OLD | NEW |
(Empty) | |
| 1 #!/bin/bash |
| 2 # Copyright (c) 2011 The Chromium OS Authors. All rights reserved. |
| 3 # Use of this source code is governed by a BSD-style license that can be |
| 4 # found in the LICENSE file. |
| 5 |
| 6 # Common key generation functions. |
| 7 |
| 8 SCRIPT_DIR="$(dirname "$0")" |
| 9 |
| 10 # 0 = (RSA1024 SHA1) |
| 11 # 1 = (RSA1024 SHA256) |
| 12 # 2 = (RSA1024 SHA512) |
| 13 # 3 = (RSA2048 SHA1) |
| 14 # 4 = (RSA2048 SHA256) |
| 15 # 5 = (RSA2048 SHA512) |
| 16 # 6 = (RSA4096 SHA1) |
| 17 # 7 = (RSA4096 SHA256) |
| 18 # 8 = (RSA4096 SHA512) |
| 19 # 9 = (RSA8192 SHA1) |
| 20 # 10 = (RSA8192 SHA256) |
| 21 # 11 = (RSA8192 SHA512) |
| 22 function alg_to_keylen { |
| 23 echo $(( 1 << (10 + ($1 / 3)) )) |
| 24 } |
| 25 |
| 26 # Emit .vbpubk and .vbprivk using given basename and algorithm |
| 27 # NOTE: This function also appears in ../../utility/dev_make_keypair. Making |
| 28 # the two implementations the same would require some common.sh, which is more |
| 29 # likely to cause problems than just keeping an eye out for any differences. If |
| 30 # you feel the need to change this file, check the history of that other file |
| 31 # to see what may need updating here too. |
| 32 function make_pair { |
| 33 local base=$1 |
| 34 local alg=$2 |
| 35 local len=$(alg_to_keylen $alg) |
| 36 |
| 37 echo "creating $base keypair..." |
| 38 |
| 39 # make the RSA keypair |
| 40 openssl genrsa -F4 -out "${base}_${len}.pem" $len |
| 41 # create a self-signed certificate |
| 42 openssl req -batch -new -x509 -key "${base}_${len}.pem" \ |
| 43 -out "${base}_${len}.crt" |
| 44 # generate pre-processed RSA public key |
| 45 dumpRSAPublicKey -cert "${base}_${len}.crt" > "${base}_${len}.keyb" |
| 46 |
| 47 # wrap the public key |
| 48 vbutil_key \ |
| 49 --pack "${base}.vbpubk" \ |
| 50 --key "${base}_${len}.keyb" \ |
| 51 --version 1 \ |
| 52 --algorithm $alg |
| 53 |
| 54 # wrap the private key |
| 55 vbutil_key \ |
| 56 --pack "${base}.vbprivk" \ |
| 57 --key "${base}_${len}.pem" \ |
| 58 --algorithm $alg |
| 59 |
| 60 # remove intermediate files |
| 61 rm -f "${base}_${len}.pem" "${base}_${len}.crt" "${base}_${len}.keyb" |
| 62 } |
| 63 |
| 64 |
| 65 # Emit a .keyblock containing flags and a public key, signed by a private key |
| 66 # flags are the bitwise OR of these (passed in decimal, though) |
| 67 # 0x01 Developer switch off |
| 68 # 0x02 Developer switch on |
| 69 # 0x04 Not recovery mode |
| 70 # 0x08 Recovery mode |
| 71 function make_keyblock { |
| 72 local base=$1 |
| 73 local flags=$2 |
| 74 local pubkey=$3 |
| 75 local signkey=$4 |
| 76 |
| 77 echo "creating $base keyblock..." |
| 78 |
| 79 # create it |
| 80 vbutil_keyblock \ |
| 81 --pack "${base}.keyblock" \ |
| 82 --flags $flags \ |
| 83 --datapubkey "${pubkey}.vbpubk" \ |
| 84 --signprivate "${signkey}.vbprivk" |
| 85 |
| 86 # verify it |
| 87 vbutil_keyblock \ |
| 88 --unpack "${base}.keyblock" \ |
| 89 --signpubkey "${signkey}.vbpubk" |
| 90 } |
| 91 |
| 92 |
OLD | NEW |