RPI-EEPROM-DIGEST(1)

NAME
rpi-eeprom-digest - Bootloader EEPROM signature generation tool

DESCRIPTION
rpi-eeprom-digest [-k RSA_KEY] -i IMAGE -o OUTPUT

Tool to generate .sig files containing the SHA256 digest and optional RSA signature. Typically this tool is used by rpi-eeprom-update to generate a hash to guard against file-system corruption for EEPROM updates OR for signing OS images (boot.img) for secure-boot.

This tool CANNOT be used directly to sign an bootloader EEPROM image for secure-boot because the signed data is bootloader configuration file rather than the entire flash image. To create signed bootloader images please see https://github.com/raspberrypi/usbboot/tree/master/secure-boot-recovery/README.md

OPTIONS

-i The source image e.g. boot.img

-o The name of the digest/signature file.

-k Optional RSA private key.

RSA signing If a private key in PEM format or a pkcs#11 URI is supplied then the RSA signature of the sha256 digest is included in the .sig file. Currently, the bootloader only supports sha256 digests signed with a 2048bit RSA key. The bootloader only verifies RSA signatures in signed boot mode and only for the EEPROM config file and the signed image.

EXAMPLES
# Generate the normal sha256 hash to guard against file-system corruption rpi-eeprom-digest -i pieeprom.bin -o pieeprom.sig rpi-eeprom-digest -i vl805.bin -o vl805.sig

# Generate a signed OS ramdisk image for secure-boot rpi-eeprom-digest -k private.pem -i boot.img -o boot.sig

# Generate RSA signature for the EEPROM config file # As used by update-pieeprom.sh in usbboot/secure-boot-recovery rpi-eeprom-digest -k private.pem -i bootconf.txt -o bootconf.sig

# Similarly, but specifying the key with a PKCS#11 URI rpi-eeprom-digest -k pkcs11:token=deadbeef;object=bl-key;type=private;pin-value=1234 -i bootconf.txt -o bootconf.sig

# To verify the signature of an existing .sig file using the public key. # N.B The key file must be the PUBLIC key in PEM format. rpi-eeprom-digest -k public.pem -i boot.bin -v boot.sig