linux-kernel - Re: MODSIGN without RTC?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51194A1F.4060900@ahsoftware.de>
Date:	Mon, 11 Feb 2013 20:44:31 +0100
From:	Alexander Holler <holler@...oftware.de>
To:	Olaf Titz <olaf@...red.inka.de>
CC:	linux-kernel@...r.kernel.org,
	Herbert Xu <herbert@...dor.apana.org.au>,
	David Miller <davem@...emloft.net>,
	Rusty Russell <rusty@...tcorp.com.au>,
	David Howells <dhowells@...hat.com>
Subject: Re: MODSIGN without RTC?

Am 07.02.2013 19:44, schrieb Olaf Titz:
>> Another option would be to make a configure option to just ignore the
>> date. I'm not sure if I would like to use MODSIGN when I have to fear
>> that the machine wouldn't start when the RTC fails or got set to a wrong
>> date.
>
> Or just ignore the date unconditionally. After all, when a certificate
> check fails due to out-of-validity-period, then you can always "fix"
> that by appropriately setting the clock. So for security, in this
> application, the date check is outright useless.

I don't think that is an option, because the date check is part of the 
crypto-api and not a part of the modsign-stuff.

So it's necessary that the crypto-api offers a flag to ignore the dates 
and another flag to mark such keys as invalid because of the date. The 
first flag is necessary to load and use the keys, the second flag for 
(maybe) other users of the crypto-api which might not use such invalid keys.

Regards,

Alexander
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/