Verity root hash signature #1737
Replies: 1 comment 3 replies
-
|
The root hash is signed as part of the full manifest, together with the meta that is necessary to perform the installation. So adding another verity signature (loaded into the kernel before setting up dm-verity) would not add additional security, right? In our projects, we've never had this issue as we use a signed kernel+initramfs (FIT or UKI) which contains the verity root hash of the rootfs, as we want to protect against mix & match attacks. We don't use the kernel's signature check. Would you use a same key as the normal bundle signature to sign the root hash or a different one? I think, adding support for creating a root-hash signature during bundle creation would ok. It would likely need a call from |
Beta Was this translation helpful? Give feedback.
8000 -
|
Hello, in my case it's not a matter of additional security. |
Beta Was this translation helpful? Give feedback.
-
|
If possible, could you explain why you want to use root hash signatures for other partitions? I'd like to understand the use-case better. Using a separate key sounds reasonable. This could be a Would you want to implement this yourself and submit a PR? If not, we offer commercial support and development. |
Beta Was this translation helpful? Give feedback.
-
|
Simply because I have readonly partitions that I mount at runtime, and I need to have a high level of security. Regarding the implementation, I had thought of it this way:
Do you think it could work, but above all, is it a safe solution? Thanks |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Hello, as you can guess from the title, I wanted to ask you if there is a possibility to implement the management of the root hash signature for verity bundle. In the documentation it is indicated as follows:
Basically, my question is: is it possible to insert in the manifest, also the root hash signature (generated via openSSL, for example) and then pass it to the dm-verity module as a parameter during the mount phase after launch rauc install?
Currently, this is what happens if I try to install a bundle while the dm-verity driver is forced to verify the form of the root hash (dm-verity.requires_signature = true)
Thanks
Beta Was this translation helpful? Give feedback.
All reactions