[U-Boot-Users] What methods of software authentication does U-Boot support?

[U-Boot-Users] What methods of software authentication does U-Boot support?

[Ken.Fuchs at bench.com]

Goal:

U-Boot will run only software that has been
authenticated to be from the system's producer.  

--- A Potential Authentication Method ---

The producer of the system generates a cryptographic
[private-key, public-key] pair, storing the public-key
on the same media as U-Boot (i.e. NOR flash; perhaps
as a read-only environment variable) on all systems
and keeping the private-key hidden at a secure site.
A hash of the software is generated, encrypted
with the private key and shipped with the software.

U-Boot reads the private-key encrypted hash and decodes
it with its public-key.  U-Boot loads the software and
generates the hash.  If both hashes match, the software
is authenticated and U-Boot executes the authenticated
software.

--- Comment ---

U-Boot obviously supports loading and verification of
the generated hash, but I haven't been able to locate
public-key cryptographic or other authentication support
in U-Boot.  Perhaps, it is available as a loadable
(stand-alone) module?

Any comments or suggestions?

Sincerely,

Ken Fuchs

[U-Boot-Users] What methods of software authentication does U-Boot support?

[Kim Phillips]

On Fri, 18 Apr 2008 12:01:38 -0500
<Ken.Fuchs@bench.com> wrote:

> Goal:
> 
> U-Boot will run only software that has been
> authenticated to be from the system's producer.  
> 
> --- A Potential Authentication Method ---
> 
> The producer of the system generates a cryptographic
> [private-key, public-key] pair, storing the public-key
> on the same media as U-Boot (i.e. NOR flash; perhaps
> as a read-only environment variable) on all systems
> and keeping the private-key hidden at a secure site.
> A hash of the software is generated, encrypted
> with the private key and shipped with the software.
> 
> U-Boot reads the private-key encrypted hash and decodes
> it with its public-key.  U-Boot loads the software and
> generates the hash.  If both hashes match, the software
> is authenticated and U-Boot executes the authenticated
> software.
> 
> --- Comment ---
> 
> U-Boot obviously supports loading and verification of
> the generated hash, but I haven't been able to locate
> public-key cryptographic or other authentication support
> in U-Boot.  Perhaps, it is available as a loadable
> (stand-alone) module?
> 
> Any comments or suggestions?
> 
this patch taps into openssl:

http://thread.gmane.org/gmane.comp.boot-loaders.u-boot/23977

or you might want to reuse some of linux' crypto library code.

Kim

[U-Boot-Users] What methods of software authentication does U-Boot support?

[Wolfgang Denk]

In message <20080418163211.d5a1ee64.kim.phillips@freescale.com> you wrote:
>
> > U-Boot will run only software that has been
> > authenticated to be from the system's producer.  

Seems it's time to start a discussion to switch to GPL v3...


> > Any comments or suggestions?
> > 
> this patch taps into openssl:

Be careful. Linking against openssl is not possible because the
openssl licence is not compatible with GPL; see for example
http://www.gnome.org/~markmc/openssl-and-the-gpl.html

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
Your own mileage may vary.

[U-Boot-Users] What methods of software authentication does U-Boot support?

[Kenneth Johansson]

On Mon, 2008-04-21 at 01:32 +0200, Wolfgang Denk wrote:
> In message <20080418163211.d5a1ee64.kim.phillips@freescale.com> you wrote:
> >
> > > U-Boot will run only software that has been
> > > authenticated to be from the system's producer.  
> 
> Seems it's time to start a discussion to switch to GPL v3...
> 
> 
> > > Any comments or suggestions?
> > > 
> > this patch taps into openssl:
> 
> Be careful. Linking against openssl is not possible because the
> openssl licence is not compatible with GPL; see for example
> http://www.gnome.org/~markmc/openssl-and-the-gpl.html
> 
> Best regards,
> 
> Wolfgang Denk
> 

For a u-boot friendly version of RSA look at
http://xyssl.org/code/source/rsa/

I have not used it as the client put the secure(authenticated) image
thing on hold but it was the best I could find in the limited time I put
into it.