linux-kernel - Re: [PATCH v7 5/5] keys: asymmetric: Add tpm2_key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 29 May 2024 04:14:58 +0300
From: "Jarkko Sakkinen" <jarkko@...nel.org>
To: "Stefan Berger" <stefanb@...ux.ibm.com>, "Herbert Xu"
 <herbert@...dor.apana.org.au>
Cc: <linux-integrity@...r.kernel.org>, <keyrings@...r.kernel.org>,
 <Andreas.Fuchs@...ineon.com>, "James Prestwood" <prestwoj@...il.com>,
 "David Woodhouse" <dwmw2@...radead.org>, "Eric Biggers"
 <ebiggers@...nel.org>, "James Bottomley"
 <James.Bottomley@...senpartnership.com>, <linux-crypto@...r.kernel.org>,
 "Lennart Poettering" <lennart@...ttering.net>, "David S. Miller"
 <davem@...emloft.net>, "open list" <linux-kernel@...r.kernel.org>, "David
 Howells" <dhowells@...hat.com>, "Peter Huewe" <peterhuewe@....de>, "Jason
 Gunthorpe" <jgg@...pe.ca>, "Ard Biesheuvel" <ardb@...nel.org>, "Mario
 Limonciello" <mario.limonciello@....com>
Subject: Re: [PATCH v7 5/5] keys: asymmetric: Add tpm2_key_ecdsa

On Wed May 29, 2024 at 2:15 AM EEST, Stefan Berger wrote:
> > +	ptr[TPM2_KEY_ECDSA_SIG_R_TAG] = 0x02; /* INTEGER */
> > +	ptr[TPM2_KEY_ECDSA_SIG_R_SIZE] = SHA256_DIGEST_SIZE + r_0;
>
> The size of the signature has nothing to do with the size of the hash. 
> SHA256_DIGEST_SIZE (32) happens to match the number of bytes of a 
> coordinate of prime256v1 / NIST p256 but should fail when you use 
> secp521r1 / NIST p521 since then r or s may then be 66 or 67 bytes (if 
> most sign. bit is set) long.

First remark did not go unnoticed, so thanks for both. There was not
just much to comment on it :-)

I could just replace the constant with a (range checked) variable
read from the response and overall structure woud be the same.

This will also mean that in the case of P521 also prefix byte (0x81) is
required but just for the sequence I think, not for the integers.

Finally, I need to implement p521 smoke test for testing this patch set.

One big letdown that I only now have consciously realized, is that TCG
does not have p256k1 in their algorithm repository. It is the basis for
quite a few blockchain technologies. I wonder why...

BR, Jarkko