[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <9c96f39ed2161dd7f0c3a7964cba2de3169fae3b.camel@HansenPartnership.com>
Date: Thu, 23 May 2024 09:38:13 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Jarkko Sakkinen <jarkko@...nel.org>, linux-integrity@...r.kernel.org
Cc: keyrings@...r.kernel.org, David Woodhouse <dwmw2@...radead.org>, Eric
Biggers <ebiggers@...nel.org>, Herbert Xu <herbert@...dor.apana.org.au>,
"David S. Miller" <davem@...emloft.net>, Andrew Morton
<akpm@...ux-foundation.org>, Mimi Zohar <zohar@...ux.ibm.com>, David
Howells <dhowells@...hat.com>, Paul Moore <paul@...l-moore.com>, James
Morris <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>, "open
list:CRYPTO API" <linux-crypto@...r.kernel.org>, open list
<linux-kernel@...r.kernel.org>, "open list:SECURITY SUBSYSTEM"
<linux-security-module@...r.kernel.org>
Subject: Re: [PATCH RESEND] KEYS: trusted: Use ASN.1 encoded OID
On Thu, 2024-05-23 at 16:19 +0300, Jarkko Sakkinen wrote:
> There's no reason to encode OID_TPMSealedData at run-time, as it
> never changes.
>
> Replace it with the encoded version, which has exactly the same size:
>
> 67 81 05 0A 01 05
>
> Include OBJECT IDENTIFIER (0x06) tag and length as the epilogue so
> that the OID can be simply copied to the blob.
This is true, but if we're going to do this, we should expand the OID
registry functions (in lib/oid_registry.c) to do something like
encode_OID. The registry already contains the hex above minus the two
prefixes (which are easy to add).
I also note:
> @ -51,8 +52,8 @@ static int tpm2_key_encode(struct
> trusted_key_payload *payload,
> if (!scratch)
> return -ENOMEM;
>
> - work = asn1_encode_oid(work, end_work, tpm2key_oid,
> - asn1_oid_len(tpm2key_oid));
> + work = memcpy(work, OID_TPMSealedData_ASN1,
> sizeof(OID_TPMSealedData_ASN1));
> + work += sizeof(OID_TPMSealedData_ASN1);
You lost the actually fits check. This is somewhat irrelevant for TPM
keys because the OID is first in the structure and thus will never
overflow, but it might matter for other uses.
James
Powered by blists - more mailing lists