Any way to not distribute the signing key?

[vlovich]

Currently if I didn't misread the docs the flow is for the provisioner device to have the customer key which means that the key is accessible to it and the provisioning device itself needs to be super hardened. This seems like a security risk if you want to give the provisioner to an untrusted party to do the flashing en masse. Isn't it more common to generate a signed image and only distribute the public key? Or am I totally misreading the docs about how it works?

[tdewey-rpi]

Correct - I would not advise giving the provisioner to an entity you don't trust to mint devices .

Essentially, you must trust someone to write the key hash into the device, and generate a device unique key pair. Given that entity has to have physical USB access, it's a logical optimisation to also flash a software payload at that station - any tooling capable of extreme modification to the device, stays inside your trust boundary.

The alternative is to do something rather deleterious - to distribute a signed Fastboot or MSG image. Those images are, by nature, extremely powerful - and not something you want to get out in to the wild, because they must pass signed boot to operate. In rpi-sb-provisioner, they are ephemeral.

[vlovich]

Maybe I'm misunderstanding how things work.

Don't you usually flash the public key into OTP and then flash a signed image onto the SD card? Why does the provisioner need the signing key? I agree the provisioner has the power to create new devices and that's part of the trust boundary, but it shouldn't have the power to sign arbitrary software?

Your comment about fastboot and interim images makes me think there's an interim OS you need to install as part of provisioning that needs to be signed on demand to complete provisioning. Is that why the signing key is needed?

I'm just trying to map it to how Apple does signing of millions of devices each year without giving Foxconn the root signing keys - I don't believe they ship a machine to China with the root signing key for all their OS images.

[tdewey-rpi]

Maybe I'm misunderstanding how things work.

Don't you usually flash the public key into OTP and then flash a signed image onto the SD card? Why does the provisioner need the signing key? I agree the provisioner has the power to create new devices and that's part of the trust boundary, but it shouldn't have the power to sign arbitrary software?

Your comment about fastboot and interim images makes me think there's an interim OS you need to install as part of provisioning that needs to be signed on demand to complete provisioning. Is that why the signing key is needed?

I'm just trying to map it to how Apple does signing of millions of devices each year without giving Foxconn the root signing keys - I don't believe they ship a machine to China with the root signing key for all their OS images.

I can't comment on how Apple manufacture their devices, but I can imagine how an equivalent flow might work. It's pretty straightforward:

• Your trusted entity writes the signing key, and a 'rump OS'
• Your 'untrusted' environment deploys an authenticated OTA on top of the 'rump OS' at deployment time

This is, in effect, how many consumer electronic devices work today (smart TVs, soundbars, etc). Critically, of course, you're still writing some kind of OS (even if it's just a kernel & an OTA client userspace).

Depending on the hardware, they might have baked their 'rump OS' into a bootloader or similar - but either way, a trusted entity has written that and the initial keys.

As I wrote above - if you have your software ready to deploy at provisioning time, it's one fewer touch event (with all the risks that each of these carry) to write that in your already-established trusted environment.

[vlovich]

Yeah, I guess the problem is that if you hand off to a 3rd party to assemble and flash you're technically at higher risk. Is my mental model correct that I would create an rpi5 via rpi-sb-provisionier using a "root key" in a trusted environment that has the factory image to install + the signing key preloaded & give that to the 3rd party? Then the signing key is on a device they can't get it out of and all they can do is install the OS onto new devices that are bound to our signing key?