Cryptographic Validation For Authenticated Variables

[Flickdm]

Description

This pull request adds a new "verify" command to the auth_var_tool.py script, enhancing its ability to cryptographically verify UEFI authenticated variables. It also improves the output of the "describe" command by converting hex-encoded certificate fields into human-readable text. The most important changes are summarized below:

New Verification Functionality:

• Added a verify command that verifies the cryptographic signature of authenticated variables, checking PKCS7 structure validity, signature correctness, and presence of the signing certificate. This includes new helper functions for extracting certificates and verifying signatures from PKCS7 data. [1] [2] [3] [4] [5] [6]

Improvements to Describe Output:

• Enhanced the describe command to convert ASN.1 hex-encoded certificate fields (such as subject and issuer names) into human-readable strings, making the output more user-friendly. [1] [2]

Documentation and Usage Examples:

• Updated script documentation and usage examples to include the new verify command and its arguments, ensuring users are aware of the new functionality. [1] [2]

These changes make the tool more robust for workflows that require verification of signed UEFI variables and improve the clarity of output for certificate inspection.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

• Impacts functionality?
• Impacts security?
• Breaking change?
• Includes tests?
• Includes documentation?

How This Was Tested

Against every supplied KEK update

Appears to have caught a couple mistakes, reviewing them internally

Integration Instructions

N/A

[Copilot]

Pull request overview

This pull request adds cryptographic verification capabilities to the UEFI authenticated variable tools by introducing a new verify command, a batch validation script, and automated CI workflow validation.

• Adds verify command to auth_var_tool.py with PKCS7 signature verification
• Creates validate_kek.py script for batch validation of KEK update files
• Implements GitHub Actions workflow for automated KEK validation on pull requests

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 13 comments.

File	Description
scripts/auth_var_tool.py	Adds cryptographic verification functionality with new verify command, PKCS7 certificate extraction, signature verification helpers, and enhanced describe output with human-readable hex strings
scripts/validate_kek.py	New script for validating KEK update files (single or batch) with JSON reporting, payload hash checking, and cryptographic signature verification
.github/workflows/validate-kek-updates.yml	New GitHub Actions workflow to automatically validate KEK files in pull requests, checking cryptographic signatures and expected payloads

Comments suppressed due to low confidence (1)

scripts/auth_var_tool.py:669

• This import of module re is redundant, as it was previously imported on line 49.

    import re

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.