bugGNU GRUB - Bugs: bug #38620, RSA is not supported

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #38620: RSA is not supported

Submitted by:  Wei Hu <whu>
Submitted on:  Thu 28 Mar 2013 11:30:52 PM UTC  
 
Category: SecuritySeverity: Minor
Priority: 1 - LaterItem Group: Feature Request
Status: FixedPrivacy: Public
Assigned to: NoneOriginator Name: wei hu
Open/Closed: ClosedRelease: 
Release: 1.97Reproducibility: Every Time
Planned Release: None

Sun 31 Mar 2013 12:24:00 PM UTC, comment #1:

You haven't read the description that only DSA is supported. Your key is RSA.

Vladimir Serbinenko <phcoder>
Project Administrator
Thu 28 Mar 2013 11:30:52 PM UTC, original submission:

I am trying to use the grub verify module to verify a detached signature I signed using gpg on Linux. I did two different signings. Both of them failed, but at the different places in grub_verify_signature(). I am wonder if I did something wrong or the module has some bugs in it. Let me detail my procedure here. The text file, signature file and my public key are all attached.

Signing Approach 1
-----------------------

On my Ubuntu system, say I want to detached sign myfile.txt

> gpg --detach-sign myfile.txt


It creates the signature file myfile.txt.sig. I noticed it uses ripemd160 hash algorithm. Then I export my public key as

> gpg --output my.pubkey --export 'whu@moka5.com'


The my.pubkey file contains my public key. Then I create a grub rescue cd image with all these three file myfile.txt myfile.txt.sig and my.pubkey.

> grub-mkrescue -o image.iso ./myfile.txt ./myfile.txt.sig ./my.pubkey


After this, I booted the image and at the grub prompt I did

grub > verify_detached /myfile.txt /myfile.txt.sig /my.pubkey

It returns bad signature in grub_verify_signature() after following line:
...
hash->final (context);
grub_dprintf ("crypt", "aliven");
hval = hash->read (context);
if (grub_file_read (sig, hash_start, sizeof (hash_start)) != sizeof (hash_start))
return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));
if (grub_memcmp (hval, hash_start, sizeof (hash_start)) != 0)
return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature")); <-- - failed here

My understanding is it calls ripemd160 algorithm to verify a two byte hash value and it failed. So I try to change the algorithm using in gpg for hashing as follows:

Signing Approch 2
---------------------

I just sign the myfile.txt with sha512 like this:

> gpg --digest-algo sha512 --detach-sign myfile.txt


It creates a myfile.txt.sig file. Then a created the iso image and boot just as in approach 1.

grub > verify_detached /myfile.txt /myfile.txt.sig /my.pubkey

This time I went much further in grub_verify_signature(). It seem failed at last when calling dsa verify routine:

unsigned nbits = gcry_mpi_get_nbits (sk->mpis[1]);
grub_dprintf ("crypt", "must be %u bits got %d bitsn", nbits,
(int)(8 * hash->mdlen)); <---- Here debug output is: must be 17 bits got 512 bits
....
if (!grub_crypto_pk_dsa)
return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("module `%s' isn't loaded"), "gcry_dsa");
if (grub_crypto_pk_dsa->verify (0, hmpi, mpis, sk->mpis, 0, 0)) <------ failed here.
return grub_error (GRUB_ERR_BAD_SIGNATURE, N_("bad signature"));

So I guess I was not doing right somewhere? Have you tested this verification module? The grub_dprintf() output (expecting 17bits but got 512 bits) is very suspicious.

For this Verify module to work, what tool and what procedure should I follow to sign a file?

Wei Hu <whu>

 

Attached Files
file #27706:  my.pubkey added by whu (1kB - application/octet-stream)
file #27707:  myfile.txt added by whu (17B - text/plain)
file #27708:  myfile.txt.ripemd160.sig added by whu (287B - application/octet-stream)
file #27709:  myfile.txt.sha512.sig added by whu (287B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by phcoder (Posted a comment)
  • -unavailable- added by whu (Submitted the item)
  • -unavailable- added by whu
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 11 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 03 Nov 2013 05:58:54 PM UTCphcoderStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Sun 31 Mar 2013 12:26:30 PM UTCphcoderSeverityMajor=>Minor
      Priority5 - Normal=>1 - Later
      Item GroupSoftware Error=>Feature Request
      SummaryUnable to verify a signature using Verify module in grub=>RSA is not supported
    Thu 28 Mar 2013 11:30:52 PM UTCwhuAttached File-=>Added my.pubkey, #27706
      Attached File-=>Added myfile.txt, #27707
      Attached File-=>Added myfile.txt.ripemd160.sig, #27708
      Attached File-=>Added myfile.txt.sha512.sig, #27709
      Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup