Code QuizAdvanced

Verifying an OTA Update Signature

See why merely checking that a signature exists does not verify update integrity.

Codejavascript

import { sha256, verifySignature } from './crypto';
import { PUBLIC_KEY } from './keys';

async function applyUpdate(bundle, signature) {
  const hash = sha256(bundle);

  // Ensure the update is authentic before installing
  if (signature) {
    installBundle(bundle);
  }
}

What is the bug in this OTA update verification?

← PreviousInput Validation and Sanitization Next →Logging During a Login Request