Re: [RFD] linux-firmware key arrangement for firmware signing

[Woodhouse, David]

On Thu, 2015-05-21 at 08:45 -0700, Greg Kroah-Hartman wrote:
> On Thu, May 21, 2015 at 09:05:21AM -0400, Mimi Zohar wrote:
> > Signatures don't provide any guarantees as to code quality or
> > correctness.   They do provide file integrity and provenance.  In
> > addition to the license and a Signed-off-by line, having the 
> > firmware provider include a signature of the firmware would be 
> > nice.
> 
> That would be "nice", but that's not going to be happening here, from
> what I can tell.  The firmware provider should be putting the signature
> inside the firmware image itself, and verifying it on the device, in
> order to properly "know" that it should be running that firmware.  The
> kernel shouldn't be involved here at all, as Alan pointed out.

In a lot of cases we have loadable firmware precisely to allow us to
reduce the cost of the hardware. Adding cryptographic capability in the
'load firmware' state of the device isn't really compatible with that
:)

In the case where kernel and modules are signed, it *is* useful for a
kernel device driver also to be able to validate that what it's about
to load into a device is authentic. Where 'authentic' will originally
just mean that it's come from the linux-firmware.git repository or the
same entity that built (and signed) the kernel, but actually I *do*
expect vendors who are actively maintaining the firmware images in
linux-firmware.git to start providing detached signatures of their own.

-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@xxxxxxxxx                              Intel Corporation

Attachment: smime.p7s
Description: S/MIME cryptographic signature