Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-13 15:03:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

efi_loader: image_loader: add digest-based verification for signed image

Browse Source 
In case that a type of certificate in "db" or "dbx" is
EFI_CERT_X509_SHA256_GUID, it is actually not a certificate which contains
a public key for RSA decryption, but a digest of image to be loaded.
If the value matches to a value calculated from a given binary image, it is
granted for loading.

With this patch, common digest check code, which used to be used for
unsigned image verification, will be extracted from
efi_signature_verify_with_sigdb() into efi_signature_lookup_digest(), and
extra step for digest check will be added to efi_image_authenticate().

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
This commit is contained in:
AKASHI Takahiro
2020-07-08 14:01:57 +09:00
committed by Heinrich Schuchardt
parent 11bafb2596
commit 7926dfb579
3 changed files with 102 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/efi_loader.h
View File

@@ -765,6 +765,8 @@ struct efi_signature_store {
struct x509_certificate;
struct pkcs7_message;
bool efi_signature_lookup_digest(struct efi_image_regions *regs,
struct efi_signature_store *db);
bool efi_signature_verify_one(struct efi_image_regions *regs,
struct pkcs7_message *msg,
struct efi_signature_store *db);