On 07/08/2020 09:47, Andrii Voloshyn wrote:
I'd like to use signature verification during sysupgrade, but at the moment I get
"Image check failed" message.
Similar to what guys mentioned here:
https://forum.openwrt.org/t/possible-bug-in-ucert/57704
Keep in mind that, for security purposes, optional signatures are useless.
You will have to change things so that your firmware *requires* the
signature to be always present. No backwards compatibility with
unsigned images is possible.
As a rule, an optional metadata field at the *end* of an image is
useless for either security or corruption checking purposes. All it
takes is the most common download issue of them all: truncation. The end
of the file isn't there (because it was truncated early enough), the
*optional* metadata isn't there, but enough of the headers made it
through to look like a valid image to sysupgrade. The corrupt
(incomplete) file is accepted and used, despise the fact that the
original had checksum metadata and signatures. Not Good[tm].
Prepending the metadata allows it to protect properly against download
truncation, but if the presence of signature metadata is still optional,
prepended or not it will still be useless as far as *security* goes.
The proper answer is *requiring* the metadata and signature to be
present. It resolves both issues, regardless of whether the metadata is
prepended or appended to the image.
What you're going to do about "sysupgrade -F" and direct flashing is
another angle to think about, as well...
--
Henrique de Moraes Holschuh
_______________________________________________
openwrt-devel mailing list
[email protected]
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
