linux-kernel - Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 20 May 2015 14:36:09 +0100
From:	David Howells <dhowells@...hat.com>
To:	Andy Lutomirski <luto@...nel.org>
Cc:	dhowells@...hat.com, rusty@...tcorp.com.au, mmarek@...e.cz,
	mjg59@...f.ucam.org, keyrings@...ux-nfs.org,
	dmitry.kasatkin@...il.com, mcgrof@...e.com,
	linux-kernel@...r.kernel.org, seth.forshee@...onical.com,
	linux-security-module@...r.kernel.org, dwmw2@...radead.org
Subject: Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4]

Andy Lutomirski <luto@...nel.org> wrote:

> I think this is way more complicated than it has to be.  Can't we look up
> certificates by their subjectPublicKeyInfo?

I want to be able to handle an X.509 chain to a root key that we have in the
kernel.  X.509 certs don't chain on subjectPublicKeyInfo unless that happens
to be what's in the SKID (which is a pretty indefinite standard in its own
right:-( ).  So we need to be able to match on the two things I made available
anyway.  PKCS#7 matches on one of them too, so that then just works.

> Why is PKCS#7 better than whatever we're using now?

It has a standard form[*].  It has standard ways to specify things such as the
key to use and the digest to use.  It can carry multiple signatures from
different keys and can carry key chains (something that's more likely to be
useful for kexec or firmware, admittedly).  It can be generated by extant
tools (though adding it onto a module needs a special tool).

 [*] We can agree it's a somewhat, um, ropy standard, but it's still a
     standard.

What we're using now isn't very extensible without changing the magic string
or putting in an override in one of the fields.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/