From: Tom Rini <trini@konsulko.com>
To: u-boot@lists.denx.de
Subject: [PATCH v6 0/7] rsa: extend rsa_verify() for UEFI secure boot
Date: Fri, 14 Feb 2020 07:29:37 -0500 [thread overview]
Message-ID: <20200214122937.GA27143@bill-the-cat> (raw)
In-Reply-To: <20200127102740.26831-1-takahiro.akashi@linaro.org>
On Mon, Jan 27, 2020 at 07:27:33PM +0900, AKASHI Takahiro wrote:
> # This patch set is a prerequisite for UEFI secure boot.
>
> The current rsa_verify() requires five parameters for a RSA public key
> for efficiency while RSA, in theory, requires only two. In addition,
> those parameters are expected to come from FIT image.
>
> So this function won't fit very well when we want to use it for the purpose
> of implementing UEFI secure boot, in particular, image authentication
> as well as variable authentication, where the essential two parameters
> are set to be retrieved from one of X509 certificates in signature
> database.
>
> So, in this patch, additional three parameters will be calculated
> on the fly when rsa_verify() is called without fdt which should contain
> parameters above.
>
> This calculation heavily relies on "big-number (or multi-precision)
> library." Therefore some routines from BearSSL[1] under MIT license are
> imported in this implementation. See Patch#4.
> # Please let me know if this is not appropriate.
>
> Prerequisite:
> * public key parser in my "import x509/pkcs7 parser" patch[2]
>
> # Checkpatch will complain with lots of warnings/errors, but
> # I intentionally don't fix them for maximum maintainability.
>
> [1] https://bearssl.org/
> [2] https://lists.denx.de/pipermail/u-boot/2019-November/390127.html
At this point it needs to be rebased again. There's a ton of failures
in https://gitlab.denx.de/u-boot/u-boot/pipelines/2198 which is after I
did
https://gitlab.denx.de/u-boot/u-boot/commit/7db0379f85995d8c7673db7b04eb36d96546c9c8
and I'll put a proper commit message on that later today and post it and
CC relevant parties. It's otherwise looking good. I do want to confirm
that on boards like minnowmax the slight growth in fit_image_check_sig
is expected. It's only 6 bytes so it probably is and we get a larger
reduction in rsa_verify all-around.
Thanks!
--
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20200214/50c7bc32/attachment.sig>
next prev parent reply other threads:[~2020-02-14 12:29 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-27 10:27 [PATCH v6 0/7] rsa: extend rsa_verify() for UEFI secure boot AKASHI Takahiro
2020-01-27 10:27 ` [PATCH v6 1/7] lib: rsa: decouple rsa from FIT image verification AKASHI Takahiro
2020-01-27 10:27 ` [PATCH v6 2/7] rsa: add CONFIG_RSA_VERIFY_WITH_PKEY config AKASHI Takahiro
2020-01-27 10:27 ` [PATCH v6 3/7] include: image.h: add key info to image_sign_info AKASHI Takahiro
2020-01-27 10:27 ` [PATCH v6 4/7] lib: rsa: generate additional parameters for public key AKASHI Takahiro
2020-01-27 10:27 ` [PATCH v6 5/7] lib: rsa: add rsa_verify_with_pkey() AKASHI Takahiro
2020-01-27 10:27 ` [PATCH v6 6/7] test: add rsa_verify() unit test AKASHI Takahiro
2020-01-27 10:27 ` [PATCH v6 7/7] test: enable RSA library test on sandbox AKASHI Takahiro
2020-02-14 12:29 ` Tom Rini [this message]
2020-02-17 1:42 ` [PATCH v6 0/7] rsa: extend rsa_verify() for UEFI secure boot AKASHI Takahiro
2020-02-18 19:57 ` Tom Rini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200214122937.GA27143@bill-the-cat \
--to=trini@konsulko.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox