linux-kernel - Re: [PATCH v2] KEYS: encrypted: fix key instantiation with user-provided data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Y0exHaHxEvj9FC/O@pevik>
Date:   Thu, 13 Oct 2022 08:33:01 +0200
From:   Petr Vorel <pvorel@...e.cz>
To:     Mimi Zohar <zohar@...ux.ibm.com>
Cc:     Nikolaus Voss <nv@...n.de>, David Howells <dhowells@...hat.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>, Yael Tzur <yaelt@...gle.com>,
        Cyril Hrubis <chrubis@...e.cz>,
        linux-integrity@...r.kernel.org, keyrings@...r.kernel.org,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] KEYS: encrypted: fix key instantiation with
 user-provided data

Hi Nikolaus, all,

> Hi Nikolaus,

> On Wed, 2022-10-12 at 17:09 +0200, Nikolaus Voss wrote:
> > Commit cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided
> > decrypted data") added key instantiation with user provided decrypted data.
> > The user data is hex-ascii-encoded but was just memcpy'ed to the binary buffer.
> > Fix this to use hex2bin instead.

> > Keys created from user provided decrypted data saved with "keyctl pipe"
> > are still valid, however if the key is recreated from decrypted data the
> > old key must be converted to the correct format. This can be done with a
> > small shell script, e.g.:

> > BROKENKEY=abcdefABCDEF1234567890aaaaaaaaaa
> > NEWKEY=$(echo -ne $BROKENKEY | xxd -p -c64)
> > keyctl add user masterkey "$(cat masterkey.bin)" @u
> > keyctl add encrypted testkey "new user:masterkey 32 $NEWKEY" @u

> > It is encouraged to switch to a new key because the effective key size
> > of the old keys is only half of the specified size.

> Thank you for updating the patch description.


> > The corresponding test for the Linux Test Project ltp has been fixed
> > with this patch:
> > https://lists.linux.it/pipermail/ltp/2022-October/031060.html
FYI, we use lore, thus:

Link: https://lore.kernel.org/ltp/20221006081709.92303897@mail.steuer-voss.de/

> Perhaps make this a "Link:" line and move it before your "Signed-off-
> by".

> > Changes
> > =======

> As per Documentation/process/submitting-patches.rst, the changelog
> belongs after the "---" separator. 

> > v2: - clarify commit message, add example to recover old/broken keys
> >     - improve example in Documentation/security/keys/trusted-encrypted.rst
> >     - add link to ltp patch

> > Fixes: cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided decrypted data")
> > Cc: stable <stable@...nel.org>
> > Signed-off-by: Nikolaus Voss <nikolaus.voss@...g-streit.com>
> > ---
> >  Documentation/security/keys/trusted-encrypted.rst | 3 ++-
> >  security/keys/encrypted-keys/encrypted.c          | 6 +++---
> >  2 files changed, 5 insertions(+), 4 deletions(-)

> > diff --git a/Documentation/security/keys/trusted-encrypted.rst b/Documentation/security/keys/trusted-encrypted.rst
> > index 0bfb4c339748..e81e47db0b4c 100644
> > --- a/Documentation/security/keys/trusted-encrypted.rst
> > +++ b/Documentation/security/keys/trusted-encrypted.rst
> > @@ -350,7 +350,8 @@ Load an encrypted key "evm" from saved blob::

> >  Instantiate an encrypted key "evm" using user-provided decrypted data::

> > -    $ keyctl add encrypted evm "new default user:kmk 32 `cat evm_decrypted_data.blob`" @u
> > +    $ evmkey=abcdefABCDEF1234567890aaaaaaaaaaabcdefABCDEF1234567890aaaaaaaaaa
> > +    $ keyctl add encrypted evm "new default user:kmk 32 $evmkey" @u
> >      794890253

> As example code is often re-used, I would avoid including the key data
> on the command line.