Firmware Key and Signature Formats: Difference between revisions

From OLPC
Jump to navigation Jump to search
(First pass clean-up.)
(Details of Key ID and of Signature Data)
Line 26: Line 26:
* the two digit version number ("01" for now)
* the two digit version number ("01" for now)
* a space
* a space
* the 13-character [http://en.wikipedia.org/wiki/ISO_8601 ISO 8601] UTC timestamp in basic format (no dashes or colons) and no fractional seconds. (eg: "200708161735Z")
* the 15-character [http://en.wikipedia.org/wiki/ISO_8601 ISO 8601] UTC timestamp in basic format (no dashes or colons) and no fractional seconds. (eg: "20070816173500Z")
* a space
* a space
* the 64 character key ID, as a hex-encoded SHA256 hash of the key file (for the immediate future you can ignore this in the firmware,
* the 64 character key ID, which are the trailing 64 characters of the "key data" in the key format above. (for the immediate future you can ignore this in the firmware, and just use a single key for each task.)
** This includes the exponent and the least significant bytes of the modulus
and just use a single key for each task.)
* a space
* a space
* the signature data as a hexadecimal-encoded string. The encoded data is the ASN.1 encoding of an RSA PSS signature given by Appendix A.2.3 of [ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf RSA PKCS #1, version 2.1]. The hashAlgorithm field will have the value sha256, and the maskGenAlgorithm field will have the value mgf1SHA256.
* the signature data as a hex-encoded string
* a newline
* a newline

Revision as of 19:03, 23 August 2007

This page describes the key and signature formats understood by OFW. The Firmware Security page describes how these are used.

Key

key01 alg data\n
 3 2 1 3 1 N  1

So that's:

  • the literal string "key"
  • the two digit version number ("01" for now)
  • a space
  • the three character algorithm name (for now this will always be "rsa")
  • a space
  • the key data
  • a newline

The key data is a hexadecimal-encoded octet string. The octet string is the ASN.1 encoding of an RSA public key given by Appendix A.1.1 of RSA PKCS #1, version 2.1.

Signature

sig01 timestamp keyid data\n
 3 2 1    13   1  64 1  N  1

So that's:

  • the literal string "sig"
  • the two digit version number ("01" for now)
  • a space
  • the 15-character ISO 8601 UTC timestamp in basic format (no dashes or colons) and no fractional seconds. (eg: "20070816173500Z")
  • a space
  • the 64 character key ID, which are the trailing 64 characters of the "key data" in the key format above. (for the immediate future you can ignore this in the firmware, and just use a single key for each task.)
    • This includes the exponent and the least significant bytes of the modulus
  • a space
  • the signature data as a hexadecimal-encoded string. The encoded data is the ASN.1 encoding of an RSA PSS signature given by Appendix A.2.3 of RSA PKCS #1, version 2.1. The hashAlgorithm field will have the value sha256, and the maskGenAlgorithm field will have the value mgf1SHA256.
  • a newline