Hello,
I have a question regarding the signing of a FIT image using mkimage. I already
contacted DENX, they referred me to this mailing list.
mkimage supports the creation of a signed FIT image. To do this, we need to
have an appropriate .its file and pass the private key as a parameter to the
mkimage command:
mkimage -f fitImage-sign.its -k keys/ fitImage-signed
However, this approach does not work in our setup, as we do not have access to
the private key.
The private key resides on an HSM (Hardware security module) that is not
directly accessible for us. We can invoke signing related functions via an
external signing server that takes a sha256 hash as input and returns the
signed hash.
Then we need to add the signed hash to the FIT image.
The replacement of a signature in a FIT image can be easily done using the FDT
library.
However, getting the sha256 hash that mkimage uses for the signing does not
seems to be possible. I tried to reverse engineer the code, but it looks like
that there are a lot of low level byte operations on the FIT image.
Now my questions:
Is there a way to get the SHA256 used for the signing somehow from the mkimage
or via a different way?
Is there somewhere a documentation how this hash is generated from the unsigned
FIT image ?
Any help is very much appreciated.
Some more details below
Our system runs on a raspberry pi CM 4 module. We use Yocto scarthgap to build
the SW images.
The raspberry bootloader loads the U-boot which then boots the further system
using a fit image.
We need to support secure boot for this platform. As part of it, we need to
have a signed fit image.
Currently, we achieve this using the mkimage tool with the -k option to pass
the private key. Via this procedure we are able to execute the secure boot
successfully.
However, our organization requires to use a dedicated signing server that
implements an organization wide security infrastructure.
It requires a hash (sha256) as input and returns a signature that is generated
using the private key inside the signing server.
Our challenges are now:
1. Get the hashes that mkimage uses as a base for the signatures
2. Manipulate the fit image to include the configuration signatures
The attachments may provide further details.
Thank you very much and Regards
Klaus Rosenschild
IoT solution architect
OP BU Tool Services
Hilti Entwicklungsgesellschaft mbH
Hiltistraße 6 | 86916 Kaufering
E klaus.rosensch...@hilti.com<mailto:klaus.rosensch...@hilti.com>
www.hilti.de<http://www.hilti.de/>
Hilti Entwicklungsgesellschaft mbH
Geschäftsführer: Dr. Olaf Schadoffsky
Sitz der Gesellschaft: D-86916 Kaufering, Hiltistraße 6
Amtsgericht Augsburg HRB 16295
rosekla@K122842H1:~/signing/playground/uboot$ ls
bcm2711-rpi-4-b.dtb fitImage.its
keys
fitImage-sign.its hilti-locker-initramfs-raspberrypi-cm4-digisens.cpio.gz
linux.bin
rosekla@K122842H1:~/signing/playground/uboot$ cat fitImage.its
/dts-v1/;
/ {
description = "Kernel fitImage for Poky (Yocto Project Reference
Distro)/6.6.22+git/raspberrypi-cm4-digisens";
#address-cells = <1>;
images {
kernel-1 {
description = "Linux kernel";
data = /incbin/("linux.bin");
type = "kernel";
arch = "arm64";
os = "linux";
compression = "none";
load = <0x00008000>;
entry = <0x00008000>;
hash-1 {
algo = "sha256";
};
};
fdt-bcm2711-rpi-4-b.dtb {
description = "Flattened Device Tree blob";
data = /incbin/("bcm2711-rpi-4-b.dtb");
type = "flat_dt";
arch = "arm64";
compression = "none";
hash-1 {
algo = "sha256";
};
};
ramdisk-1 {
description = "hilti-locker-initramfs";
data =
/incbin/("hilti-locker-initramfs-raspberrypi-cm4-digisens.cpio.gz");
type = "ramdisk";
arch = "arm64";
os = "linux";
compression = "none";
hash-1 {
algo = "sha256";
};
};
};
configurations {
default = "conf-bcm2711-rpi-4-b.dtb";
conf-bcm2711-rpi-4-b.dtb {
description = "1 Linux kernel, FDT blob, ramdisk";
kernel = "kernel-1";
fdt = "fdt-bcm2711-rpi-4-b.dtb";
ramdisk = "ramdisk-1";
};
};
};
rosekla@K122842H1:~/signing/playground/uboot$ cat fitImage-sign.its
/dts-v1/;
/ {
description = "Kernel fitImage for Poky (Yocto Project Reference
Distro)/6.6.22+git/raspberrypi-cm4-digisens";
#address-cells = <1>;
images {
kernel-1 {
description = "Linux kernel";
data = /incbin/("linux.bin");
type = "kernel";
arch = "arm64";
os = "linux";
compression = "none";
load = <0x00008000>;
entry = <0x00008000>;
hash-1 {
algo = "sha256";
};
};
fdt-bcm2711-rpi-4-b.dtb {
description = "Flattened Device Tree blob";
data = /incbin/("bcm2711-rpi-4-b.dtb");
type = "flat_dt";
arch = "arm64";
compression = "none";
hash-1 {
algo = "sha256";
};
};
ramdisk-1 {
description = "hilti-locker-initramfs";
data =
/incbin/("hilti-locker-initramfs-raspberrypi-cm4-digisens.cpio.gz");
type = "ramdisk";
arch = "arm64";
os = "linux";
compression = "none";
hash-1 {
algo = "sha256";
};
};
};
configurations {
default = "conf-bcm2711-rpi-4-b.dtb";
conf-bcm2711-rpi-4-b.dtb {
description = "1 Linux kernel, FDT blob, ramdisk";
kernel = "kernel-1";
fdt = "fdt-bcm2711-rpi-4-b.dtb";
ramdisk = "ramdisk-1";
signature {
algo = "sha256,rsa2048";
key-name-hint = "build";
sign-images = "kernel", "fdt", "ramdisk";
require-hash = "true";
padding = "pkcs-1.5";
sig-type = "x509";
};
};
};
};
rosekla@K122842H1:~/signing/playground/uboot$ mkimage -f fitImage.its fitImage
FIT description: Kernel fitImage for Poky (Yocto Project Reference
Distro)/6.6.22+git/raspberrypi-cm4-digisens
Created: Wed Jan 15 15:52:49 2025
Image 0 (kernel-1)
Description: Linux kernel
Created: Wed Jan 15 15:52:49 2025
Type: Kernel Image
Compression: uncompressed
Data Size: 27406848 Bytes = 26764.50 KiB = 26.14 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x00008000
Entry Point: 0x00008000
Hash algo: sha256
Hash value: 8fd7fa36fe73eb8f9a43e64e1be6d6d7f4225056985699692076feb2e6da358e
Image 1 (fdt-bcm2711-rpi-4-b.dtb)
Description: Flattened Device Tree blob
Created: Wed Jan 15 15:52:49 2025
Type: Flat Device Tree
Compression: uncompressed
Data Size: 54809 Bytes = 53.52 KiB = 0.05 MiB
Architecture: AArch64
Hash algo: sha256
Hash value: b7a32c0939c4d51b9ab87c6d3d68388887c828f258bfa3fa48c8290a635fadd4
Image 2 (ramdisk-1)
Description: hilti-locker-initramfs
Created: Wed Jan 15 15:52:49 2025
Type: RAMDisk Image
Compression: uncompressed
Data Size: 41491844 Bytes = 40519.38 KiB = 39.57 MiB
Architecture: AArch64
OS: Linux
Load Address: unavailable
Entry Point: unavailable
Hash algo: sha256
Hash value: b4c834417c8a845907cc19a415fa69f4e23b442f03f1ea56f5b431b7fa2047fa
Default Configuration: 'conf-bcm2711-rpi-4-b.dtb'
Configuration 0 (conf-bcm2711-rpi-4-b.dtb)
Description: 1 Linux kernel, FDT blob, ramdisk
Kernel: kernel-1
Init Ramdisk: ramdisk-1
FDT: fdt-bcm2711-rpi-4-b.dtb
rosekla@K122842H1:~/signing/playground/uboot$ mkimage -f fitImage-sign.its -k
keys/ fitImage-signed
FIT description: Kernel fitImage for Poky (Yocto Project Reference
Distro)/6.6.22+git/raspberrypi-cm4-digisens
Created: Wed Jan 15 15:52:58 2025
Image 0 (kernel-1)
Description: Linux kernel
Created: Wed Jan 15 15:52:58 2025
Type: Kernel Image
Compression: uncompressed
Data Size: 27406848 Bytes = 26764.50 KiB = 26.14 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x00008000
Entry Point: 0x00008000
Hash algo: sha256
Hash value: 8fd7fa36fe73eb8f9a43e64e1be6d6d7f4225056985699692076feb2e6da358e
Image 1 (fdt-bcm2711-rpi-4-b.dtb)
Description: Flattened Device Tree blob
Created: Wed Jan 15 15:52:58 2025
Type: Flat Device Tree
Compression: uncompressed
Data Size: 54809 Bytes = 53.52 KiB = 0.05 MiB
Architecture: AArch64
Hash algo: sha256
Hash value: b7a32c0939c4d51b9ab87c6d3d68388887c828f258bfa3fa48c8290a635fadd4
Image 2 (ramdisk-1)
Description: hilti-locker-initramfs
Created: Wed Jan 15 15:52:58 2025
Type: RAMDisk Image
Compression: uncompressed
Data Size: 41491844 Bytes = 40519.38 KiB = 39.57 MiB
Architecture: AArch64
OS: Linux
Load Address: unavailable
Entry Point: unavailable
Hash algo: sha256
Hash value: b4c834417c8a845907cc19a415fa69f4e23b442f03f1ea56f5b431b7fa2047fa
Default Configuration: 'conf-bcm2711-rpi-4-b.dtb'
Configuration 0 (conf-bcm2711-rpi-4-b.dtb)
Description: 1 Linux kernel, FDT blob, ramdisk
Kernel: kernel-1
Init Ramdisk: ramdisk-1
FDT: fdt-bcm2711-rpi-4-b.dtb
Sign algo: sha256,rsa2048:build
Sign padding: pkcs-1.5
Sign value:
9c75ff865d195d6d529cc00a85ee27a6a7cdd6dc8ccc78d873f0e3346f3b26fefc1bb60319c14886f64329f77aeea7b261fcf5b2be5cdbe558cd4638b734bc21aec71d2b6b18f2d0cdc8cc02d1bec125295c5dff5d2da0dac0618e3dcbb46e983b4c4b0aa83c8698d48b66e127513458efd6e2e59cacd60207e86cf37c5215611de933abc740ddb226c65faac78622591e8d5bae06e38689646dee0a26fbe86640301c002f952307d189dcf8bb08fc63a9d433a1b075d3c855461bbce06c19fc27cd4a6ed3fbe1dccfe46d56c0a0181d5a4f23687a63e2697d79eb58b0cb3d8d16f2c9788bea51870cceb710206ed48dce0288028f7f873e07e29e5419e272b0
Timestamp: Wed Jan 15 15:52:58 2025
