tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
audk/IntelFsp2Pkg/Tools/ConfigEditor/SingleSign.py

325 lines
10 KiB
Python
Raw Blame History

#!/usr/bin/env python
# @ SingleSign.py
# Single signing script
#
# Copyright (c) 2020 - 2021, Intel Corporation. All rights reserved.<BR>
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
import os
import sys
import re
import shutil
import subprocess
SIGNING_KEY = {
# Key Id | Key File Name start |
# =================================================================
# KEY_ID_MASTER is used for signing Slimboot Key Hash Manifest \
# container (KEYH Component)
"KEY_ID_MASTER_RSA2048": "MasterTestKey_Priv_RSA2048.pem",
"KEY_ID_MASTER_RSA3072": "MasterTestKey_Priv_RSA3072.pem",
# KEY_ID_CFGDATA is used for signing external Config data blob)
"KEY_ID_CFGDATA_RSA2048": "ConfigTestKey_Priv_RSA2048.pem",
"KEY_ID_CFGDATA_RSA3072": "ConfigTestKey_Priv_RSA3072.pem",
# KEY_ID_FIRMWAREUPDATE is used for signing capsule firmware update image)
"KEY_ID_FIRMWAREUPDATE_RSA2048": "FirmwareUpdateTestKey_Priv_RSA2048.pem",
"KEY_ID_FIRMWAREUPDATE_RSA3072": "FirmwareUpdateTestKey_Priv_RSA3072.pem",
# KEY_ID_CONTAINER is used for signing container header with mono signature
"KEY_ID_CONTAINER_RSA2048": "ContainerTestKey_Priv_RSA2048.pem",
"KEY_ID_CONTAINER_RSA3072": "ContainerTestKey_Priv_RSA3072.pem",
# CONTAINER_COMP1_KEY_ID is used for signing container components
"KEY_ID_CONTAINER_COMP_RSA2048": "ContainerCompTestKey_Priv_RSA2048.pem",
"KEY_ID_CONTAINER_COMP_RSA3072": "ContainerCompTestKey_Priv_RSA3072.pem",
# KEY_ID_OS1_PUBLIC, KEY_ID_OS2_PUBLIC is used for referencing \
# Boot OS public keys
"KEY_ID_OS1_PUBLIC_RSA2048": "OS1_TestKey_Pub_RSA2048.pem",
"KEY_ID_OS1_PUBLIC_RSA3072": "OS1_TestKey_Pub_RSA3072.pem",
"KEY_ID_OS2_PUBLIC_RSA2048": "OS2_TestKey_Pub_RSA2048.pem",
"KEY_ID_OS2_PUBLIC_RSA3072": "OS2_TestKey_Pub_RSA3072.pem",
}
MESSAGE_SBL_KEY_DIR = """!!! PRE-REQUISITE: Path to SBL_KEY_DIR has.
to be set with SBL KEYS DIRECTORY !!! \n!!! Generate keys.
using GenerateKeys.py available in BootloaderCorePkg/Tools.
directory !!! \n !!! Run $python.
BootloaderCorePkg/Tools/GenerateKeys.py -k $PATH_TO_SBL_KEY_DIR !!!\n
!!! Set SBL_KEY_DIR environ with path to SBL KEYS DIR !!!\n"
!!! Windows $set SBL_KEY_DIR=$PATH_TO_SBL_KEY_DIR !!!\n
!!! Linux $export SBL_KEY_DIR=$PATH_TO_SBL_KEY_DIR !!!\n"""
def get_openssl_path():
if os.name == 'nt':
if 'OPENSSL_PATH' not in os.environ:
openssl_dir = "C:\\Openssl\\bin\\"
if os.path.exists(openssl_dir):
os.environ['OPENSSL_PATH'] = openssl_dir
else:
os.environ['OPENSSL_PATH'] = "C:\\Openssl\\"
if 'OPENSSL_CONF' not in os.environ:
openssl_cfg = "C:\\Openssl\\openssl.cfg"
if os.path.exists(openssl_cfg):
os.environ['OPENSSL_CONF'] = openssl_cfg
openssl = os.path.join(
os.environ.get('OPENSSL_PATH', ''),
'openssl.exe')
else:
# Get openssl path for Linux cases
openssl = shutil.which('openssl')
return openssl
def run_process(arg_list, print_cmd=False, capture_out=False):
sys.stdout.flush()
if print_cmd:
print(' '.join(arg_list))
exc = None
result = 0
output = ''
try:
if capture_out:
output = subprocess.check_output(arg_list).decode()
else:
result = subprocess.call(arg_list)
except Exception as ex:
result = 1
exc = ex
if result:
if not print_cmd:
print('Error in running process:\n %s' % ' '.join(arg_list))
if exc is None:
sys.exit(1)
else:
raise exc
return output
def check_file_pem_format(priv_key):
# Check for file .pem format
key_name = os.path.basename(priv_key)
if os.path.splitext(key_name)[1] == ".pem":
return True
else:
return False
def get_key_id(priv_key):
# Extract base name if path is provided.
key_name = os.path.basename(priv_key)
# Check for KEY_ID in key naming.
if key_name.startswith('KEY_ID'):
return key_name
else:
return None
def get_sbl_key_dir():
# Check Key store setting SBL_KEY_DIR path
if 'SBL_KEY_DIR' not in os.environ:
exception_string = "ERROR: SBL_KEY_DIR is not defined." \
" Set SBL_KEY_DIR with SBL Keys directory!!\n"
raise Exception(exception_string + MESSAGE_SBL_KEY_DIR)
sbl_key_dir = os.environ.get('SBL_KEY_DIR')
if not os.path.exists(sbl_key_dir):
exception_string = "ERROR:SBL_KEY_DIR set " + sbl_key_dir \
+ " is not valid." \
" Set the correct SBL_KEY_DIR path !!\n" \
+ MESSAGE_SBL_KEY_DIR
raise Exception(exception_string)
else:
return sbl_key_dir
def get_key_from_store(in_key):
# Check in_key is path to key
if os.path.exists(in_key):
return in_key
# Get Slimboot key dir path
sbl_key_dir = get_sbl_key_dir()
# Extract if in_key is key_id
priv_key = get_key_id(in_key)
if priv_key is not None:
if (priv_key in SIGNING_KEY):
# Generate key file name from key id
priv_key_file = SIGNING_KEY[priv_key]
else:
exception_string = "KEY_ID" + priv_key + "is not found " \
"is not found in supported KEY IDs!!"
