Enforce TLV protected entries #1938
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
davidvincze
reviewed
Apr 16, 2024
Comment on lines
+358
to
+370
| IMAGE_TLV_KEYHASH, | ||
| IMAGE_TLV_PUBKEY, | ||
| IMAGE_TLV_SHA256, | ||
| IMAGE_TLV_SHA384, | ||
| IMAGE_TLV_RSA2048_PSS, | ||
| IMAGE_TLV_ECDSA224, | ||
| IMAGE_TLV_ECDSA_SIG, | ||
| IMAGE_TLV_RSA3072_PSS, | ||
| IMAGE_TLV_ED25519, | ||
| IMAGE_TLV_ENC_RSA2048, | ||
| IMAGE_TLV_ENC_KW, | ||
| IMAGE_TLV_ENC_EC256, | ||
| IMAGE_TLV_ENC_X25519, |
There was a problem hiding this comment.
This is the current situation - considering how imgtool works.
In theory the keyhash/pubkey and encryption TLVs could be in the protected area.
Do you think it would make sense to move these TLVs in the future?
As for the keyhash/pubkey TLV, I prefer to have it together with the signature TLV to make re-signing of an image more convenient.
There was a problem hiding this comment.
I think the keyhash/pubhash can stay in the unprotected. The things directly related to signature verification make sense to keep there. It probably makes sense to move the enc ones, but it isn't urgent.
I'll fix the whitespace.
Add a query to the TLV iterator that will indicate if the currently iterated TLV entry was found in the protected region or not. Signed-off-by: David Brown <david.brown@linaro.org>
Only allow TLV entries that are needed for signature verification to be placed in the unprotected area of the TLV. Signed-off-by: David Brown <david.brown@linaro.org>
Add a release not stub for the TLV check. Signed-off-by: David Brown <david.brown@linaro.org>
davidvincze
approved these changes
Apr 18, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add an additional check to the image validation to ensure that TLV entries that need to be protected are actually in the protected section. This works with a whitelist of entries that are allowed to be unprotected. There is a define
ALLOW_ROGUE_TLVSthat can be set to bypass this check.