diff options
author | axtloss <axtlos@getcryst.al> | 2024-02-03 17:34:17 +0100 |
---|---|---|
committer | axtloss <axtlos@getcryst.al> | 2024-02-03 17:34:17 +0100 |
commit | 09f7f5fe7b55a6ab2e2326aa7ff27cf7f7bc05ba (patch) | |
tree | 12577c54b02e60c5ce5850ef2a2e65982d7c6849 | |
parent | abd7aba9709a7e05d57861af50f55ce275fb3663 (diff) | |
download | fsverify-09f7f5fe7b55a6ab2e2326aa7ff27cf7f7bc05ba.tar.gz fsverify-09f7f5fe7b55a6ab2e2326aa7ff27cf7f7bc05ba.tar.bz2 |
fix typos
-rw-r--r-- | core/verification.go | 41 | ||||
-rw-r--r-- | fsverify-paper.md | 4 |
2 files changed, 43 insertions, 2 deletions
diff --git a/core/verification.go b/core/verification.go new file mode 100644 index 0000000..5023d06 --- /dev/null +++ b/core/verification.go @@ -0,0 +1,41 @@ +package core + +import ( + "bufio" + "fmt" + "strings" +) + +func ReadBlock(node Node, part *bufio.Reader) ([]byte, error) { + block := make([]byte, node.BlockEnd-node.BlockStart) + blockSize := node.BlockEnd - node.BlockStart + _, err := part.Discard(node.BlockStart) + if err != nil { + return []byte{}, err + } + block, err = part.Peek(blockSize) + return block, err +} + +func VerifyBlock(block []byte, node Node) error { + calculatedBlockHash, err := CalculateBlockHash(block) + if err != nil { + return err + } + wantedBlockHash := node.BlockSum + if strings.Compare(calculatedBlockHash, strings.TrimSpace(wantedBlockHash)) == 0 { + return nil + } + return fmt.Errorf("Error: Node %s ranging from %d to %d does not match block", node.PrevNodeSum, node.BlockStart, node.BlockEnd) +} + +func VerifyNode(node Node, nextNode Node) error { + nodeHash, err := calculateStringHash(fmt.Sprintf("%d%d%s%s", node.BlockStart, node.BlockEnd, node.BlockSum, node.PrevNodeSum)) + if err != nil { + return err + } + if strings.Compare(nodeHash, nextNode.PrevNodeSum) != 0 { + return fmt.Errorf("Node %s is not valid!", node.PrevNodeSum) + } + return nil +} diff --git a/fsverify-paper.md b/fsverify-paper.md index ba50847..b19ec52 100644 --- a/fsverify-paper.md +++ b/fsverify-paper.md @@ -75,7 +75,7 @@ The verification step consists of multiple steps: 4. Verifying the target partition using the database ## Reading the Signature and Public Key -Reading the signature is quite simple, it is part of the Fsverify partition header and is read at an offset starting at 0x4 up to 0x132 (total 302 Bytes). +The header only contains parts of the signature, the Trusted Hash and the Untrusted Hash, using this a complete signature is constructed, this allows for easier storage of the signature as the full signature contains data that can change over time (but is not required for signing) and break the header by becoming too big. The Public Key however is not stored in the partition, instead it can be stored in multiple ways - A different partition that has been verified in a different way @@ -88,7 +88,7 @@ The most secure option for most average Desktop computers would be the TPM2 or a In the case that the hardware itself cannot be trusted, read-only external storage can be used to store the key, this can ensure that the public key is never modified, assuming the person carrying said storage device does not loose it. ## Reading the database -The Database is simply read from 0x13A until the size of the table is reached as specified in the headers. If the table would be 1mb big, it would reach from 0x13A until 0xF437A (1000000bytes/1mb) +The Database is simply read from 0x13A until the size of the table is reached as specified in the headers. If the table is 1mb big, it would reach from 0xC8 until 0xF4308 (1000000bytes/1mb) ## Verifying the database using the previously read keys Now that the signature, public key and database are read, they can be verified using [minisign](https://jedisct1.github.io/minisign/). |