bugGNU GRUB - Bugs: bug #38620, RSA is not supported


You are not allowed to post comments on this tracker with your current authentication level.

bug #38620: RSA is not supported

Submitted by:  Wei Hu <whu>
Submitted on:  Thu 28 Mar 2013 11:30:52 PM UTC  
Category:  Security Severity:  Minor
Priority:  1 - Later Item Group:  Feature Request
Status:  Fixed Privacy:  Public
Assigned to:  None Originator Name:  wei hu
Open/Closed:  Closed Release: 
Release:  1.97 Reproducibility:  Every Time
Planned Release:  None

Sun 31 Mar 2013 12:24:00 PM UTC, comment #1:

You haven't read the description that only DSA is supported. Your key is RSA.

Vladimir Serbinenko <phcoder>
Project Administrator
Thu 28 Mar 2013 11:30:52 PM UTC, original submission:

I am trying to use the grub verify module to verify a detached signature I signed using gpg on Linux. I did two different signings. Both of them failed, but at the different places in grub_verify_signature(). I am wonder if I did something wrong or the module has some bugs in it. Let me detail my procedure here. The text file, signature file and my public key are all attached.

Signing Approach 1

On my Ubuntu system, say I want to detached sign myfile.txt

> gpg --detach-sign myfile.txt

It creates the signature file myfile.txt.sig. I noticed it uses ripemd160 hash algorithm. Then I export my public key as

> gpg --output my.pubkey --export 'whu@moka5.com'

The my.pubkey file contains my public key. Then I create a grub rescue cd image with all these three file myfile.txt myfile.txt.sig and my.pubkey.

> grub-mkrescue -o image.iso ./myfile.txt ./myfile.txt.sig ./my.pubkey

After this, I booted the image and at the grub prompt I did

grub > verify_detached /myfile.txt /myfile.txt.sig /my.pubkey

It returns bad signature in grub_verify_signature() after following line:
hash->final (context);
grub_dprintf ("crypt", "aliven");
hval = hash->read (context);
if (grub_file_read (sig, hash_start, sizeof (hash_start)) != sizeof (hash_start))
return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));
if (grub_memcmp (hval, hash_start, sizeof (hash_start)) != 0)
return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature")); <-- - failed here

My understanding is it calls ripemd160 algorithm to verify a two byte hash value and it failed. So I try to change the algorithm using in gpg for hashing as follows:

Signing Approch 2

I just sign the myfile.txt with sha512 like this:

> gpg --digest-algo sha512 --detach-sign myfile.txt

It creates a myfile.txt.sig file. Then a created the iso image and boot just as in approach 1.

grub > verify_detached /myfile.txt /myfile.txt.sig /my.pubkey

This time I went much further in grub_verify_signature(). It seem failed at last when calling dsa verify routine:

unsigned nbits = gcry_mpi_get_nbits (sk->mpis[1]);
grub_dprintf ("crypt", "must be %u bits got %d bitsn", nbits,
(int)(8 * hash->mdlen)); <---- Here debug output is: must be 17 bits got 512 bits
if (!grub_crypto_pk_dsa)
return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("module `%s' isn't loaded"), "gcry_dsa");
if (grub_crypto_pk_dsa->verify (0, hmpi, mpis, sk->mpis, 0, 0)) <------ failed here.
return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));

So I guess I was not doing right somewhere? Have you tested this verification module? The grub_dprintf() output (expecting 17bits but got 512 bits) is very suspicious.

For this Verify module to work, what tool and what procedure should I follow to sign a file?

Wei Hu <whu>


Attached Files
file #27706:  my.pubkey added by whu (1KiB - application/octet-stream)
file #27707:  myfile.txt added by whu (17B - text/plain)
file #27708:  myfile.txt.ripemd160.sig added by whu (287B - application/octet-stream)
file #27709:  myfile.txt.sha512.sig added by whu (287B - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by phcoder (Posted a comment)
  • -email is unavailable- added by whu (Submitted the item)
  • -email is unavailable- added by whu

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 11 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-11-03 phcoder StatusNone => Fixed
        Open/ClosedOpen => Closed
    2013-03-31 phcoder SeverityMajor => Minor
        Priority5 - Normal => 1 - Later
        Item GroupSoftware Error => Feature Request
        SummaryUnable to verify a signature using Verify module in grub => RSA is not supported
    2013-03-28 whu Attached File- => Added my.pubkey, #27706
        Attached File- => Added myfile.txt, #27707
        Attached File- => Added myfile.txt.ripemd160.sig, #27708
        Attached File- => Added myfile.txt.sha512.sig, #27709
        Carbon-Copy- => Added -email is unavailable-

    Back to the top

    Powered by Savane 3.3