From: Tom Rini <trini@konsulko.com>
To: u-boot@lists.denx.de
Subject: [U-Boot] [PATCH v4 1/6] lib: rsa: decouple rsa from FIT image verification
Date: Fri, 6 Dec 2019 19:25:47 -0500 [thread overview]
Message-ID: <20191207002547.GA3484@bill-the-cat> (raw)
In-Reply-To: <20191121001121.21854-2-takahiro.akashi@linaro.org>
On Thu, Nov 21, 2019 at 09:11:16AM +0900, AKASHI Takahiro wrote:
> Introduce new configuration, CONFIG_RSA_VERIFY which will decouple building
> RSA functions from FIT verification and allow for adding a RSA-based
> signature verification for other file formats, in particular PE file
> for UEFI secure boot.
>
> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
> Reviewed-by: Simon Glass <sjg@chromium.org>
> ---
> Kconfig | 1 +
> common/Makefile | 3 +-
> common/image-fit-sig.c | 417 +++++++++++++++++++++++++++++++++++++++++
> common/image-fit.c | 6 +-
> common/image-sig.c | 396 --------------------------------------
> include/image.h | 13 +-
> lib/rsa/Kconfig | 12 ++
> lib/rsa/Makefile | 2 +-
> lib/rsa/rsa-verify.c | 78 +++++---
> tools/Makefile | 2 +-
> 10 files changed, 493 insertions(+), 437 deletions(-)
> create mode 100644 common/image-fit-sig.c
OK, the way this works today we see things like:
T1042RDB_PI_NAND_SECURE_BOOT: all +706 data +88 rodata +58 spl/u-boot-spl:all +704 spl/u-boot-spl:data +144 spl/u-boot-spl:text +560 text +560
u-boot: add: 8/0, grow: 0/0 bytes: 584/0 (584)
function old new delta
hash_calculate - 192 +192
padding_pkcs_15_verify - 184 +184
rsa_verify - 104 +104
crypto_algos - 40 +40
checksum_algos - 40 +40
rsa_sign - 8 +8
rsa_add_verify_data - 8 +8
padding_algos - 8 +8
spl-u-boot-spl: add: 10/0, grow: 0/0 bytes: 618/0 (618)
function old new delta
hash_calculate - 192 +192
padding_pkcs_15_verify - 184 +184
rsa_verify - 104 +104
crypto_algos - 40 +40
checksum_algos - 40 +40
sha256_der_prefix - 19 +19
sha1_der_prefix - 15 +15
rsa_sign - 8 +8
rsa_add_verify_data - 8 +8
padding_algos - 8 +8
Which seems wrong, we should be making any changes here opt-in, yes? Thanks!
--
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20191206/0ec13c61/attachment.sig>
next prev parent reply other threads:[~2019-12-07 0:25 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-21 0:11 [U-Boot] [PATCH v4 0/6] rsa: extend rsa_verify() for UEFI secure boot AKASHI Takahiro
2019-11-21 0:11 ` [U-Boot] [PATCH v4 1/6] lib: rsa: decouple rsa from FIT image verification AKASHI Takahiro
2019-12-07 0:25 ` Tom Rini [this message]
2019-12-12 10:10 ` AKASHI Takahiro
2019-11-21 0:11 ` [U-Boot] [PATCH v4 2/6] rsa: add CONFIG_RSA_VERIFY_WITH_PKEY config AKASHI Takahiro
2020-01-08 12:35 ` Heinrich Schuchardt
2020-01-14 7:45 ` AKASHI Takahiro
2020-01-14 11:43 ` Heinrich Schuchardt
2020-01-17 2:24 ` AKASHI Takahiro
2020-01-17 5:59 ` Heinrich Schuchardt
2020-01-21 4:29 ` AKASHI Takahiro
2020-01-21 15:34 ` Tom Rini
2019-11-21 0:11 ` [U-Boot] [PATCH v4 3/6] include: image.h: add key info to image_sign_info AKASHI Takahiro
2019-11-21 0:11 ` [U-Boot] [PATCH v4 4/6] lib: rsa: generate additional parameters for public key AKASHI Takahiro
2020-01-08 18:07 ` Heinrich Schuchardt
2020-01-08 18:16 ` Heinrich Schuchardt
2020-01-14 7:15 ` AKASHI Takahiro
2019-11-21 0:11 ` [U-Boot] [PATCH v4 5/6] lib: rsa: add rsa_verify_with_pkey() AKASHI Takahiro
2019-11-21 0:11 ` [U-Boot] [PATCH v4 6/6] test: add rsa_verify() unit test AKASHI Takahiro
2020-01-08 17:43 ` Heinrich Schuchardt
2020-01-08 22:25 ` Heinrich Schuchardt
2020-01-14 7:33 ` AKASHI Takahiro
2020-01-14 12:04 ` Heinrich Schuchardt
2020-01-17 1:53 ` AKASHI Takahiro
2020-01-17 5:26 ` Heinrich Schuchardt
2020-01-21 5:48 ` AKASHI Takahiro
2020-01-21 15:40 ` Tom Rini
2020-01-22 0:22 ` AKASHI Takahiro
2020-01-22 0:26 ` Tom Rini
2020-01-18 20:20 ` [PATCH v4 0/6] rsa: extend rsa_verify() for UEFI secure boot Heinrich Schuchardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191207002547.GA3484@bill-the-cat \
--to=trini@konsulko.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox