Lock down vendor pubkey - #35
Merged
Merged
Conversation
agren
reviewed
Jun 18, 2026
agren
left a comment
agren
left a comment
Member
There was a problem hiding this comment.
I looked through this draft PR as it is at this moment. I realize you might have already addressed some of the things I'm commenting on.
agren
approved these changes
Jun 23, 2026
agren
left a comment
agren
left a comment
Member
There was a problem hiding this comment.
I've tested on hardware and it works. Have only some minor notes.
Instead of letting anyone update the vendor pubkey on the filesystem, only update it if a signature over a digest of the new pubkey is provided. - Update the CMD_STORE_PUBKEY protocol request to: - 32 bytes pubkey - 64 bytes Ed25519 signature - Update tkey-mgt to read in both public key and signature when used with the "install-pubkey" command. - Update the boot verifier itself to compute a digest over the new pubkey and verify the Ed25519 signature before allowing the key to be updated. - Break out stuff to util.[ch]
In some cases we want the user to tap 3 times to assert presence and sometimes just one.
To be able to sign a binary public key, add -P to export to a binary file. Update usage text.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Instead of letting anyone update the vendor pubkey on the filesystem, only update it if a signature over the new pubkey is provided.
Update the CMD_STORE_PUBKEY protocol request to:
Update tkey-mgt to read in both public key and signature when used with the "install-pubkey" command.
Update the boot verifier itself to verify the Ed25519 signature before allowing the vendor public key to be updated.
Add
-Ptosign-toolto export a public key in binary form. Necessary to sign a pubkey.Tap only 1 time for vendor pubkey update since it's checked if it's verified.
NOTE WELL: So far no check is done in boot verifier when updating an app if the vendor pubkey on the filesystem will verify it. See #37
Type of change
Submission checklist