Authentication of files
Methods of authenticating a file are disclosed. A method may include selecting, via an identifier, a subset of data segments of a file. The method may also include executing, via a microcontroller, a cryptographic function on only the subset of data segments of the file to generate a digest. Further, the method may include generating, via the microcontroller, an authenticator based on the digest and a private key. The method may also include conveying the file, the identifier, and the authenticator to a cryptography element. In addition, the method may include executing, via the cryptography element, the cryptographic function on the subset of data segments of the file to generate a second digest. Furthermore, the method may include authenticating, via the cryptography element, the file via verification of the authenticator based on the second digest and a public key of the microcontroller.
1. A system, comprising:
one or more physical devices configured to:
select, as indicated by an identifier, a subset of data segments of an application image for generating a first digest with a hash function, the identifier used to at least one of select the subset of data segments of the application image or identify how the subset of data segments of the application image is selected;
execute the hash function on the selected subset of data segments of the application image to generate the first digest;
generate an authenticator using the first digest and a private key; and
send the application image, the identifier, and the authenticator to a cryptography element;
wherein the cryptography element is configured to:
execute the hash function on the subset of data segments of the application image to generate a second digest; and
authenticate the application image via verification of the authenticator using the second digest and a public key.
2. The system of claim 1 , wherein the identifier identifies a repeatable pattern of data segments.
3. The system of claim 2 , wherein the repeatable pattern is in a form of 1 data segment selected for every N data segments, wherein N is a positive integer.
4. The system of claim 1 , wherein the identifier identifies a pseudorandom distribution of data segments of the application image.
5. The system of claim 1 , wherein the identifier includes or is determined via an algorithm.
6. The system of claim 1 , wherein the identifier includes or is determined by a randomly generated number.
7. The system of claim 6 , wherein the randomly generated number is represented by a binary number, wherein each bit of the binary number corresponds to a data segment within either the subset of data segments or another subset of data segments of the application image not selected for generating the digest.
8. A method, comprising:
selecting, via an identifier, a subset of data segments of an application image, the identifier used to at least one of select the subset of data segments of the application image or identify how the subset of data segments of the application image is selected;
executing, via a microcontroller, a hash function on only the subset of data segments of the application image to generate a first digest;
generating, via the microcontroller, an authenticator using the first digest and a private key;
conveying the application image, the identifier, and the authenticator to a cryptography element;
executing, via the cryptography element, the hash function on the subset of data segments of the application image to generate a second digest; and
authenticating, via the cryptography element, the application image via verification of the authenticator using the second digest and a public key.
9. The method of claim 8 , further comprising determining the identifier.
10. The method of claim 9 , wherein the determining the identifier comprises determining a repeatable pattern of data segments of the application image in a form of 1 data segment selected for every N data segments, wherein N is a positive integer.
11. The method of claim 9 , wherein the determining the identifier comprises determining the identifier via one of an algorithm and a randomly generated number.
12. A non-transitory machine-readable medium storing instructions that, in response to being executed by at least one processor of a system, are configured to enable the system to perform operations comprising:
selecting, via an identifier, a subset of data segments of an application image, the identifier used to at least one of select the subset of data segments of the application image or identify how the subset of data segments of the application image is selected;
executing a first hash operation on only the subset of data segments of the application image to generate a first digest;
generating an authenticator using the first digest and a private key;
conveying, via a secure message, at least the subset of data segments, the identifier, and the authenticator;
executing a second hash operation on the subset of data segments of the application image to generate a second digest; and
authenticating the application image via verification of the authenticator using the second digest and a public key.
13. The non-transitory machine-readable medium of claim 12 , wherein the selecting the subset of data segments comprises selecting a subset of bytes of the application image.
14. The non-transitory machine-readable medium of claim 12 , the operations further comprising determining the identifier based on at least one of a repeatable pattern, a random number, and an algorithm.
15. The non-transitory machine-readable medium of claim 12 , wherein the executing the second hash operation comprises executing the second hash operation on a secure cryptography element.
16. The non-transitory machine-readable medium of claim 12 , wherein the executing the first hash operation comprises executing the first hash operation on a microcontroller.
17. The non-transitory machine-readable medium of claim 12 , wherein the executing the first hash operation comprises executing the first hash operation responsive to at least one of a firmware update and a secure boot up.