Unable to verify some MP messages

cancel
Showing results for 
Search instead for 
Did you mean: 

Unable to verify some MP messages

226 Views
jaymonkman
Contributor I

This is on an i.MX7D, related to manufacturing protection

I have a message that when I sign it, I'm unable to verify it. The message is 220 bytes long. If I truncate it to 219 bytes or extend it to 221 bytes and sign it, I can verify the signature. If I try a different 220 byte message, that works also. The behavior I'm seeing seems to related to the particular data I'm trying to sign.

For signing, I'm using u-boot's mfgprot command. For verification, I'm using a tool I wrote. If you need the source, I can provide it.

I've include the output of signing the message as 219, 220, and 221 bytes long. I've also included the output of my verification tool. As you can see, the hashes reported by u-boot match the ones I calculated during verification.

 

Edited to add:

It's giving me some invalid HTML error, so I'm just attaching the data as a text file.

 

 

 

0 Kudos
2 Replies

213 Views
jaymonkman
Contributor I

We're seeing about 20-25% of the messages that we sign fail to verify.

On one of the messages, I've tried truncating to different sizes and some pass, some fail. The original message is 165 bytes long, I tried every size down to 1 byte and 17 of the messages fail verification. It's consistent - if a particular message fails to verify and I sign it again, the new signature will also fail to verify.

 

0 Kudos

115 Views
Yuri
NXP TechSupport
NXP TechSupport

@jaymonkman 
Hello,

  I received the information, that the issue was solved.

The problem was an issue with the verification tool where strlen() was being misused.

Regards,
Yuri.

0 Kudos