D080 - The keystone is derived, not supplied, and every package this crate built was missing one
The keystone is derived, not supplied, and every package this crate built was missing one.
Every real package carries sce_sys/keystone - 96 bytes -
and a builder was demanding it as an input because it looked like one
more file a caller owns. It is not. It is two HMAC-SHA256
operations over the passcode, which the builder already
has:
header "keystone" 02 00 01 00, then zeros, to 32 bytes
fingerprint HMAC-SHA256(keystone_hmac_key, passcode)
final HMAC-SHA256(keystone_mac_data, header || fingerprint)
Nothing about it identifies a title, so
selfish-pkg::keystone builds it and the tool puts one into
every image it lays out. examples/keystone.rs opens the
filesystem inside a package, extracts the keystone and compares:
96 of 96 bytes identical on both fake-passcode samples.
The third was built with a passcode nobody can recover and is reported
as such.
Found by asking why a package this project builds differs from the ones that install - the same question that produced D054 and D056, and the third time it has found something certain rather than probable.