feat(secureboot): configurable signing key size (2048 default, 4096 opt-in)#172
Merged
Conversation
…pt-in) Add Options.KeyBits to internal/secureboot so callers can opt into a 4096-bit RSA key for the Secure Boot db certificate instead of the 2048-bit default. Only 2048 and 4096 are accepted; any other size is rejected with a clear error. Expose this as --bits on cryptos-sbkey (default 2048). Selecting a non-default size prints a warning to stderr: not every firmware implementation accepts RSA-4096 in db, and a key the firmware won't load means the signed image won't boot. Update docs/secure-boot.md to cover the flag and the warning. Closes #171
An unsupported --bits value is rejected by secureboot.Generate, so emitting the firmware-compat warning for it first was misleading. Gate the warning on the one valid opt-in size (4096).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
The Secure Boot signing key was hardcoded to RSA-2048. That stays the
default (the UEFI spec mandates RSA-2048 PKCS#1 v1.5 for db image
authentication, and ECDSA in db is inconsistent across firmware), but an
operator who knows their firmware accepts RSA-4096 can now opt into a
stronger key for this long-lived (~10-year) db certificate.
secureboot.OptionsgainsKeyBits; zero means the 2048 default.{2048, 4096}are accepted; any other size returns an error.cryptos-sbkeyexposes--bits(default 2048).accepts RSA-2048 in db, and a key the firmware won't load means the
signed image won't boot.
docs/secure-boot.mddocuments the flag and the warning.Closes #171
Verification
How this was verified
go test ./internal/secureboot/... ./cmd/cryptos-sbkey/...- all green,including new subtests for KeyBits 0 (default), 2048, 4096, and the
rejected sizes 3072 and 1024.
task ci(fmt, lint, vet, test, build) - passes clean, 0 lint issues.task license- 0/208 files changed, all headers already present.