summaryrefslogtreecommitdiff
path: root/Kconfig
diff options
context:
space:
mode:
authorReuben Dowle <reubendowle0@gmail.com>2020-04-16 17:36:52 +1200
committerTom Rini <trini@konsulko.com>2020-06-12 13:14:07 -0400
commitd16b38f42704fe3cc94fbee1601be96045013151 (patch)
treeabd95e88387701d92c5319565ed4a6aaf9c02a1b /Kconfig
parentf191f3a1027ede56e2501920e3e8a8acd7033e77 (diff)
Add support for SHA384 and SHA512
The current recommendation for best security practice from the US government is to use SHA384 for TOP SECRET [1]. This patch adds support for SHA384 and SHA512 in the hash command, and also allows FIT images to be hashed with these algorithms, and signed with sha384,rsaXXXX and sha512,rsaXXXX The SHA implementation is adapted from the linux kernel implementation. [1] Commercial National Security Algorithm Suite http://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite.cfm Signed-off-by: Reuben Dowle <reuben.dowle@4rf.com>
Diffstat (limited to 'Kconfig')
-rw-r--r--Kconfig26
1 files changed, 20 insertions, 6 deletions
diff --git a/Kconfig b/Kconfig
index 0e7ccc0b07..34a88ebe34 100644
--- a/Kconfig
+++ b/Kconfig
@@ -358,12 +358,26 @@ config FIT_ENABLE_SHA256_SUPPORT
help
Enable this to support SHA256 checksum of FIT image contents. A
SHA256 checksum is a 256-bit (32-byte) hash value used to check that
- the image contents have not been corrupted. SHA256 is recommended
- for use in secure applications since (as at 2016) there is no known
- feasible attack that could produce a 'collision' with differing
- input data. Use this for the highest security. Note that only the
- SHA256 variant is supported: SHA512 and others are not currently
- supported in U-Boot.
+ the image contents have not been corrupted.
+
+config FIT_ENABLE_SHA384_SUPPORT
+ bool "Support SHA384 checksum of FIT image contents"
+ default n
+ select SHA384
+ help
+ Enable this to support SHA384 checksum of FIT image contents. A
+ SHA384 checksum is a 384-bit (48-byte) hash value used to check that
+ the image contents have not been corrupted. Use this for the highest
+ security.
+
+config FIT_ENABLE_SHA512_SUPPORT
+ bool "Support SHA512 checksum of FIT image contents"
+ default n
+ select SHA512
+ help
+ Enable this to support SHA512 checksum of FIT image contents. A
+ SHA512 checksum is a 512-bit (64-byte) hash value used to check that
+ the image contents have not been corrupted.
config FIT_SIGNATURE
bool "Enable signature verification of FIT uImages"