[PATCH 1/4] tools: mkeficapsule: add firmwware image signing

[Heinrich Schuchardt]

On 5/14/21 3:09 PM, Masami Hiramatsu wrote:
> Hi all,
>
> I think it's time to summarize the topics on this thread.
>
> 1. tools/mkeficapsule, config options dependency
>    - The tools, especially useful and distributable tools like
> mkeficapsule should not be changed by the target board configuration.
>    - Since there are target boards which don't need capsule
> authentication, it should be configurable. That also can optimize the
> library dependency.

Thank you for providing this summary.

You described that the tool shall not depend on the target board
configuration. Your sentence starting with "Since" contradicts this.

As Ilias pointed out all Linux distributions come with an OpenSSL
package. The library dependency is nothing to worry about.

Capsule updates without authentication don't not make much sense in a
world full of attacks.

Hence, a configuration switch for the tool is not needed.

Best regards

Heinrich

>
> 2. tools/mkeficapsule, revert -K/-D options
>    - Since these options are for embedding a public key in the
> devicetree, that is not related to the capsule file. Also, the same
> feature can be provided by a simple shell script.
>
> 3. capsule authentication, key embedding method
>    - Embedding key in the devicetree is too fragile, especially, the
> document says overwriting new device tree including key with fdt
> command. That is not for the product, only for proof of concept.
>    - Such a key should be embedded in the U-Boot, or hardware secure
> storage so that the user can not change it.
>      (BTW, I think there are more options, like embedding keys in SCP
> firmware, TF-A, or OP-TEE, outside of U-Boot)
>
> 4. capsule authentication, authentication enablement
>    - The UEFI spec said IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED can be
> supported but cleared (for the current running firmware). This means
> it is possible that the authentication feature is supported, but not
> enabled.
>    - For ensuring security, if U-Boot is compiled with
> CONFIG_EFI_CAPSULE_AUTHETICATE=y,
> IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED must always be set.
>
> Are there any other topics on this thread? and any other comments on
> these topics?
>
> Thank you,