issues verifying FIT image signature

issues verifying FIT image signature

[Kai Che]

Hi all,

I'm trying to verify the signature of a FIT image in barebox. 

I created the FIT image with the following .its file:

...
configurations {
        default = "config@1";
        config@1 {
            description = "Boot Raspian kernel";
            kernel = "kernel";
            fdt = "fdt-1";
            signature@1 {
                algo = "sha256,rsa2048";
                key-name-hint = "dev";
                sign-images = "fdt", "kernel";
...

Verifying the Hashes for the kernel and fdt-1 works fine ("hash OK" for both images) , but when I try to verify the signature I get the follwoing error:

ERROR: FIT: hashed-strings start not found in /configurations/config@1/signature@1

I could follow the error back to the fit_verify_signature function in /common/image-fit.c file, but I don't understand what is causing the error.

Is the function looking for a string called "hashed-strings" in the FIT image file? I checked the .fit file (with hexdump) and I could only find the string "hash@1" which barebox uses to verify the signature.

Best regards

Kai


   
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: issues verifying FIT image signature

[Sascha Hauer]

Hi Kai,

On Fri, Nov 02, 2018 at 03:16:44PM +0000, Kai Che wrote:
> Hi all,
> 
> I'm trying to verify the signature of a FIT image in barebox. 
> 
> I created the FIT image with the following .its file:
> 
> ...
> configurations {
>         default = "config@1";
>         config@1 {
>             description = "Boot Raspian kernel";
>             kernel = "kernel";
>             fdt = "fdt-1";
>             signature@1 {
>                 algo = "sha256,rsa2048";
>                 key-name-hint = "dev";
>                 sign-images = "fdt", "kernel";
> ...
> 
> Verifying the Hashes for the kernel and fdt-1 works fine ("hash OK"
> for both images) , but when I try to verify the signature I get the
> follwoing error:
> 
> ERROR: FIT: hashed-strings start not found in /configurations/config@1/signature@1
> 
> I could follow the error back to the fit_verify_signature function in
> /common/image-fit.c file, but I don't understand what is causing the
> error.
> 
> Is the function looking for a string called "hashed-strings" in the
> FIT image file? I checked the .fit file (with hexdump) and I could
> only find the string "hash@1" which barebox uses to verify the
> signature.

No idea what went wrong. Which options did you pass to mkimage?

Sascha

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox