Re: [PATCH] habv4: add the possibility to changing the signing area from Kconfig

[Sascha Hauer <s.hauer@pengutronix.de>]

On Wed, Dec 11, 2019 at 08:57:45AM +0100, Maik Otto wrote:
> Hi Sascha,
> 
> in my opinion it is better to have it configurable, because ther are
> different use cases and security requirements.
> i found the problem by creating  a sd-card \emmc image with wic.  The
> mbr, the partition table and bootloader became be signed at barebox
> build and wic changes
> the partition table at the end of the build process. Then the sd card
> image could not boot , because the signature was wrong. yeah secure boot
> works :-)
> the highest protection you have, when mbr and partition table is signed
> with the bootloader, but it is not always necessary.

But in which cases is it really necessary? I can't think of any. The mbr
and partition table are not evaluated by the ROM code, hence they do not
need to be signed for HAB.

The images generated by the build system all do not have a partition table
included, so basically we are currently enforcing no partition table at
all which is just not useful.

I think the current way of including the first KiB in signed area comes
from the fact that we started doing HAB on a NAND device which doesn't
have a partition table. Other projects we are currently doing use eMMC
where we use the boot partitions, again no MBR or partition table.

If we had started on SD cards, we wouldn't have included the partition
table in the signature and also would never have thought it would be a
good idea to do so.

Regards
 Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox