linux-kernel - [PATCH 0/8] KEYS: keyctl operations for asymmetric keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <146668964650.2880.17571426835045239156.stgit@warthog.procyon.org.uk>
Date:	Thu, 23 Jun 2016 14:47:26 +0100
From:	David Howells <dhowells@...hat.com>
To:	mathew.j.martineau@...ux.intel.com, dwmw2@...radead.org,
	tadeusz.struk@...el.com
Cc:	dhowells@...hat.com, linux-security-module@...r.kernel.org,
	keyrings@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-crypto@...r.kernel.org
Subject: [PATCH 0/8] KEYS: keyctl operations for asymmetric keys


Here's a set of patches that provides keyctl access for asymmetric keys,
including a query function, and functions to do encryption, decryption,
signature creation and signature verification.

I've added a PKCS#8 asymmetric key parser so that you can load an RSA private
key into the kernel.  Currently only DER-encoded and unencrypted PKCS#8 is
supported.  Encryption and verification can use a public key from an X.509
cert, but signing and decryption require a private key, though encryption and
verification can use that too.

Example usage:

	j=`openssl pkcs8 -in private_key.pem -topk8 -nocrypt -outform DER | \
	    keyctl padd asymmetric foo @s`
	echo -n abcdefghijklmnopqrst >/tmp/data
	keyctl pkey_encrypt $j /tmp/data enc=pkcs1 >/tmp/enc
	keyctl pkey_decrypt $j /tmp/enc enc=pkcs1 >/tmp/dec
	cmp /tmp/data /tmp/dec
	keyctl pkey_sign $j /tmp/data enc=pkcs1 hash=sha1 >/tmp/sig
	keyctl pkey_verify $j /tmp/data /tmp/sig enc=pkcs1 hash=sha1

Changes:

 (*) I've taken out the password parameters for the moment as there isn't
     yet a subtype that uses them.  I have, however, left space in the
     keyctl UAPI to add them back later.

The kernel patches can be found here also:

	http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-asym-keyctl

The keyutils changes needed can be found here:

	http://git.kernel.org/cgit/linux/kernel/git/dhowells/keyutils.git/log/?h=pkey

David
---
David Howells (8):
      KEYS: Provide key type operations for asymmetric key ops
      KEYS: Provide keyctls to drive the new key type ops for asymmetric keys
      KEYS: Provide missing asymmetric key subops for new key type ops
      KEYS: Make the X.509 and PKCS7 parsers supply the sig encoding type
      KEYS: Provide software public key query function
      KEYS: Allow the public_key struct to hold a private key
      KEYS: Implement encrypt, decrypt and sign for software asymmetric key
      KEYS: Implement PKCS#8 RSA Private Key parser


 Documentation/crypto/asymmetric-keys.txt  |   26 ++
 Documentation/security/keys.txt           |  217 +++++++++++++++++++
 crypto/asymmetric_keys/Kconfig            |   10 +
 crypto/asymmetric_keys/Makefile           |   13 +
 crypto/asymmetric_keys/asymmetric_keys.h  |    3 
 crypto/asymmetric_keys/asymmetric_type.c  |   59 +++++
 crypto/asymmetric_keys/pkcs7_parser.c     |    1 
 crypto/asymmetric_keys/pkcs8.asn1         |   24 ++
 crypto/asymmetric_keys/pkcs8_parser.c     |  184 +++++++++++++++++
 crypto/asymmetric_keys/public_key.c       |  195 ++++++++++++++++--
 crypto/asymmetric_keys/signature.c        |   95 +++++++++
 crypto/asymmetric_keys/x509_cert_parser.c |   21 +-
 include/crypto/public_key.h               |   14 +
 include/keys/asymmetric-subtype.h         |    9 +
 include/linux/key-type.h                  |   11 +
 include/linux/keyctl.h                    |   46 ++++
 include/uapi/linux/keyctl.h               |   30 +++
 security/keys/Makefile                    |    1 
 security/keys/compat.c                    |   18 ++
 security/keys/internal.h                  |   39 ++++
 security/keys/keyctl.c                    |   24 ++
 security/keys/keyctl_pkey.c               |  323 +++++++++++++++++++++++++++++
 22 files changed, 1319 insertions(+), 44 deletions(-)
 create mode 100644 crypto/asymmetric_keys/pkcs8.asn1
 create mode 100644 crypto/asymmetric_keys/pkcs8_parser.c
 create mode 100644 include/linux/keyctl.h
 create mode 100644 security/keys/keyctl_pkey.c