raise Exception(exception_string)
elif check_file_pem_format(in_key):
# check if file name is provided in pem format
priv_key_file = in_key
else:
priv_key_file = None
raise Exception('key provided %s is not valid!' % in_key)
# Create a file path
# Join Key Dir and priv_key_file
try:
priv_key = os.path.join(sbl_key_dir, priv_key_file)
except Exception:
raise Exception('priv_key is not found %s!' % priv_key)
# Check for priv_key construted based on KEY ID exists in specified path
if not os.path.isfile(priv_key):
exception_string = "!!! ERROR: Key file corresponding to" \
+ in_key + "do not exist in Sbl key " \
"directory at" + sbl_key_dir + "!!! \n" \
+ MESSAGE_SBL_KEY_DIR
raise Exception(exception_string)
return priv_key
#
# Sign an file using openssl
#
# priv_key [Input] Key Id or Path to Private key
# hash_type [Input] Signing hash
# sign_scheme[Input] Sign/padding scheme
# in_file [Input] Input file to be signed
# out_file [Input/Output] Signed data file
#
def single_sign_file(priv_key, hash_type, sign_scheme, in_file, out_file):
_hash_type_string = {
"SHA2_256": 'sha256',
"SHA2_384": 'sha384',
"SHA2_512": 'sha512',
}
_hash_digest_Size = {
# Hash_string : Hash_Size
"SHA2_256": 32,
"SHA2_384": 48,
"SHA2_512": 64,
"SM3_256": 32,
}
_sign_scheme_string = {
"RSA_PKCS1": 'pkcs1',
"RSA_PSS": 'pss',
}
priv_key = get_key_from_store(priv_key)
# Temporary files to store hash generated
hash_file_tmp = out_file+'.hash.tmp'
hash_file = out_file+'.hash'
# Generate hash using openssl dgst in hex format
cmdargs = [get_openssl_path(),
'dgst',
'-'+'%s' % _hash_type_string[hash_type],
'-out', '%s' % hash_file_tmp, '%s' % in_file]
run_process(cmdargs)
# Extract hash form dgst command output and convert to ascii
with open(hash_file_tmp, 'r') as fin:
hashdata = fin.read()
fin.close()
try:
hashdata = hashdata.rsplit('=', 1)[1].strip()
except Exception:
raise Exception('Hash Data not found for signing!')
if len(hashdata) != (_hash_digest_Size[hash_type] * 2):
raise Exception('Hash Data size do match with for hash type!')
hashdata_bytes = bytearray.fromhex(hashdata)
open(hash_file, 'wb').write(hashdata_bytes)
print("Key used for Singing %s !!" % priv_key)
# sign using Openssl pkeyutl
cmdargs = [get_openssl_path(),
'pkeyutl', '-sign', '-in', '%s' % hash_file,
'-inkey', '%s' % priv_key, '-out',
'%s' % out_file, '-pkeyopt',
'digest:%s' % _hash_type_string[hash_type],
'-pkeyopt', 'rsa_padding_mode:%s' %
_sign_scheme_string[sign_scheme]]
run_process(cmdargs)
return
#
# Extract public key using openssl
#
# in_key [Input] Private key or public key in pem format
# pub_key_file [Input/Output] Public Key to a file
#
# return keydata (mod, exp) in bin format
#
def single_sign_gen_pub_key(in_key, pub_key_file=None):
in_key = get_key_from_store(in_key)
# Expect key to be in PEM format
is_prv_key = False
cmdline = [get_openssl_path(), 'rsa', '-pubout', '-text', '-noout',
'-in', '%s' % in_key]
# Check if it is public key or private key
text = open(in_key, 'r').read()
if '-BEGIN RSA PRIVATE KEY-' in text:
is_prv_key = True
elif '-BEGIN PUBLIC KEY-' in text:
cmdline.extend(['-pubin'])
else:
raise Exception('Unknown key format "%s" !' % in_key)
if pub_key_file:
cmdline.extend(['-out', '%s' % pub_key_file])
capture = False
else:
capture = True
output = run_process(cmdline, capture_out=capture)
if not capture:
output = text = open(pub_key_file, 'r').read()
data = output.replace('\r', '')
data = data.replace('\n', '')
data = data.replace(' ', '')
# Extract the modulus
if is_prv_key:
match = re.search('modulus(.*)publicExponent:\\s+(\\d+)\\s+', data)
else:
match = re.search('Modulus(?:.*?):(.*)Exponent:\\s+(\\d+)\\s+', data)
if not match:
raise Exception('Public key not found!')
modulus = match.group(1).replace(':', '')
exponent = int(match.group(2))
mod = bytearray.fromhex(modulus)
# Remove the '00' from the front if the MSB is 1
if mod[0] == 0 and (mod[1] & 0x80):
mod = mod[1:]
exp = bytearray.fromhex('{:08x}'.format(exponent))
keydata = mod + exp
return keydata
Reference in New Issue View Git Blame Copy Permalink