Q&A: Does code signing tool with "CST -h" take much time?

Document created by Yixing Kong Employee on Nov 15, 2013Last modified by Yixing Kong Employee on Nov 18, 2013
Version 2Show Document
  • View in full screen mode

Question:

The code signing tool(CST) of i.MX6 with "CST -h" command just for viewing help message took about 22 minutes.

On other system, it was shorter but still took about 2 minutes. CST version is BLN_CST_MAIN_02.00.00.

 

More test results:
1. Print help message => 4 min.

dnlk@bauer-mm2014:~/secureboot/bBLN_CST_MAIN_02.00.00/linux$ date && ./cst --help && date

Fri Oct 18 14:10:52 KST 2013

Fri Oct 18 14:15:01 KST 2013

2. Signing 512MB file => 11 min.

dnlk@bauer-mm2014:~/secureboot/bBLN_CST_MAIN_02.00.00/linux$ date && ./cst --output "out_system.csf" < "example_system.csf" && date

Fri Oct 18 14:15:01 KST 2013

CSF Processed successfully and signed data available in out_system.csf

Fri Oct 18 14:25:47 KST 2013

3. Signing 3MB file => 17 min.

dnlk@bauer-mm2014:~/secureboot/bBLN_CST_MAIN_02.00.00/linux$ date && ./cst --output "out_kernel.csf" < "example_kernel.csf" && date

Fri Oct 18 14:25:47 KST 2013

CSF Processed successfully and signed data available in out_kernel.csf

Fri Oct 18 14:42:39 KST 2013

4. Signing 160KB file => 2 min.

dnlk@bauer-mm2014:~/secureboot/bBLN_CST_MAIN_02.00.00/linux$ date && ./cst --output "out_uboot.csf" < "example_uboot.csf" && date

Fri Oct 18 14:42:39 KST 2013

CSF Processed successfully and signed data available in out_uboot.csf

Fri Oct 18 14:45:05 KST 2013

 

Answer:
The slow performance is caused by lack of entropy source and it takes long time to initialize random number generator. Check amount of entropy  "cat /proc/sys/kernel/random/entropy_avail"

 

Tried to install package rng-tools.

1. $sudo apt-get install rng-tools

2. add the following settings in /etc/default/rng-tools

HRNGDEVICE=/dev/urandom

RNGDOPTIONS=”-W 90% -t 1?

3. sudo /etc/init.d/rng-tools restart

4. cat /proc/sys/kernel/random/entropy_avail

After rng-tools starts, entropy increases from less than 100 to more than 1000, then command ./cst -h can run very smoothly.

1 person found this helpful

Attachments

    Outcomes