Re: [Ksummit-discuss] [TECH TOPIC] Firmware signing

[David Howells <dhowells@redhat.com>]

David Woodhouse <dwmw2@infradead.org> wrote:

> No. Just use a *hash* of the acceptable signing cert(s)¹. Note that the
> SKID is *usually* a hash of the public key, but isn't guaranteed to be
> so, so using the SKID to specify the acceptable signing cert isn't
> secure.

True.  That's one of the reasons I don't like SKIDs - the specification is
very vague and non-enforcing.  We would need a 'standard' for how to hash the
public key data.  Some types of public key, for example, have more than one
integer.  I wonder if we could just take the PGP method as the standard -
though that does require extra elements.

> The actual signing cert doesn't need to be present in full because we
> can require it to be present in the PKCS#7 signature.

True.  I suppose for firmware this might not be so bad since any particular
public key isn't going to sign all that many blobs, so having duplicates
wouldn't take up all that much space.

David