linux-kernel - Re: [PATCH] X.509: Remove certificate date checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 14 Mar 2013 18:42:29 +0100
From:	Alexander Holler <holler@...oftware.de>
To:	David Woodhouse <dwmw2@...radead.org>
CC:	David Howells <dhowells@...hat.com>, rusty@...tcorp.com.au,
	torvalds@...ux-foundation.org, keyrings@...ux-nfs.org,
	Josh Boyer <jwboyer@...hat.com>, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH] X.509: Remove certificate date checks

Am 14.03.2013 18:09, schrieb David Woodhouse:
> On Thu, 2013-03-14 at 17:22 +0100, Alexander Holler wrote:
>>
>> Agreed (thats what my patch did).
>>
>> I've introduced a new config option because I don't know if something (a
>> use case I don't know) relies on the validity check of the dates in the
>> parser. If there currently isn't such a user, just removing the validity
>> check in the parser might be enough.
>
> Is there *is* such a user, it's broken already. The key could have been
> loaded (and passed the existing check) *months* ago, expired seconds
> after it was loaded, and your hypothetical user could still be happily
> trusting it.

As the user (program or whatever) calls the parser, he knows if he can 
trust it to validate dates. So there might be something for which the 
current implementation works (parsing date = using date).

I just don't know, because I've only discovered that glitch while trying 
to use modsign to be sure no unsigned module (I've compiled myself) will 
be become loaded (I compile the kernel and delete the keys right 
afterwards). So I don't know anything if and how the crypto-api to load 
x.509 keys is used besides modsign. ;)

Regards,

Alexander

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/