4 ms·
Encryption for firmware updates is only to obscure the contents. The imgdecrypt binary here also references RSA_verify and similarly public-key cryptography sou
by stefan_ 6y ago
Encryption for firmware updates is only to obscure the contents. The imgdecrypt binary here also references RSA_verify and similarly public-key cryptography sounding names so I assume they are using that to authenticate the firmware images (checking for a D-Link signature).
Of course this is D-Link and the product is an embedded garbage router, so chances are high they are doing it entirely wrong.
- 0xricksanchez 6y agoYou're right with your assumptions! If you go to part 3 pretty much to the bottom of the article there's a good summary of what fields are included in their firmware verification headers. TL;DR: They verify the length of the encrypted and decrypted firmware as well as multiple RSA signatures. As much as I like pushing security vectors on embedded/IoT devices... This approach of obscuring what is being pushed in an update may not be the right approach imo.