* [U-Boot] [PATCH] rsa: Return immediately if required-key verification fails
@ 2019-09-14 10:36 Daniele Alessandrelli
2019-09-16 17:43 ` Simon Glass
0 siblings, 1 reply; 2+ messages in thread
From: Daniele Alessandrelli @ 2019-09-14 10:36 UTC (permalink / raw
To: u-boot
Currently, if image verification with a required key fails, rsa_verify()
code tries to find another key to verify the FIT image. This however, is
not the intended behavior as the documentation says that required keys
"must be verified for the image / configuration to be considered valid".
This patch fixes the issue by making rsa_verify() return immediately if
the verification of a required key fails.
Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@gmail.com>
---
lib/rsa/rsa-verify.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c
index 287fcc4d23..82dc513260 100644
--- a/lib/rsa/rsa-verify.c
+++ b/lib/rsa/rsa-verify.c
@@ -437,8 +437,7 @@ int rsa_verify(struct image_sign_info *info,
if (info->required_keynode != -1) {
ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
info->required_keynode);
- if (!ret)
- return ret;
+ return ret;
}
/* Look for a key that matches our hint */
--
2.21.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [U-Boot] [PATCH] rsa: Return immediately if required-key verification fails
2019-09-14 10:36 [U-Boot] [PATCH] rsa: Return immediately if required-key verification fails Daniele Alessandrelli
@ 2019-09-16 17:43 ` Simon Glass
0 siblings, 0 replies; 2+ messages in thread
From: Simon Glass @ 2019-09-16 17:43 UTC (permalink / raw
To: u-boot
Hi Daniele,
On Sat, 14 Sep 2019 at 04:37, Daniele Alessandrelli
<daniele.alessandrelli@gmail.com> wrote:
>
> Currently, if image verification with a required key fails, rsa_verify()
> code tries to find another key to verify the FIT image. This however, is
> not the intended behavior as the documentation says that required keys
> "must be verified for the image / configuration to be considered valid".
>
> This patch fixes the issue by making rsa_verify() return immediately if
> the verification of a required key fails.
>
> Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@gmail.com>
> ---
> lib/rsa/rsa-verify.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c
> index 287fcc4d23..82dc513260 100644
> --- a/lib/rsa/rsa-verify.c
> +++ b/lib/rsa/rsa-verify.c
> @@ -437,8 +437,7 @@ int rsa_verify(struct image_sign_info *info,
> if (info->required_keynode != -1) {
> ret = rsa_verify_with_keynode(info, hash, sig, sig_len,
> info->required_keynode);
> - if (!ret)
> - return ret;
> + return ret;
> }
>
> /* Look for a key that matches our hint */
> --
> 2.21.0
>
Thanks for the patch.
Unfortunately I don't think it is worth taking a patch in this area
without updating the test. Will see if someone has time to do that.
Regards,
Simon
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-09-16 17:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-09-14 10:36 [U-Boot] [PATCH] rsa: Return immediately if required-key verification fails Daniele Alessandrelli
2019-09-16 17:43 ` Simon Glass
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.