linux-kernel - Re: [PATCH RESEND] KEYS: trusted: Use ASN.1 encoded OID

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 23 May 2024 09:38:13 -0400
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Jarkko Sakkinen <jarkko@...nel.org>, linux-integrity@...r.kernel.org
Cc: keyrings@...r.kernel.org, David Woodhouse <dwmw2@...radead.org>, Eric
 Biggers <ebiggers@...nel.org>, Herbert Xu <herbert@...dor.apana.org.au>,
 "David S. Miller" <davem@...emloft.net>, Andrew Morton
 <akpm@...ux-foundation.org>, Mimi Zohar <zohar@...ux.ibm.com>, David
 Howells <dhowells@...hat.com>, Paul Moore <paul@...l-moore.com>, James
 Morris <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>, "open
 list:CRYPTO API" <linux-crypto@...r.kernel.org>,  open list
 <linux-kernel@...r.kernel.org>, "open list:SECURITY SUBSYSTEM"
 <linux-security-module@...r.kernel.org>
Subject: Re: [PATCH RESEND] KEYS: trusted: Use ASN.1 encoded OID

On Thu, 2024-05-23 at 16:19 +0300, Jarkko Sakkinen wrote:
> There's no reason to encode OID_TPMSealedData at run-time, as it
> never changes.
> 
> Replace it with the encoded version, which has exactly the same size:
> 
>         67 81 05 0A 01 05
> 
> Include OBJECT IDENTIFIER (0x06) tag and length as the epilogue so
> that the OID can be simply copied to the blob.

This is true, but if we're going to do this, we should expand the OID
registry functions (in lib/oid_registry.c) to do something like
encode_OID.  The registry already contains the hex above minus the two
prefixes (which are easy to add).

I also note:

> @ -51,8 +52,8 @@ static int tpm2_key_encode(struct
> trusted_key_payload *payload,
>         if (!scratch)
>                 return -ENOMEM;
>  
> -       work = asn1_encode_oid(work, end_work, tpm2key_oid,
> -                              asn1_oid_len(tpm2key_oid));
> +       work = memcpy(work, OID_TPMSealedData_ASN1,
> sizeof(OID_TPMSealedData_ASN1));
> +       work += sizeof(OID_TPMSealedData_ASN1);

You lost the actually fits check.  This is somewhat irrelevant for TPM
keys because the OID is first in the structure and thus will never
overflow, but it might matter for other uses.

James