Firmware Key and Signature Formats

This page describes the key and signature formats understood by OFW. The Firmware Security page describes how these are used.

Key

key01 data\n
 3 2 1 N  1

So that's:

• the literal string "key"
• the two digit version number ("01" for now)
• a space
• the key data
• a newline

The key data is a hexadecimal-encoded octet string. The octet string is the ASN.1 DER encoding of an RSA public key given by Appendix A.1.1 of RSA PKCS #1, version 2.1.

Future versions of the key format might allow different algorithms.

Signature

sig01 timestamp keyid data\n
 3 2 1    16   1  64 1  N  1

So that's:

• the literal string "sig"
• the two digit version number ("01" for now)
• a space
• the 16-character ISO 8601 UTC expiration time in basic format (no dashes or colons) and no fractional seconds. (eg: "20070816T173500Z")
  • should consist of the string "00000000T000000Z" if not present or not applicable.
  • firmware must ignore this expiration time if the signature is on a kernel or ramdisk.
• a space
• the 64 character key ID, which are the trailing 64 characters of the "key data" in the key format above. (for the immediate future you can ignore this in the firmware, and just use a single key for each task.)
  • This includes the exponent and the least significant bytes of the modulus
• a space
• the signature data as a hexadecimal-encoded string. The encoded data is the ASN.1 DER encoding of an RSA PSS signature given by Appendix A.2.3 of RSA PKCS #1, version 2.1. The hashAlgorithm field will have the value sha256, and the maskGenAlgorithm field will have the value mgf1SHA256.
• a newline

Antitheft/Activation Lease

An activation lease is a signature, in the format above, of the string:

<serial-number>:<uuid>:<expiration time>

where the expiration time is identical in format and content to the signature expiration time.

For example:

SHF725001A0:414737D8-2312-9241-9C7B-9886CB74403C:20080819T052946Z

Resources

• PKCS #1, v2.1 (wikipedia)
• ASN.1 DER (wikipedia)