diff options
| author | Michael Brown <mcb30@ipxe.org> | 2024-08-29 14:00:34 +0100 |
|---|---|---|
| committer | Michael Brown <mcb30@ipxe.org> | 2024-08-29 15:11:30 +0100 |
| commit | 72316b820d4bdbf3d75a0ae7e13f1c3bc8e6ac29 (patch) | |
| tree | 111872793eecfcd754e93491c8d352bfb4e0e627 /src/config/general.h | |
| parent | 486b15b3c11692af4325cd7d0220cdb72ec27586 (diff) | |
| download | ipxe-72316b820d4bdbf3d75a0ae7e13f1c3bc8e6ac29.tar.gz | |
[image] Add the "imgdecrypt" command
Add the "imgdecrypt" command that can be used to decrypt a detached
encrypted data image using a cipher key obtained from a separate CMS
envelope image. For example:
# Create non-detached encrypted CMS messages
#
openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \
-in vmlinuz -outform DER -out vmlinuz.cms
openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \
-in initrd.img -outform DER -out initrd.img.cms
# Detach data from envelopes (using iPXE's contrib/crypto/cmsdetach)
#
cmsdetach vmlinuz.cms -d vmlinuz.dat -e vmlinuz.env
cmsdetach initrd.img.cms -d initrd.img.dat -e initrd.img.env
and then within iPXE:
#!ipxe
imgfetch http://192.168.0.1/vmlinuz.dat
imgfetch http://192.168.0.1/initrd.img.dat
imgdecrypt vmlinuz.dat http://192.168.0.1/vmlinuz.env
imgdecrypt initrd.img.dat http://192.168.0.1/initrd.img.env
boot vmlinuz
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/config/general.h')
| -rw-r--r-- | src/config/general.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/config/general.h b/src/config/general.h index f936e874c..b82e5602c 100644 --- a/src/config/general.h +++ b/src/config/general.h @@ -158,6 +158,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL ); //#define REBOOT_CMD /* Reboot command */ //#define POWEROFF_CMD /* Power off command */ //#define IMAGE_TRUST_CMD /* Image trust management commands */ +//#define IMAGE_CRYPT_CMD /* Image encryption management commands */ //#define PCI_CMD /* PCI commands */ //#define PARAM_CMD /* Request parameter commands */ //#define NEIGHBOUR_CMD /* Neighbour management commands */ |