hesela.devUBIFS authentication
UBIFS authentication uses hashes and keyed authentication to detect offline changes to file contents and filesystem metadata on UBI volumes.
The authenticated index binds child nodes to an HMAC-protected master; the journal and LEB property tree also need authentication. Trusted executing code and protection of the authentication key are assumptions. [1]
The threat model excludes full-flash rollback and rollback of individual index commits. Successful authentication is therefore not proof of the latest committed state. [1]
Linux v6.16 documents auth_key= as making authentication mandatory, with a logon-type key in the kernel keyring. auth_hash_name= selects the hash/HMAC algorithm. These settings are distinct from data-node CRC checking. [2]
The v6.16 initializer rejects an absent or unknown hash name and propagates key-lookup failures; a revoked key is rejected. Configuration support is not evidence that a particular mounted volume is authenticated. [3]
Relations
- related
- UBI File System (UBIFS), Unsorted Block Images (UBI), HMAC, Merkle tree, Rollback protection, fscrypt
Citations
- Linux v6.16: UBIFS Authentication Support, threat model and index/journal authentication
- Linux v6.16: UBIFS mount options, data CRC and authentication keys
- Linux v6.16 auth.c: ubifs_init_authentication and authentication-node construction
Further reading
Sources & caveats
- Source review pinned to Linux v6.16. No UBIFS mount, power-cut, offline-modification or key-erasure experiment was performed.