linux-kernel - Re: [RFC 0/1] ima/evm: signature verification support using asymmetric keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Jan 2013 18:03:49 +0000
From:	David Howells <dhowells@...hat.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	Dmitry Kasatkin <dmitry.kasatkin@...el.com>
Cc:	dhowells@...hat.com, jmorris@...ei.org,
	linux-security-module@...r.kernel.org,
	linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC 0/1] ima/evm: signature verification support using asymmetric keys

Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:

> David, are you ok with how support for asymmetric keys is being added to
> EVM/IMA-appraisal for verifying signatures?  Any comments?

I would also like to have a look at altering your trusted key type[*] to be a
subtype of asymmetric keys so that the asymmetric key type can cover keys from
more sources:

	- Compiled-in keys.
	- Keys from UEFI db.
	- Keys from TPM (ie. the trusted key stuff).
	- Keys loaded by the administrator _if_ they are validated by a key the
	  kernel already has.
	
[*] I believe that that's your asymmetric key type and that your encrypted key
    type is your symmetric key type.

To support this, it may be necessary to make it possible to make the "trusted"
key type name a synonym of the "asymmetric" key type name in some way.

I also have some patches to divorce the module signing public keyring stuff
from module signing and make it a more generic system keyring of trusted keys
that can be used for other purposes (such as IMA and verifying additional
keys) that I shall post shortly.

On top of those patches, I have a series of patches to permit extra keys to be
added from signed PE binaries that can be found here:

http://git.kernel.org/?p=linux/kernel/git/dhowells/linux-modsign.git;a=shortlog;h=refs/heads/devel-pekey

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/