8. DATA Partition (userdata) Signing and Verification

8.1. Overview

  • Purpose：DATA Partition（JFFS2）inBurningbefore SHA256 + RSA Signature，Device before Signature Verification；Through JFFS2，Failureor Signature tmpfs， Use or Data。

  • ： payload SHA256， 32 Bytes PKCS#1 v1.5 RSA Signature（2048-bit）；Signature VerificationUse of N and e，andSignaturePrivate Key 。

  • Key：SignatureUse ramdisk/keys/test_reeos.key；Signature Verification gen_data_sig_pubkey_h.py from Private Key（or Certificate） andGenerate C File；Device OpenSSL，Use mbedTLS RSA Signature Verification。

8.2. UseandVerificationMethod

  1. menuconfig->Kernel options->Enable kernel secure boot。

  2. Execute build_all，or need make data、make rootfs：before GenerateandSignature data.spinor，after will verify_data_sig etc. rootfs。

  3. Burning will install/.../data.spinor FileWrite DATA（userdata）Partition ；ImagePath Board Variant ， Partition andBurning ToolwithBoard-levelis 。

  4. Device after， DATA PartitionExecute verify_data_sig，Signature VerificationThrough JFFS2，Failureor Signature tmpfs。

  5. inDeviceonExecute mount | grep /mnt/data ，IfOutputin jffs2， Indicates DATA Signature verification succeedsandalready JFFS2；Ifis tmpfs， IndicatesSignature Verification Throughor Signature。

8.3. Related Files

File

build/scripts/append_image_sig.py

data Image SHA256 + RSA Signatureand trailer

build/scripts/gen_data_sig_pubkey_h.py

fromKeyorCertificateGenerate verify_data_sig_key.h

build/scripts/verify_data_sig.c

Device andLocal HostSignature VerificationProgram（mbedTLS）

build/scripts/verify_data_sig_key.h

N/e（ gen_data_sig_pubkey_h.py Generate）

build/tools/common/image_tool/mkjffs2.py

JFFS2 data.spinor and trailer

build/tools/common/image_tool/create_automount.py

Generate Script（ DATA Signature Verification ）

build/Makefile

Build verify_data_sig / verify_data_sig_host， host/ARM mbedTLS