100 lines
3.7 KiB
Python
100 lines
3.7 KiB
Python
|
# -*- coding: utf-8 -*-
|
|||
|
|
# ===================================================================
|
|||
|
|
#
|
|||
|
|
# Copyright © 2022 China Mobile IOT. All rights reserved.
|
|||
|
|
#
|
|||
|
|
# Date: 2022/08/05
|
|||
|
|
# Author: zhangxw
|
|||
|
|
# Function: 固件签名
|
|||
|
|
#
|
|||
|
|
# 签名流程：①提取bin文件md5码；②对md5码进行RSA签名（pkcs1_15填充）；③将签名结果及md5码放置于bin文件开头，增加固定长度256（RSA） + 16(MD5)
|
|||
|
|
# 秘钥存储：公钥存储在模组中，私钥存储在编译环境中
|
|||
|
|
#
|
|||
|
|
# ===================================================================
|
|||
|
|
|
|||
|
|
|
|||
|
|
import sys
|
|||
|
|
import os.path
|
|||
|
|
from Crypto.Signature import pkcs1_15
|
|||
|
|
from Crypto.Hash import MD5
|
|||
|
|
from Crypto.PublicKey import RSA
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 功能：固件签名
|
|||
|
|
# private_key_fn 私钥文件
|
|||
|
|
# bin_fn 待签名文件
|
|||
|
|
# sign_fn 签名后文件
|
|||
|
|
def package_sign(private_key_fn, bin_fn, sign_fn):
|
|||
|
|
with open(private_key_fn) as private_key_file, \
|
|||
|
|
open(bin_fn, "rb") as bin_file, \
|
|||
|
|
open(sign_fn, "wb") as sign_file:
|
|||
|
|
private_key = RSA.import_key(private_key_file.read())
|
|||
|
|
bin_data = bin_file.read()
|
|||
|
|
digest = MD5.new(bin_data) # 生成16字节MD5码
|
|||
|
|
print("MD5:", digest.digest())
|
|||
|
|
# 使用私钥对HASH值进行签名
|
|||
|
|
signature = pkcs1_15.new(private_key).sign(digest) # 私钥签名
|
|||
|
|
sign_file.write(signature) # 写入256字节签名信息
|
|||
|
|
sign_file.write(digest.digest()) # 写入16字节MD5信息
|
|||
|
|
sign_file.write(bin_data) # 写入固件信息
|
|||
|
|
return signature
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 功能：固件验签
|
|||
|
|
# public_key_fn 公钥文件
|
|||
|
|
# sign_fn 签名固件
|
|||
|
|
def package_check(public_key_fn, sign_fn):
|
|||
|
|
with open(public_key_fn) as public_key_file, \
|
|||
|
|
open(sign_fn, "rb") as sign_file:
|
|||
|
|
public_key = RSA.import_key(public_key_file.read())
|
|||
|
|
sign_data = sign_file.read(256) # 读取签名信息
|
|||
|
|
sign_file.read(16) # 读取MD5信息
|
|||
|
|
bin_data = sign_file.read() # 读取固件信息
|
|||
|
|
md5_data = MD5.new(bin_data)
|
|||
|
|
# print(sign_data)
|
|||
|
|
print("MD5:", md5_data.digest())
|
|||
|
|
try:
|
|||
|
|
pkcs1_15.new(public_key).verify(md5_data, sign_data)
|
|||
|
|
print("签名验证成功！！！")
|
|||
|
|
except:
|
|||
|
|
print("签名验证失败！！！")
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 功能：生成公私秘钥对
|
|||
|
|
def pem_generate(length):
|
|||
|
|
key = RSA.generate(length)
|
|||
|
|
private_key = key.export_key()
|
|||
|
|
public_key = key.publickey().export_key()
|
|||
|
|
with open("private_key.rsa", "wb") as pri_file, \
|
|||
|
|
open("public_key.rsa", "wb") as pub_file:
|
|||
|
|
pri_file.write(private_key)
|
|||
|
|
pub_file.write(public_key)
|
|||
|
|
|
|||
|
|
|
|||
|
|
# 传入待签名文件，在同一个文件夹下生成签名后文件
|
|||
|
|
if __name__ == "__main__":
|
|||
|
|
if len(sys.argv) != 3:
|
|||
|
|
print("参数错误:", len(sys.argv))
|
|||
|
|
sys.exit()
|
|||
|
|
|
|||
|
|
bin_filename = str(sys.argv[1])
|
|||
|
|
private_key_filename = str(sys.argv[2])
|
|||
|
|
|
|||
|
|
if os.path.isfile(bin_filename) is not True: # 判断bin文件是否存在
|
|||
|
|
print("bin文件不存在", bin_filename)
|
|||
|
|
sys.exit()
|
|||
|
|
if os.path.isfile(private_key_filename) is not True: # 判断私钥文件是否存在
|
|||
|
|
print("私钥文件不存在", private_key_filename)
|
|||
|
|
sys.exit()
|
|||
|
|
|
|||
|
|
bin_dir = os.path.dirname(os.path.realpath(bin_filename))
|
|||
|
|
bin_name = os.path.basename(bin_filename)
|
|||
|
|
sign_bin_file_name = bin_dir + "\sign_" + bin_name # 签名后的文件名
|
|||
|
|
|
|||
|
|
print("开始签名，文件名：", bin_name)
|
|||
|
|
# 将会在bin文件开头增加272固定长度，包括256bytes的签名信息及16bytes的md5信息
|
|||
|
|
sign = package_sign(private_key_filename, bin_filename, sign_bin_file_name) # 生成签名包
|
|||
|
|
# print("签名信息：", sign)
|
|||
|
|
print("签名完成，文件名：", sign_bin_file_name)
|
|||
|
|
# package_check("public_key.rsa", sign_bin_file_name) # 验签
|