bugGNU GRUB - Bugs: bug #38620, RSA is not supported

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #38620: RSA is not supported

Submitter:  Wei Hu <whu>
Submitted:  Thu 28 Mar 2013 11:30:52 PM UTC
   
 
Category:  Security Severity:  Minor
Priority:  1 - Later Item Group:  Feature Request
Status:  Fixed Privacy:  Public
Assigned to:  None Originator Name:  wei hu
Open/Closed:  Closed Release:  1.97
Release:  Reproducibility:  Every Time
Planned Release:  None

Sun 31 Mar 2013 12:24:00 PM UTC, comment #1: 

You haven't read the description that only DSA is supported. Your key is RSA.

Vladimir Serbinenko <phcoder>
Group administrator
Thu 28 Mar 2013 11:30:52 PM UTC, original submission:  

I am trying to use the grub verify module to verify a detached signature I signed using gpg on Linux. I did two different signings. Both of them failed, but at the different places in grub_verify_signature(). I am wonder if I did something wrong or the module has some bugs in it. Let me detail my procedure here. The text file, signature file and my public key are all attached.

Signing Approach 1
-----------------------

On my Ubuntu system, say I want to detached sign myfile.txt

> gpg --detach-sign myfile.txt


It creates the signature file myfile.txt.sig. I noticed it uses ripemd160 hash algorithm. Then I export my public key as

> gpg --output my.pubkey --export 'whu@moka5.com'


The my.pubkey file contains my public key.  Then I create a grub rescue cd image with all these three file myfile.txt myfile.txt.sig and my.pubkey.

> grub-mkrescue -o image.iso ./myfile.txt ./myfile.txt.sig ./my.pubkey


After this, I booted the image and at the grub prompt I did

grub > verify_detached /myfile.txt /myfile.txt.sig /my.pubkey

It returns bad signature in grub_verify_signature() after following line:
   ...
    hash->final (context);
    grub_dprintf ("crypt", "aliven");
    hval = hash->read (context);
    if (grub_file_read (sig, hash_start, sizeof (hash_start)) != sizeof (hash_start))
         return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));    
    if (grub_memcmp (hval, hash_start, sizeof (hash_start)) != 0)
      return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));         <-- - failed here

My understanding is it calls ripemd160 algorithm to verify a two byte hash value and it failed. So I try to change the algorithm using in gpg for hashing as follows:

Signing Approch 2
---------------------

I just sign the myfile.txt with sha512 like this:

> gpg --digest-algo sha512 --detach-sign myfile.txt


It creates a myfile.txt.sig file. Then a created the iso image and boot just as in approach 1.

grub > verify_detached /myfile.txt /myfile.txt.sig /my.pubkey

This time I went much further in grub_verify_signature(). It seem failed at last when calling dsa verify routine:

    unsigned nbits = gcry_mpi_get_nbits (sk->mpis[1]);
    grub_dprintf ("crypt", "must be %u bits got %d bitsn", nbits,
                  (int)(8 * hash->mdlen));                                                   <---- Here debug output is: must be 17 bits got 512 bits
   ....
    if (!grub_crypto_pk_dsa)
      return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("module `%s' isn't loaded"), "gcry_dsa");
    if (grub_crypto_pk_dsa->verify (0, hmpi, mpis, sk->mpis, 0, 0))                                 <------ failed here.
      return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));                         

So I guess I was not doing right somewhere? Have you tested this verification module? The grub_dprintf() output (expecting 17bits but got 512 bits) is very suspicious.

For this Verify module to work, what tool and what procedure should I follow to sign a file?

Wei Hu <whu>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #27706:  my.pubkey added by whu (1KiB - application/octet-stream)
file #27707:  myfile.txt added by whu (17B - text/plain)
file #27708:  myfile.txt.ripemd160.sig added by whu (287B - application/octet-stream)
file #27709:  myfile.txt.sha512.sig added by whu (287B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by phcoder (Posted a comment)
  • -email is unavailable- added by whu (Submitted the item)
  • -email is unavailable- added by whu
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 11 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-11-03 phcoder StatusNone Fixed
        Open/ClosedOpen Closed
    2013-03-31 phcoder SeverityMajor Minor
        Priority5 - Normal 1 - Later
        Item GroupSoftware Error Feature Request
        SummaryUnable to verify a signature using Verify module in grub RSA is not supported
    2013-03-28 whu Attached File- Added my.pubkey, #27706
        Attached File- Added myfile.txt, #27707
        Attached File- Added myfile.txt.ripemd160.sig, #27708
        Attached File- Added myfile.txt.sha512.sig, #27709
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code