[Fw_Os_Forum] How to correctly sign EFI Firmware Volume?

[Petr Vandrovec]

Good morning,

I'm looking at options how to sign our EFI firmware through some 
industry-standard embedded signature option, and signing whole firmware 
volume as described in Platform Initialization spec would definitely fit 
the bill.

Unfortunately problem is that I cannot make sense of what should be 
actually signed.  Chapter 3.2.1.1 of PI_Spec_1_6.pdf says:

<quote>
3.2.1.1 EFI Signed Firmware Volumes

There may be one or more headers with a FormatType of value 
EFI_FIRMWARE_CONTENTS_SIGNED_GUID.

A signed firmware volume is a cryptographic signature across the entire 
volume. To process the contents and verify the integrity of the volume, 
the EFI_FIRMWARE_VOLUME_EXT_ENTRY_GUID_TYPE Data[] shall contain an 
instance of WIN_CERTIFICATE_UEFI_GUID where the CertType = 
EFI_CERT_TYPE_PKCS7_GUID or EFI_CERT_TYPE_RSA2048_SHA256_GUID.
</quote>

Part about WIN_CERTIFICATE_UEFI_GUID is easy.  But what should be signed?

Text says 'A signed firmware volume is a cryptographic signature across 
the entire volume.' - beside that 'firmware volume' is not a signature, 
what is 'the entire volume' ?  Clearly Data[] entry holding signature 
cannot be part of the signature, as otherwise adding signature would 
invalidate that very same signature, so it cannot be signature of entire 
volume from first 16 reserved bytes in the header to the last byte of 
the image, but something else.

Can someone provide clarification what should be signed?  It seems to me 
like that intention is to only sign data portion of the volume, from the 
end of extended header to the end of volume.  But that means that anyone 
can modify anything in the header or extended header without breaking 
signature.

Are there any examples of signed firmware volumes?  Unfortunately there 
does not seem to be any code in UDK for this feature.

Thanks,
Petr Vandrovec