OLD | NEW |
| (Empty) |
1 #!/bin/bash | |
2 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | |
3 # Use of this source code is governed by a BSD-style license that can be | |
4 # found in the LICENSE file. | |
5 # | |
6 # Generate .vbpubk and .vbprivk pairs for use by developer builds. These should | |
7 # be exactly like the real keys except that the private keys aren't secret. | |
8 | |
9 | |
10 # 0 = (RSA1024 SHA1) | |
11 # 1 = (RSA1024 SHA256) | |
12 # 2 = (RSA1024 SHA512) | |
13 # 3 = (RSA2048 SHA1) | |
14 # 4 = (RSA2048 SHA256) | |
15 # 5 = (RSA2048 SHA512) | |
16 # 6 = (RSA4096 SHA1) | |
17 # 7 = (RSA4096 SHA256) | |
18 # 8 = (RSA4096 SHA512) | |
19 # 9 = (RSA8192 SHA1) | |
20 # 10 = (RSA8192 SHA256) | |
21 # 11 = (RSA8192 SHA512) | |
22 function alg_to_keylen { | |
23 echo $(( 1 << (10 + ($1 / 3)) )) | |
24 } | |
25 | |
26 # Emit .vbpubk and .vbprivk using given basename and algorithm | |
27 # NOTE: This function also appears in ../../utility/dev_make_keypair. Making | |
28 # the two implementations the same would require some common.sh, which is more | |
29 # likely to cause problems than just keeping an eye out for any differences. If | |
30 # you feel the need to change this file, check the history of that other file | |
31 # to see what may need updating here too. | |
32 function make_pair { | |
33 local base=$1 | |
34 local alg=$2 | |
35 local len=$(alg_to_keylen $alg) | |
36 | |
37 echo "creating $base keypair..." | |
38 | |
39 # make the RSA keypair | |
40 openssl genrsa -F4 -out "${base}_${len}.pem" $len | |
41 # create a self-signed certificate | |
42 openssl req -batch -new -x509 -key "${base}_${len}.pem" \ | |
43 -out "${base}_${len}.crt" | |
44 # generate pre-processed RSA public key | |
45 dumpRSAPublicKey -cert "${base}_${len}.crt" > "${base}_${len}.keyb" | |
46 | |
47 # wrap the public key | |
48 vbutil_key \ | |
49 --pack "${base}.vbpubk" \ | |
50 --key "${base}_${len}.keyb" \ | |
51 --version 1 \ | |
52 --algorithm $alg | |
53 | |
54 # wrap the private key | |
55 vbutil_key \ | |
56 --pack "${base}.vbprivk" \ | |
57 --key "${base}_${len}.pem" \ | |
58 --algorithm $alg | |
59 | |
60 # remove intermediate files | |
61 rm -f "${base}_${len}.pem" "${base}_${len}.crt" "${base}_${len}.keyb" | |
62 } | |
63 | |
64 | |
65 # Emit a .keyblock containing flags and a public key, signed by a private key | |
66 # flags are the bitwise OR of these (passed in decimal, though) | |
67 # 0x01 Developer switch off | |
68 # 0x02 Developer switch on | |
69 # 0x04 Not recovery mode | |
70 # 0x08 Recovery mode | |
71 function make_keyblock { | |
72 local base=$1 | |
73 local flags=$2 | |
74 local pubkey=$3 | |
75 local signkey=$4 | |
76 | |
77 echo "creating $base keyblock..." | |
78 | |
79 # create it | |
80 vbutil_keyblock \ | |
81 --pack "${base}.keyblock" \ | |
82 --flags $flags \ | |
83 --datapubkey "${pubkey}.vbpubk" \ | |
84 --signprivate "${signkey}.vbprivk" | |
85 | |
86 # verify it | |
87 vbutil_keyblock \ | |
88 --unpack "${base}.keyblock" \ | |
89 --signpubkey "${signkey}.vbpubk" | |
90 } | |
91 | |
92 | |
93 | |
94 # Create the normal keypairs | |
95 make_pair root_key 11 | |
96 make_pair firmware_data_key 7 | |
97 make_pair dev_firmware_data_key 7 | |
98 make_pair kernel_subkey 7 | |
99 make_pair kernel_data_key 4 | |
100 | |
101 # Create the recovery and factory installer keypairs | |
102 make_pair recovery_key 11 | |
103 make_pair recovery_kernel_data_key 11 | |
104 make_pair installer_kernel_data_key 11 | |
105 | |
106 # Create the firmware keyblock for use only in Normal mode. This is redundant, | |
107 # since it's never even checked during Recovery mode. | |
108 make_keyblock firmware 7 firmware_data_key root_key | |
109 | |
110 # Create the dev firmware keyblock for use only in Developer mode. | |
111 make_keyblock dev_firmware 6 dev_firmware_data_key root_key | |
112 | |
113 # Create the recovery kernel keyblock for use only in Recovery mode. | |
114 make_keyblock recovery_kernel 11 recovery_kernel_data_key recovery_key | |
115 | |
116 # Create the normal kernel keyblock for use only in Normal mode. | |
117 make_keyblock kernel 7 kernel_data_key kernel_subkey | |
118 | |
119 # Create the installer keyblock for use in Developer + Recovery mode | |
120 # For use in Factory Install and Developer Mode install shims. | |
121 make_keyblock installer_kernel 10 installer_kernel_data_key recovery_key | |
122 | |
123 # CAUTION: The public parts of most of these blobs must be compiled into the | |
124 # firmware, which is built separately (and some of which can't be changed after | |
125 # manufacturing). If you update these keys, you must coordinate the changes | |
126 # with the BIOS people or you'll be unable to boot the resulting images. | |
127 | |
OLD | NEW |