mirror of https://github.com/thesofproject/sof.git
947238ded8
New platforms like TigerLake will need 3k RSA key for signing. Generate new keys for SOF public key. Signed-off-by: Pan Xiuli <xiuli.pan@linux.intel.com> |
||
|---|---|---|
| .. | ||
| README | ||
| otc_private_key.pem | ||
| otc_private_key_3k.pem | ||
| otc_public_key.pem | ||
| otc_public_key_3k.pem | ||
README
About ===== Firmware binary signing is for audio DSP is mandatory on Intel products from Skylake onwards. i.e. no code signing on Baytrail, Cherrytrail, Braswell, Haswell and Broadwell but mandatory on Skylake, Kabylake, Apollolake, Cannonlake Icelake and Tigerlake. rimage can now sign firmware binaries for Apollolake, Cannonlake and Icelake targets. This is done automatically as part of the "make bin" part of the build. Key Pairs ========= The key included here is the Intel OTC (Opensource Technology Center) community development key. It can be freely used by anyone and is intended for reference board makers and firmware developers. ** This key is NOT intended for locking down firmware on end user production devices since the "private" key has been published here. A new key pair must be genrated for securing firmware ! ** RSA Private and Public keys are generated as follows :- For cavs 1.5-2.0 platforms, 2k key is needed with following: openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048 For cavs 2.5+ (TigerLake), 3k key is needed with following: openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:3072 openssl rsa -pubout -in private_key.pem -out public_key.pem The public key needs to be programmed into the OEM Key manifest (cavsManifest0) within the BIOS in order to verify code signed with the private key. Intel supplies tools to board makers to stitch the public key into the BIOS. The private key is used by rimage to sign the SOF binary. It should be kept secret and secure for production signing.