mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-09-23 14:41:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

coreos_sign_update: Use smartcards for signing

Browse Source 
Sign updates using private keys on smartcards. This involves changing the
padding approach - rather than including the padding in the hash, ask the
card to generate the padding itself, since the card will refuse to sign
pre-padded material. Use + as a key separator rather than : as the PKCS#11
URI includes colons.
This commit is contained in:
Matthew Garrett 2017-01-12 15:49:13 -08:00 committed by Euan Kemp
parent 2447debece
commit 54048fbb00
2 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
core_sign_update
View File

@ -43,10 +43,10 @@ delta_generator \
-new_kernel "$FLAGS_kernel" \ -new_kernel "$FLAGS_kernel" \
-out_file update -out_file update
IFS=: read -a private_keys <<< "$FLAGS_private_keys" IFS=+ read -a private_keys <<< "$FLAGS_private_keys"
IFS=: read -a public_keys <<< "$FLAGS_public_keys" IFS=+ read -a public_keys <<< "$FLAGS_public_keys"
if [ ${#private_keys} -ne ${#public_keys} ]; then if [ ${#private_keys[@]} -ne ${#public_keys[@]} ]; then
echo "mismatch in count of private keys and public keys" echo "mismatch in count of private keys and public keys"
exit 1 exit 1
fi fi
@ -64,13 +64,13 @@ delta_generator \
--in_file update \ --in_file update \
--out_hash_file update.hash --out_hash_file update.hash
# The following is a standard PKCS1-v1_5 padding for SHA256 signatures, as # The following is an ASN.1 header. It is prepended to the actual signature
# defined in RFC3447. It is prepended to the actual signature (32 bytes) to # (32 bytes) to form a sequence of 51 bytes. OpenSSL will add additional
# form a sequence of 256 bytes (2048 bits) that is amenable to RSA signing. The # PKCS#1 1.5 padding during the signing operation. The padded hash will look
# padded hash will look as follows: # as follows:
# #
# 0x00 0x01 0xff ... 0xff 0x00 ASN1HEADER SHA256HASH # ASN1HEADER SHA256HASH
# |--------------205-----------||----19----||----32----| # |----19----||----32----|
# #
# where ASN1HEADER is the ASN.1 description of the signed data. The complete 51 # where ASN1HEADER is the ASN.1 description of the signed data. The complete 51
# bytes of actual data (i.e. the ASN.1 header complete with the hash) are # bytes of actual data (i.e. the ASN.1 header complete with the hash) are
@ -83,13 +83,13 @@ delta_generator \
# } # }
# OCTET STRING(2+32) <actual signature bytes...> # OCTET STRING(2+32) <actual signature bytes...>
# } # }
echo "AAH/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////ADAxMA0GCWCGSAFlAwQCAQUABCA=" | base64 -d > padding echo "MDEwDQYJYIZIAWUDBAIBBQAEIA==" | base64 -d > padding
cat padding update.hash > update.padhash cat padding update.hash > update.padhash
i=1 i=1
signature_sizes="" signature_sizes=""
for key in "${private_keys[@]}"; do for key in "${private_keys[@]}"; do
openssl rsautl -raw -sign -inkey ${key} -in update.padhash -out update.sig.${i} openssl rsautl -engine pkcs11 -pkcs -sign -inkey ${key} -keyform engine -in update.padhash -out update.sig.${i}
let "i += 1" let "i += 1"
done done

4
offline_signing/sign.sh
View File

@ -17,5 +17,5 @@ cd "${DATA_DIR}"
--image "${DATA_DIR}/coreos_production_update.bin" \ --image "${DATA_DIR}/coreos_production_update.bin" \
--kernel "${DATA_DIR}/coreos_production_image.vmlinuz" \ --kernel "${DATA_DIR}/coreos_production_image.vmlinuz" \
--output "${DATA_DIR}/coreos_production_update.gz" \ --output "${DATA_DIR}/coreos_production_update.gz" \
--private_keys "${KEYS_DIR}/devel.key.pem:${KEYS_DIR}/prod-2.key.pem" \ --private_keys "${KEYS_DIR}/devel.key.pem+${KEYS_DIR}/prod-2.key.pem" \
--public_keys "${KEYS_DIR}/devel.pub.pem:${KEYS_DIR}/prod-2.pub.pem" --public_keys "${KEYS_DIR}/devel.pub.pem+${KEYS_DIR}/prod-2.pub.pem"