-hashname$ signature-bad? if ( line$ ) + 2drop false unloop exit + then ( line$ ) + loop + true abort" Delegation too long" +; + +: this-sig-line-good? ( line$ -- good? ) + bl left-parse-string ( line$' tag$ ) + 2dup " sig01:" $= if ( line$' tag$ ) + 2drop sig01-good? ( good? ) + exit + then ( line$' ) + 2dup " sig02:" $= if ( line$' tag$ ) + 2drop sig02-good? ( good? ) + exit + then ( line$' tag$ ) + 4drop false ( good? ) +; + +: signature-good? ( data$ sig$ hashname$ -- good? ) + to exp-hashname$ ( data$ sig$ ) + 2swap to signed-data$ ( sig$ ) + begin dup while ( rem$ ) + newline left-parse-string ( rem$' line$ ) + + this-sig-line-good? if ( rem$ ) + 2drop true exit + then ( rem$ ) + + repeat ( rem$ ) + 2drop false ( good? ) +; + +\ Find a sig0N: line and check its sha256/rsa signature +: sha-valid? ( data$ sig01$ -- okay? ) + next-sig-in-list$ if 2drop false exit then ( data$ rem$ sig01$ ) + \ 2nip " sha256" signature-invalid? 0= + 2nip " sha256" signature-good? +; + +\ Find two sig0N: lines, the first with sha256 and the second with rmd160, +\ and check their signatures +: fw-valid? ( data$ sig$ -- okay? ) + 2swap 2>r ( sig$ r: data$ ) + next-sig-in-list$ if 2r> 2drop false exit then ( rem$ sig01$ ) + 2r@ 2swap sha-valid? 0= if ( rem$ r: data$ ) + 2r> 4drop false exit + then ( rmd-sig$ r: data$ ) + next-sig$ if 2r> 2drop false exit then ( rem$ sig01$ ) +\ 2nip 2r> 2swap " rmd160" signature-invalid? 0= + 2nip 2r> 2swap " rmd160" signature-good? +; + +d# 1024 constant /sec-line-max +/sec-line-max buffer: sec-line-buf + : check-expiry ( exp$ -- exp$ -1|0 ) - \ Check for non-expiring case - 2dup " 00000000T000000Z" $= if 0 exit then - dup d# 16 <> if ( expiration$ ) " has bad expiration format" ?lease-error-cr -1 exit @@ -504,7 +666,8 @@ 2over in-pubkey-list? if ( sig$ exp$ ) machine-id-buf d# 51 + swap move ( sig$ ) machine-id-buf d# 67 2swap ( id$ sig$ ) - " sha256" signature-invalid? if -1 else 1 then ( -1|1 ) + \ " sha256" signature-invalid? if -1 else 1 then ( -1|1 ) + " sha256" signature-good? if 1 else -1 then ( -1|1 ) else ( sig$ exp$ ) 4drop 0 ( 0 ) then ( -1|0|1 )
Modified: cpu/x86/pc/olpc/versions.fth =================================================================== --- cpu/x86/pc/olpc/versions.fth 2009-08-28 20:10:46 UTC (rev 1336) +++ cpu/x86/pc/olpc/versions.fth 2009-08-28 21:40:06 UTC (rev 1337) @@ -19,7 +19,7 @@ macro: WLAN_VERSION 5.110.22.p23
\ The bios_verify image -macro: CRYPTO_VERSION 0.2 +macro: CRYPTO_VERSION 0.4
\ The multicast NAND updater code version \ Use a specific git commit ID for a formal release or "test" for development.
Modified: cpu/x86/pc/olpc/via/versions.fth =================================================================== --- cpu/x86/pc/olpc/via/versions.fth 2009-08-28 20:10:46 UTC (rev 1336) +++ cpu/x86/pc/olpc/via/versions.fth 2009-08-28 21:40:06 UTC (rev 1337) @@ -2,7 +2,7 @@
\ The overall firmware revision macro: FW_MAJOR A -macro: FW_MINOR 10 +macro: FW_MINOR 10a
\ The EC microcode macro: EC_VERSION 1_9_9 @@ -23,7 +23,7 @@ \ macro: GET_WLAN cp "/c/Documents and Settings/Mitch Bradley/My Documents/OLPC/DiskImages/sd8686-9.70.7.p0.bin" sd8686.bin; cp "/c/Documents and Settings/Mitch Bradley/My Documents/OLPC/DiskImages/sd8686_helper.bin" sd8686_helper.bin
\ The bios_verify image -macro: CRYPTO_VERSION 0.2 +macro: CRYPTO_VERSION 0.4
\ The multicast NAND updater code version \ Use a specific git commit ID for a formal release or "test" for development.