[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <26123.1326889583@redhat.com>
Date: Wed, 18 Jan 2012 12:26:23 +0000
From: David Howells <dhowells@...hat.com>
To: "Kasatkin, Dmitry" <dmitry.kasatkin@...el.com>
Cc: dhowells@...hat.com, keyrings@...ux-nfs.org,
linux-crypto@...r.kernel.org,
linux-security-module@...r.kernel.org,
linux-kernel@...r.kernel.org, zohar@...ux.vnet.ibm.com,
arjan.van.de.ven@...el.com, alan.cox@...el.com
Subject: Re: [PATCH 08/21] KEYS: Add signature verification facility [ver #3]
Kasatkin, Dmitry <dmitry.kasatkin@...el.com> wrote:
> It would also nice to have an API to supply pre-computed data hash. For
> example IMA uses the same functionality to compute the hash of the file
> content, and then, based on security.ima type decided either verify it using
> just hash, or use digital signature. We could pass a hash as data. But may
> be we do not want to have extra operation and compute hash over hash.
If I understand you correctly, you'd like to have the option to do the hashing
externally to this API? Would you supply the completed hash or just a hash
with the data in it, and require this API to complete it (ie. chuck metadata
into it)?
I don't think it should be hard. I could add an alternative to
verify_sig_add_data() perhaps. Either that or one function that does the lot
and takes the precomputed hash as input. There would be no need for the split
into four functions (begin, add_data, end, cancel) in such a case. The reason
for the split is so that the caller can invoke add_data several times with
non-contiguous bits of data.
It might even make sense to expose the crypto hash object for direct access
rather than use add_data - but that then makes it hard to use crypto hardware
where you would just shovel the raw data into it and it does all the hashing
and cryptography in a black box.
David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists