linux-kernel - Re: [RFC PATCH v2] akcipher: Introduce verify

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <24887.1547658740@warthog.procyon.org.uk>
Date:   Wed, 16 Jan 2019 17:12:20 +0000
From:   David Howells <dhowells@...hat.com>
To:     Vitaly Chikunov <vt@...linux.org>
Cc:     dhowells@...hat.com, Tudor Ambarus <tudor-dan.ambarus@....com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S. Miller" <davem@...emloft.net>,
        Maxime Coquelin <mcoquelin.stm32@...il.com>,
        Alexandre Torgue <alexandre.torgue@...com>,
        Horia Geantă <horia.geanta@....com>,
        Aymen Sghaier <aymen.sghaier@....com>,
        Tom Lendacky <thomas.lendacky@....com>,
        Gary Hook <gary.hook@....com>,
        Giovanni Cabiddu <giovanni.cabiddu@...el.com>,
        linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
        keyrings@...r.kernel.org, linux-stm32@...md-mailman.stormreply.com,
        linux-arm-kernel@...ts.infradead.org, qat-linux@...el.com
Subject: Re: [RFC PATCH v2] akcipher: Introduce verify_rsa/verify for public key algorithms

Umm...  What do I apply this patch to?

In your modified public_key_verify_signature():

> -	sg_init_one(&digest_sg, output, outlen);
> -	akcipher_request_set_crypt(req, &sig_sg, &digest_sg, sig->s_size,
> +	sg_init_one(&output_sg, output, outlen);
> +	akcipher_request_set_crypt(req, &sig_sg, &output_sg, sig->s_size,
>  				   outlen);

Why is the output necessary?  It was there for the decoded hash to be placed
in prior to comparison - but now that's not necessary.

> -	ret = crypto_wait_req(crypto_akcipher_verify(req), &cwait);
> +	ret = crypto_wait_req(crypto_akcipher_verify(req, sig->digest,
> +						     sig->digest_size), &cwait);

I see sig->digest is passed in here.  Should it be passed in in place of
output_sg above?

> -	inst->alg.verify = pkcs1pad_verify;
> +	inst->alg.verify_rsa = pkcs1pad_verify;

Is there a reason that pkcs1pad_verify() can't do the comparison?

> -	.verify = rsa_verify,
> +	.verify_rsa = rsa_verify,

Likewise verify_rsa()?

Granted, this might involve pkcs1pad_verify() dressing up the signature in the
appropriate wrappings and passing it along to verify_rsa() to do the actual
comparison there (ie. what pkcs1pad_verify_complete() does).

> -	.verify = caam_rsa_enc,
> +	.verify_rsa = caam_rsa_enc,

I presume this is the reason - because this reuses its encrypt operation
directly.  But could this instead perform the comparison upon completion, say
in rsa_pub_done()?

> -	.verify = qat_rsa_enc,
> +	.verify_rsa = qat_rsa_enc,

Again, this could do the comparison, say, in qat_rsa_cb().

David