diff options
Diffstat (limited to 'doc/uImage.FIT/signature.txt')
| -rw-r--r-- | doc/uImage.FIT/signature.txt | 37 |
1 files changed, 33 insertions, 4 deletions
diff --git a/doc/uImage.FIT/signature.txt b/doc/uImage.FIT/signature.txt index 78b59e7203..c9b1802686 100644 --- a/doc/uImage.FIT/signature.txt +++ b/doc/uImage.FIT/signature.txt @@ -388,8 +388,8 @@ Test Verified Boot Run: signed config with bad hash: OK Test passed -Hardware Signing with PKCS#11 ------------------------------ +Hardware Signing with PKCS#11 or with HSM +----------------------------------------- Securely managing private signing keys can challenging, especially when the keys are stored on the file system of a computer that is connected to the @@ -402,14 +402,43 @@ them perform the signing. PKCS#11 is standard for interfacing with these crypto device. Requirements: -Smartcard/USB token/HSM which can work with the pkcs11 engine +Smartcard/USB token/HSM which can work with some openssl engine openssl + +For pkcs11 engine usage: libp11 (provides pkcs11 engine) p11-kit (recommended to simplify setup) opensc (for smartcards and smartcard like USB devices) gnutls (recommended for key generation, p11tool) -The following examples use the Nitrokey Pro. Instructions for other devices may vary. +For generic HSMs respective openssl engine must be installed and locateable by +openssl. This may require setting up LD_LIBRARY_PATH if engine is not installed +to openssl's default search paths. + +PKCS11 engine support forms "key id" based on "keydir" and with +"key-name-hint". "key-name-hint" is used as "object" name and "keydir" if +defined is used to define (prefix for) which PKCS11 source is being used for +lookup up for the key. + +PKCS11 engine key ids: + "pkcs11:<keydir>;object=<key-name-hint>;type=<public|private>" +or + "pkcs11:object=<key-name-hint>;type=<public|private>", + +Generic HSM engine support forms "key id" based on "keydir" and with +"key-name-hint". If "keydir" is specified for mkimage it is used as a prefix in +"key id" and is appended with "key-name-hint". + +Generic engine key ids: + "<keydir><key-name-hint>" +or + "<key-name-hint>" + +As mkimage does not at this time support prompting for passwords HSM may need +key preloading wrapper to be used when invoking mkimage. + +The following examples use the Nitrokey Pro using pkcs11 engine. Instructions +for other devices may vary. Notes on pkcs11 engine setup: |