lkml.org 
[lkml]   [2015]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [RFD] linux-firmware key arrangement for firmware signing
    From
    Date
    On Thu, 2015-05-21 at 16:03 +0000, Woodhouse, David wrote:
    > On Thu, 2015-05-21 at 08:45 -0700, Greg Kroah-Hartman wrote:
    > > On Thu, May 21, 2015 at 09:05:21AM -0400, Mimi Zohar wrote:
    > > > Signatures don't provide any guarantees as to code quality or
    > > > correctness. They do provide file integrity and provenance. In
    > > > addition to the license and a Signed-off-by line, having the
    > > > firmware provider include a signature of the firmware would be
    > > > nice.
    > >
    > > That would be "nice", but that's not going to be happening here, from
    > > what I can tell. The firmware provider should be putting the signature
    > > inside the firmware image itself, and verifying it on the device, in
    > > order to properly "know" that it should be running that firmware. The
    > > kernel shouldn't be involved here at all, as Alan pointed out.
    >
    > In a lot of cases we have loadable firmware precisely to allow us to
    > reduce the cost of the hardware. Adding cryptographic capability in the
    > 'load firmware' state of the device isn't really compatible with that
    > :)
    >
    > In the case where kernel and modules are signed, it *is* useful for a
    > kernel device driver also to be able to validate that what it's about
    > to load into a device is authentic. Where 'authentic' will originally
    > just mean that it's come from the linux-firmware.git repository or the
    > same entity that built (and signed) the kernel, but actually I *do*
    > expect vendors who are actively maintaining the firmware images in
    > linux-firmware.git to start providing detached signatures of their own.

    That's great! What format do you expect the detached signatures to be?
    Where will they reside?

    Mimi



    \
     
     \ /
      Last update: 2015-05-21 19:01    [W:4.979 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site