To create a file signature:
- The vendor generates a public and private RSA key pair, supported: RSA 128 or 256 bytes, the generated files are of public.pem and private.pem.
- A known CA creates a signed certificate which contains the public key.
- The subject name of the certificate must contain the CN (common name) field.
- Using the private key, the file digital signature is generated. The signature is a standard digital signature; the algorithm first calculates the SHA of the file content and then the SHA result is encrypted using the private key. The supported signature types are: PKCS#1, RSA 256 or 128 bytes, SHA_1 (the signature length is 256 or 128 bytes). The signature for the file can be created by standard tools, or by the UniFlash Image Creator tool (using the private key).
- The close function receives the file signature as an input, and the signed certificate (in DER encoding).
Notes:
- All the chained certificates should exist in the SFLASH when the close function is called.
- The supported encoding for the certificate files is DER.
- After an updated service pack is used, the firmware supports additional certificate chain verification types:
- The signed certificates filename should be created in the device with the name as it appears under the “issued to” property of the certificate (the exact name should be given).
- The trusted root-certificate catalog delivered by TI contains the list of supported and revoked certificates. For a list of supported CAs, see the security application document.
Example for secure-signed files close function:
_i32 FileHdl;
_i16 Status;
const _u8 CeritificateFileName[180];
const _u8 Signature[256];
const _u32 SignatureLen;
SignatureLen = sizeof(Signature);
Status = sl_FsClose(FileHdl, CeritificateFileName, Signature, SignatureLen);
if( Status < 0 )
{
/* error */
/* abort */
sl_FsClose(FileHdl,0,'A',1);
}