From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2F404C433F5 for ; Fri, 14 Jan 2022 09:22:24 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 4CFF183496; Fri, 14 Jan 2022 10:21:57 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=siemens.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=siemens.com header.i=@siemens.com header.b="oyZNKqpp"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id EE4F68343B; Fri, 14 Jan 2022 10:21:55 +0100 (CET) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-ve1eur03on0617.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe09::617]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id AA88283493 for ; Fri, 14 Jan 2022 10:21:50 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=siemens.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=jan.kiszka@siemens.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=bVkP+DdL5KfBUg5dn+0rmn51Z+kCGjXpWlUCA+a7ohjzoX6WNsRF3nJma3a3Pwq04OtrXw45tE3s1YmHGuA0zbGt/6YI06mzzDPj/LvuY8Vm/zRTIaDCTLoz9maxInIbXaaEqUU3j5UZJVx4LsevlUS9V5KZ6q8SOwAGXF4jp2olcRK7+xPhCqTQxijsH8E5SVLW9hTZI7Y1D9RH5R7k4SlfE5SBO1Y/wABb25M6N6T5TTdYnsf4lTu2LX/SzA+l8vMgcYNjQzICzEW1PShfHkO/netQmIMyh44vIKNDzIcudFi3zeKDg7s04ybanfBJ/lyToa6TKZMBNh7hr621Ow== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=7OWhy97pV00dv7vJ52R0srfNOyjGeZW39qSMM8X5n9I=; b=I3YYrdtG3eUmK3DGbNGYM99nQfi+TqIIe1LiggA+3sf8e3tWAYvFDPp6eIdYv3S7Srk0JuX+sfz7a1Ag/SxvARJvl+H+o/SbI1U0nzZgYBikNTRrHjpAsRDF/b4Xursc8hXZLE5q9mH4ycQrnJIdtOHP51zlfCLZ7zc2zHQ4nWAOAO1u9ExmBM/xoIZEc6zLe8EKTCvCkb5LAGGcJh0dJ2E+YjoILfD6YVdio2tqdkMV8AyD6ZeZB/etuQsG42cduFI5i2bLHBhkW+oLT+uLorfKBxh3f6Kf0HmpTgKCCFIxopYvkniVTT/OsBQF1i2JDrq3VOwUQrpW5GosQz2q1g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 194.138.21.70) smtp.rcpttodomain=linux.microsoft.com smtp.mailfrom=siemens.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=siemens.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7OWhy97pV00dv7vJ52R0srfNOyjGeZW39qSMM8X5n9I=; b=oyZNKqppfXNFmj5M55auo9qRbatbLeDNcTcLebZy9KiVemB/ppJixndmIC7QVtPSOkMAugow0knxPv7FVzA8rhPw1Lw1TWMq/Djz2WTlhSj8lyG1UQ7wR9V2CT7l+IfaLnOZ6usNFzNFkKjMxSo/BUmZtoCd17rNObTvT9kEm6GU9Tgt+zHoHSk4xnHGd5B22LiyCGGEs1rgQX7QLJEAPc059YGxac31qq+2IYBf2a4j6r9X2PTqA3vaY2bkO0qqcv9wxQQaGPmUsAV09xNhU/xGOoInxCt7sZni32or5+YP3O9VDS8JrXXpcPwrN63xDdKMH46BI0E6705hB6zSNQ== Received: from DB6PR0501CA0024.eurprd05.prod.outlook.com (2603:10a6:4:8f::34) by AM0PR10MB3106.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:208:12a::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4888.9; Fri, 14 Jan 2022 09:21:49 +0000 Received: from DB5EUR01FT042.eop-EUR01.prod.protection.outlook.com (2603:10a6:4:8f:cafe::4e) by DB6PR0501CA0024.outlook.office365.com (2603:10a6:4:8f::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4888.10 via Frontend Transport; Fri, 14 Jan 2022 09:21:49 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 194.138.21.70) smtp.mailfrom=siemens.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=siemens.com; Received-SPF: Pass (protection.outlook.com: domain of siemens.com designates 194.138.21.70 as permitted sender) receiver=protection.outlook.com; client-ip=194.138.21.70; helo=hybrid.siemens.com; Received: from hybrid.siemens.com (194.138.21.70) by DB5EUR01FT042.mail.protection.outlook.com (10.152.5.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.4888.9 via Frontend Transport; Fri, 14 Jan 2022 09:21:48 +0000 Received: from DEMCHDC8A0A.ad011.siemens.net (139.25.226.106) by DEMCHDC9SJA.ad011.siemens.net (194.138.21.70) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.17; Fri, 14 Jan 2022 10:21:48 +0100 Received: from [167.87.0.93] (167.87.0.93) by DEMCHDC8A0A.ad011.siemens.net (139.25.226.106) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.17; Fri, 14 Jan 2022 10:21:48 +0100 Message-ID: <3f5b1588-0ff8-0d14-e7b7-1aebf913dc0e@siemens.com> Date: Fri, 14 Jan 2022 10:21:47 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.4.1 Subject: Re: [PATCH 0/3] mkimage: allow to specify signing algorithm Content-Language: en-US To: Dhananjay Phadke , U-Boot Mailing List , Simon Glass CC: Ivan Mikhaylov References: <276812c9-80e6-c430-c1cf-c19566accc02@siemens.com> From: Jan Kiszka In-Reply-To: Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [167.87.0.93] X-ClientProxiedBy: DEMCHDC89YA.ad011.siemens.net (139.25.226.104) To DEMCHDC8A0A.ad011.siemens.net (139.25.226.106) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 38e5baf8-c3bd-48a1-9905-08d9d73f4ae8 X-MS-TrafficTypeDiagnostic: AM0PR10MB3106:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: qmfw8gM8gi7gtl9uhjpZxBtSjyHGPxvxVkyu2+8vAQcPkvNRGCKu/+LZu0G4qMKAyUWGEPhMo54S4NGbItO7S5vLD+yhr3htSzU5DDuLs16zzSk5YW5EF7omEhcgts5Kci2t+tJKZt1i+io0YCsmC+A95ojcnerbgdX/Umbl41MUA5GyqYZIPucEur7A03IsuvDwex4hpMEKjyE0tMTF34h80kG3CcsMMyDSm6sjUNaICfI3DIAPEtgXM9fyWLT+Fahok769I/ZaK/QEh1RqYinIHK3IJ1MnIAH+gYZ58y1fsl9SlwbzvpsLHV4n718DhgJmSK1ZgZONQtbXCJXtbr+DT//lB9zZG8HWL/GdP721dpRfy+qyFKKj19oF4+mKFbUR0+qFm8K81scOvOj4cJ5wbJKBUPSFHl2fAttSwHS3Cx2scqv/hJ4W6+Yqytai+M0ea1a6aIANyUarGkApDPi9IUJTUVyxsxFoPZnitB6SVZG7jQx6MeZmKzRT9jXKwM1CZcbLeTZ7L0g5LvUjtTUscbW83wJ+b9F+9vFF+7DKf/E/SAY6OfSoqoVdROa2kXYwXQJnBDwGfnCTkpttEN9u1Dl2x8XF4CQlBeENMmA8KAozlAwlb6hRHsF/FMuBxSq5FAVjd9heelxJkZaQuCWtXPpBh9HGPx+aM7fq2X9YNRm7ip36MhgOnifUCFyfguZBJaLSTdxBa1TXps0zZzSOs3Php8i3o7uqrENtSHQC/ZeluJZYVQJFe3Gn6mjoDZ5TFI/2xAao1lZV+zq+r0H8O0rtyAmmu0pKo6Jour83aiQEhOD6yQm8BAFK7ji/hJsEUfuJi0Cazj522Abxoa1QEeVTKo5K2UulqKbQCNUpifql5z0QwwJe5wzq1yUW6VBP33lLFK8TqyzQ1v5vqA== X-Forefront-Antispam-Report: CIP:194.138.21.70; CTRY:DE; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:hybrid.siemens.com; PTR:hybrid.siemens.com; CAT:NONE; SFS:(4636009)(36840700001)(46966006)(40470700002)(316002)(186003)(36756003)(16576012)(16526019)(6706004)(82960400001)(36860700001)(956004)(44832011)(966005)(83380400001)(336012)(4326008)(2616005)(356005)(86362001)(7636003)(31696002)(110136005)(40460700001)(8676002)(47076005)(70206006)(70586007)(26005)(53546011)(107886003)(82310400004)(8936002)(31686004)(508600001)(5660300002)(7596003)(2906002)(3940600001)(43740500002); DIR:OUT; SFP:1101; X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jan 2022 09:21:48.8523 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 38e5baf8-c3bd-48a1-9905-08d9d73f4ae8 X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=38ae3bcd-9579-4fd4-adda-b42e1495d55a; Ip=[194.138.21.70]; Helo=[hybrid.siemens.com] X-MS-Exchange-CrossTenant-AuthSource: DB5EUR01FT042.eop-EUR01.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR10MB3106 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.2 at phobos.denx.de X-Virus-Status: Clean On 14.01.22 00:28, Dhananjay Phadke wrote: > On 1/13/2022 4:38 AM, Jan Kiszka wrote: >> On 25.11.21 20:03, Jan Kiszka wrote: >>> Another step to decouple the FIT image specification from the actual >>> signing: With these changes, the signature nodes can leave out an algo >>> property, mkimage will initialize that as well while signing. This way, >>> in-tree FIT source files can be prepared for gaining signatures without >>> defining the key type or size upfront, forcing users to patch the code >>> to change that. > > [resend to the list] > > While encryption algo (rsa2048 vs rsa4096, etc) shouldn't need to be > explicitly specified as you noted below, how does it help to add it to > (already exhaustive) mkimage args? Parsing OID / length from keyfile > would be real change. > > While rotating keys is common, how often algo is changed? > The use case is decoupling of signature preparation from actual signing. Means, we would like to prepare binman image device trees for applying signature but without making the decision which key type and width should be used. That shall be up to the user (integrator) of the firmware image. This series will enable a patch like https://github.com/siemens/u-boot/commit/1215a357ec1f58acde56c8ca4085aa43f8fdbf5a and a signature workflow that does not require to patch the U-Boot source anymore. It still makes the decision of using hash algo SHA256, but that is acceptable. Jan -- Siemens AG, Technology Competence Center Embedded Linux