mirror of https://github.com/ipxe/ipxe.git
72316b820d
Add the "imgdecrypt" command that can be used to decrypt a detached
encrypted data image using a cipher key obtained from a separate CMS
envelope image. For example:
# Create non-detached encrypted CMS messages
#
openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \
-in vmlinuz -outform DER -out vmlinuz.cms
openssl cms -encrypt -binary -aes-256-gcm -recip client.crt \
-in initrd.img -outform DER -out initrd.img.cms
# Detach data from envelopes (using iPXE's contrib/crypto/cmsdetach)
#
cmsdetach vmlinuz.cms -d vmlinuz.dat -e vmlinuz.env
cmsdetach initrd.img.cms -d initrd.img.dat -e initrd.img.env
and then within iPXE:
#!ipxe
imgfetch http://192.168.0.1/vmlinuz.dat
imgfetch http://192.168.0.1/initrd.img.dat
imgdecrypt vmlinuz.dat http://192.168.0.1/vmlinuz.env
imgdecrypt initrd.img.dat http://192.168.0.1/initrd.img.env
boot vmlinuz
Signed-off-by: Michael Brown <mcb30@ipxe.org>
|
||
|---|---|---|
| .. | ||
| autoboot.c | ||
| certmgmt.c | ||
| dhcpmgmt.c | ||
| fcmgmt.c | ||
| ibmgmt.c | ||
| ifmgmt.c | ||
| imgarchive.c | ||
| imgcrypt.c | ||
| imgmgmt.c | ||
| imgtrust.c | ||
| ipstat.c | ||
| iwmgmt.c | ||
| lotest.c | ||
| neighmgmt.c | ||
| nslookup.c | ||
| ntpmgmt.c | ||
| pingmgmt.c | ||
| profstat.c | ||
| prompt.c | ||
| pxemenu.c | ||
| route.c | ||
| route_ipv4.c | ||
| route_ipv6.c | ||
| shimmgmt.c | ||
| sync.c | ||