lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 13 Oct 2022 22:10:54 -0400
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Nikolaus Voss <nv@...n.de>, David Howells <dhowells@...hat.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>, Yael Tzur <yaelt@...gle.com>,
        Cyril Hrubis <chrubis@...e.cz>, Petr Vorel <pvorel@...e.cz>
Cc:     linux-integrity@...r.kernel.org, keyrings@...r.kernel.org,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4] KEYS: encrypted: fix key instantiation with
 user-provided data

On Thu, 2022-10-13 at 08:39 +0200, Nikolaus Voss wrote:
> Commit cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided
> decrypted data") added key instantiation with user provided decrypted data.
> The user data is hex-ascii-encoded but was just memcpy'ed to the binary buffer.
> Fix this to use hex2bin instead.
> 
> Old keys created from user provided decrypted data saved with "keyctl pipe"
> are still valid, however if the key is recreated from decrypted data the
> old key must be converted to the correct format. This can be done with a
> small shell script, e.g.:
> 
> BROKENKEY=abcdefABCDEF1234567890aaaaaaaaaa
> NEWKEY=$(echo -ne $BROKENKEY | xxd -p -c32)
> keyctl add user masterkey "$(cat masterkey.bin)" @u
> keyctl add encrypted testkey "new user:masterkey 32 $NEWKEY" @u
> 
> It is encouraged to switch to a new key because the effective key size
> of the old keys is only half of the specified size.

Both the old and new decrypted data size is 32 bytes.  Is the above
statement necessary, especially since the Documentation example does
the equivalent?

> The corresponding test for the Linux Test Project ltp has also been
> fixed (see link below).

The LTP patch still needs to be revised, but the "Link" is a reference
to the discussion.  Is the above statement necessary?

> 
> Fixes: cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided decrypted data")
> Cc: stable <stable@...nel.org>
> Link: https://lore.kernel.org/ltp/20221006081709.92303897@mail.steuer-voss.de/
> Signed-off-by: Nikolaus Voss <nikolaus.voss@...g-streit.com>

Otherwise,

Reviewed-by: Mimi Zohar <zohar@...ux.ibm.com>

Powered by blists - more mailing lists