smallsolar/u-boot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for SHA384 and SHA512

Browse Source 
The current recommendation for best security practice from the US government
is to use SHA384 for TOP SECRET [1].

This patch adds support for SHA384 and SHA512 in the hash command, and also
allows FIT images to be hashed with these algorithms, and signed with
sha384,rsaXXXX and sha512,rsaXXXX

The SHA implementation is adapted from the linux kernel implementation.

[1] Commercial National Security Algorithm Suite
http://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite.cfm

Signed-off-by: Reuben Dowle <reuben.dowle@4rf.com>
This commit is contained in:
Reuben Dowle
2020-04-16 17:36:52 +12:00
committed by Tom Rini
parent f191f3a102
commit d16b38f427
13 changed files with 632 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
common/spl/Kconfig
View File

@@ -412,7 +412,7 @@ config SPL_MD5_SUPPORT
secure as it is possible (with a brute-force attack) to adjust the
image while still retaining the same MD5 hash value. For secure
applications where images may be changed maliciously, you should
consider SHA1 or SHA256.
consider SHA256 or SHA384.
config SPL_SHA1_SUPPORT
bool "Support SHA1"
@@ -424,7 +424,7 @@ config SPL_SHA1_SUPPORT
image contents have not been corrupted or maliciously altered.
While SHA1 is fairly secure it is coming to the end of its life
due to the expanding computing power available to brute-force
attacks. For more security, consider SHA256.
attacks. For more security, consider SHA256 or SHA384.
config SPL_SHA256_SUPPORT
bool "Support SHA256"
@@ -433,12 +433,28 @@ config SPL_SHA256_SUPPORT
help
Enable this to support SHA256 in FIT images within SPL. A SHA256
checksum is a 256-bit (32-byte) hash value used to check that the
image contents have not been corrupted. SHA256 is recommended for
use in secure applications since (as at 2016) there is no known
feasible attack that could produce a 'collision' with differing
input data. Use this for the highest security. Note that only the
SHA256 variant is supported: SHA512 and others are not currently
supported in U-Boot.
image contents have not been corrupted.
config SPL_SHA384_SUPPORT
bool "Support SHA384"
depends on SPL_FIT
select SHA384
select SHA512_ALGO
help
Enable this to support SHA384 in FIT images within SPL. A SHA384
checksum is a 384-bit (48-byte) hash value used to check that the
image contents have not been corrupted. Use this for the highest
security.
config SPL_SHA512_SUPPORT
bool "Support SHA512"
depends on SPL_FIT
select SHA512
select SHA512_ALGO
help
Enable this to support SHA512 in FIT images within SPL. A SHA512
checksum is a 512-bit (64-byte) hash value used to check that the
image contents have not been corrupted.
config SPL_FIT_IMAGE_TINY
bool "Remove functionality from SPL FIT loading to reduce size"