linux-kernel - Re: [PATCH06/17] PKCS#7: Verify internal certificate chain

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <42827.1405012013@turing-police.cc.vt.edu>
Date:	Thu, 10 Jul 2014 13:06:53 -0400
From:	Valdis.Kletnieks@...edu
To:	David Howells <dhowells@...hat.com>
Cc:	keyrings@...ux-nfs.org, linux-security-module@...r.kernel.org,
	kexec@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH06/17] PKCS#7: Verify internal certificate chain

On Wed, 09 Jul 2014 16:16:04 +0100, David Howells said:
> Verify certificate chain in the X.509 certificates contained within the PKCS#7
> message as far as possible.  If any signature that we should be able to verify
> fails, we reject the whole lot.

What happens if we see a signature that we shouldn't be able to verify?  Or should
that changelog entry be reduced to "If any signature fails", period?

Content of type "application/pgp-signature" skipped