linux-kernel - [GIT PULL] certs: Make signature verification FIPS compliant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 21 Jun 2022 16:20:09 +0100
From:   David Howells <dhowells@...hat.com>
To:     torvalds@...ux-foundation.org
cc:     dhowells@...hat.com, simo@...hat.com,
        Herbert Xu <herbert@...dor.apana.org.au>,
        Jarkko Sakkinen <jarkko@...nel.org>, keyrings@...r.kernel.org,
        linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [GIT PULL] certs: Make signature verification FIPS compliant

Hi Linus,

Can you pull this please?  The signature checking code, as used by module
signing, kexec, etc., is non-FIPS compliant as there is no selftest.  For a
kernel to be FIPS-compliant, signature checking would have to be tested
before being used, and the box would need to panic if it's not available
(probably reasonable as simply disabling signature checking would prevent
you from loading any driver modules).

Deal with this by adding a minimal test.

This is split into two patches: the first moves load_certificate_list() to
the same place as the X.509 code to make it more accessible internally; the
second adds a selftest.

David

Link: https://lore.kernel.org/r/165515741424.1554877.9363755381201121213.stgit@warthog.procyon.org.uk/
---
The following changes since commit b13baccc3850ca8b8cccbf8ed9912dbaa0fdf7f3:

  Linux 5.19-rc2 (2022-06-12 16:11:37 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git tags/certs-20220621

for you to fetch changes up to 3cde3174eb910513d32a9ec8a9b95ea59be833df:

  certs: Add FIPS selftests (2022-06-21 16:05:12 +0100)

----------------------------------------------------------------
Certs changes

----------------------------------------------------------------
David Howells (2):
      certs: Move load_certificate_list() to be with the asymmetric keys code
      certs: Add FIPS selftests

 certs/Makefile                                     |   4 +-
 certs/blacklist.c                                  |   8 +-
 certs/common.h                                     |   9 -
 certs/system_keyring.c                             |   6 +-
 crypto/asymmetric_keys/Kconfig                     |  10 +
 crypto/asymmetric_keys/Makefile                    |   2 +
 crypto/asymmetric_keys/selftest.c                  | 224 +++++++++++++++++++++
 .../asymmetric_keys/x509_loader.c                  |   8 +-
 crypto/asymmetric_keys/x509_parser.h               |   9 +
 crypto/asymmetric_keys/x509_public_key.c           |   8 +-
 include/keys/asymmetric-type.h                     |   3 +
 11 files changed, 268 insertions(+), 23 deletions(-)
 delete mode 100644 certs/common.h
 create mode 100644 crypto/asymmetric_keys/selftest.c
 rename certs/common.c => crypto/asymmetric_keys/x509_loader.c (87%)