linux-kernel - Re: [RFC 1/1] ima: digital signature verification using asymmetric keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130128151527.GA5868@redhat.com>
Date:	Mon, 28 Jan 2013 10:15:27 -0500
From:	Vivek Goyal <vgoyal@...hat.com>
To:	"Kasatkin, Dmitry" <dmitry.kasatkin@...el.com>
Cc:	Mimi Zohar <zohar@...ux.vnet.ibm.com>, dhowells@...hat.com,
	jmorris@...ei.org, linux-security-module@...r.kernel.org,
	linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC 1/1] ima: digital signature verification using asymmetric
 keys

On Mon, Jan 28, 2013 at 04:54:06PM +0200, Kasatkin, Dmitry wrote:
> On Fri, Jan 25, 2013 at 11:01 PM, Vivek Goyal <vgoyal@...hat.com> wrote:
> > Hi,
> >
> > I am trying to read and understand IMA code. How does digital signature
> > mechanism work.
> >
> > IIUC, evmctl will install a file's signature in security.ima. And later
> > process_measurement() will do following.
> >
> > Calculate digest of file in ima_collect_measurement() and then
> > ima_appraise_measurement() actually compares signatuer against the
> > digest.
> >
> > If yes, ima_collect_measurement() always calculates digest either using
> > md5/sha1 but signatures might have used sha256 or something else. So
> > how does it work. What am I missing.
> 
> Hi,
> 
> Yes, currently it is possible to use only single configured algorithm, which is
> in generally enough. Consider it like a policy.
> Soon it will be a patch which allows to use any hash algorithms, supported by
> asymmetric key verification API.

Ok. I am hoping that it will be more than the kernel command line we
support. In the sense that for digital signatures one needs to parse
the signature, look at what hash algorithm has been used  and then
collect the hash accordingly. It is little different then IMA requirement
of calculating one pre-determine hash for all files.

Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/