From patchwork Tue Aug 22 06:19:20 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Masahiro Yamada X-Patchwork-Id: 110612 Delivered-To: patch@linaro.org Received: by 10.140.95.78 with SMTP id h72csp2241266qge; Mon, 21 Aug 2017 23:20:22 -0700 (PDT) X-Received: by 10.80.218.76 with SMTP id a12mr13775366edk.231.1503382822624; Mon, 21 Aug 2017 23:20:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1503382822; cv=none; d=google.com; s=arc-20160816; b=EEX/uHoff8ZOoMRxoxGiaYHQWtFalvZtqOricAXXpc9Bc859nzzl7p4uQ5bQhXtCzW OEZa7YYVxlQ7QTUP/U4fyBoX6Tf49cbhRr2zeSYcieRNRQ7N0TlNiVFoiNJlxyxBpvRV D48PAUYb/3hD8w7cyegziYwf30rGyqN3nJBQkwpoT/FQ5kK/WT+xwJCFLaU9Zcz9Ww8t FtbiAhU6Rq9mOaiUYmXF/OdTIDZjGITgk6+6gJUeOJy5lN4/wKkOW0m3nVkVt0GigUYj Un3oEXYICZeSuQjLNQyGJrSv755tdN7sr4ym7G5ieifCCrLESd/5PuaZ4I8WF66mUMs0 ZtDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:date:to:from:dkim-signature :dkim-filter:arc-authentication-results; bh=yhxVALKCEAL6AP84G9aNKDU6b/s70YGJabsxaN9agUk=; b=QpMwd65gy/DFHXkWC6w6w5NMAEUlRWEqUaZM7ZytR7ledxZqlbEfA9BExD7ANXd5so GeSTBeElGLtjXy4Zno8HHyRbxGzq58mxReMKKqtAbb72apwtDATXzQrVepKd1oPDhNqY mboGH+5glypsyhzVMPZLIdMoGrByy79Z94ui3V0BXTseC3dhHpTLD3qzJkcaXtNPUyrF E7WDlaRTmnP6R8jQmlM19CoBz2ovU+NLACfHK7lowhwUdTnsMfwNjH8YwuZskDYwTnTi vHDWJpx6ZhdKCKEjtdiXsNCklYisBNKvSESTCowtVkW5eqgTItD+XHL5WeqweJAggjbv 5BQg== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@nifty.com header.s=dec2015msa header.b=kFsaH4IJ; spf=pass (google.com: best guess record for domain of u-boot-bounces@lists.denx.de designates 81.169.180.215 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de Return-Path: Received: from lists.denx.de (dione.denx.de. [81.169.180.215]) by mx.google.com with ESMTP id 10si13795739edx.197.2017.08.21.23.20.22; Mon, 21 Aug 2017 23:20:22 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of u-boot-bounces@lists.denx.de designates 81.169.180.215 as permitted sender) client-ip=81.169.180.215; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@nifty.com header.s=dec2015msa header.b=kFsaH4IJ; spf=pass (google.com: best guess record for domain of u-boot-bounces@lists.denx.de designates 81.169.180.215 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by lists.denx.de (Postfix, from userid 105) id 1BDFFC21E01; Tue, 22 Aug 2017 06:20:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=T_DKIM_INVALID autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id 4F991C21D84; Tue, 22 Aug 2017 06:20:14 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id E51F3C21D84; Tue, 22 Aug 2017 06:20:12 +0000 (UTC) Received: from conuserg-08.nifty.com (conuserg-08.nifty.com [210.131.2.75]) by lists.denx.de (Postfix) with ESMTPS id 463C4C21C26 for ; Tue, 22 Aug 2017 06:20:11 +0000 (UTC) Received: from pug.e01.socionext.com (p14092-ipngnfx01kyoto.kyoto.ocn.ne.jp [153.142.97.92]) (authenticated) by conuserg-08.nifty.com with ESMTP id v7M6JRa8004621; Tue, 22 Aug 2017 15:19:28 +0900 DKIM-Filter: OpenDKIM Filter v2.10.3 conuserg-08.nifty.com v7M6JRa8004621 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.com; s=dec2015msa; t=1503382768; bh=XYpPLEqBRjQzC2rC8Z2vOhrR6DHP4U7LmXJ8Das3Cpk=; h=From:To:Cc:Subject:Date:From; b=kFsaH4IJ6Szc56t2gBQPdMW28b9xMnCZIYYKJObUMjDxmcqJS23rG7UsmKshQkuMx UZyXdW3FDiCj7kKgq72MbuZLNMoKa33Q1jRHf/1nxn6IDC/z+GSDyUd4/ZeBXXEADb HfI909awIQ9Y7gB9KE9pjzzezoRAMNWYKkzXb+9NZWSZVgViazNg72JjbYB4/DbrmD tuvMBKAgxLuXcJmidBNjQdfFX3oqKKHYSW5ru8CHaCgHpAfN34xRkJfzTtJ3iUwDON WY7Vh05YM45V/fGvVkYDOJ/E5T4Wz69X6VHM6IYWfaJo2V7zlNgZ4PO9WCWnlgfe6h rYdIOP3X+rDAw== X-Nifty-SrcIP: [153.142.97.92] From: Masahiro Yamada To: u-boot@lists.denx.de, Simon Glass Date: Tue, 22 Aug 2017 15:19:20 +0900 Message-Id: <1503382760-27022-1-git-send-email-yamada.masahiro@socionext.com> X-Mailer: git-send-email 2.7.4 Subject: [U-Boot] [PATCH] doc: verified-boot: fix typos X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" Signed-off-by: Masahiro Yamada --- doc/uImage.FIT/signature.txt | 10 +++++----- doc/uImage.FIT/verified-boot.txt | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/doc/uImage.FIT/signature.txt b/doc/uImage.FIT/signature.txt index 7cdb7bf324c1..a57cdab33956 100644 --- a/doc/uImage.FIT/signature.txt +++ b/doc/uImage.FIT/signature.txt @@ -81,7 +81,7 @@ $ openssl rsa -in keys/dev.key -pubout Device Tree Bindings -------------------- The following properties are required in the FIT's signature node(s) to -allow thes signer to operate. These should be added to the .its file. +allow the signer to operate. These should be added to the .its file. Signature nodes sit at the same level as hash nodes and are called signature@1, signature@2, etc. @@ -150,7 +150,7 @@ all available signing keys until one matches. - required: If present this indicates that the key must be verified for the image / configuration to be considered valid. Only required keys are normally verified by the FIT image booting algorithm. Valid values are -"image" to force verification of all images, and "conf" to force verfication +"image" to force verification of all images, and "conf" to force verification of the selected configuration (which then relies on hashes in the images to verify those). @@ -242,7 +242,7 @@ configuration 3 with kernel 1 and fdt 2: With signed images, nothing protects against this. Whether it gains an advantage for the attacker is debatable, but it is not secure. -To solved this problem, we support signed configurations. In this case it +To solve this problem, we support signed configurations. In this case it is the configurations that are signed, not the image. Each image has its own hash, and we include the hash in the configuration signature. @@ -327,7 +327,7 @@ Enabling FIT Verification In addition to the options to enable FIT itself, the following CONFIGs must be enabled: -CONFIG_FIT_SIGNATURE - enable signing and verfication in FITs +CONFIG_FIT_SIGNATURE - enable signing and verification in FITs CONFIG_RSA - enable RSA algorithm for signing WARNING: When relying on signed FIT images with required signature check @@ -336,7 +336,7 @@ CONFIG_IMAGE_FORMAT_LEGACY Testing ------- -An easy way to test signing and verfication is to use the test script +An easy way to test signing and verification is to use the test script provided in test/vboot/vboot_test.sh. This uses sandbox (a special version of U-Boot which runs under Linux) to show the operation of a 'bootm' command loading and verifying images. diff --git a/doc/uImage.FIT/verified-boot.txt b/doc/uImage.FIT/verified-boot.txt index e639e7ae71a1..41c9fa9e09f9 100644 --- a/doc/uImage.FIT/verified-boot.txt +++ b/doc/uImage.FIT/verified-boot.txt @@ -93,7 +93,7 @@ include hashes to verify images, so it is relatively straightforward to add signatures as well. The public key can be stored in U-Boot's CONFIG_OF_CONTROL device tree in -a standard place. Then when a FIT it loaded it can be verified using that +a standard place. Then when a FIT is loaded it can be verified using that public key. Multiple keys and multiple signatures are supported. See signature.txt for more information.