linux-kernel - Re: [PATCH v3 00/14] KEYS: Add support for PGP keys and signatures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <D45Z0FUO6UXA.3SUWRYAENNFNT@kernel.org>
Date: Sat, 14 Sep 2024 14:29:16 +0300
From: "Jarkko Sakkinen" <jarkko@...nel.org>
To: "Herbert Xu" <herbert@...dor.apana.org.au>, "Roberto Sassu"
 <roberto.sassu@...weicloud.com>
Cc: <dhowells@...hat.com>, <dwmw2@...radead.org>, <davem@...emloft.net>,
 <linux-kernel@...r.kernel.org>, <keyrings@...r.kernel.org>,
 <linux-crypto@...r.kernel.org>, <zohar@...ux.ibm.com>,
 <linux-integrity@...r.kernel.org>, <torvalds@...ux-foundation.org>,
 <roberto.sassu@...wei.com>
Subject: Re: [PATCH v3 00/14] KEYS: Add support for PGP keys and signatures

On Fri Sep 13, 2024 at 7:45 AM EEST, Herbert Xu wrote:
> Roberto Sassu <roberto.sassu@...weicloud.com> wrote:
> >
> > For the envisioned use cases, PGP operations cannot be done in user space,
> > since the consumers are in the kernel itself (Integrity Digest Cache and
> > IMA). Also they cannot be done in a trusted initial ram disk, since PGP
> > operations can occur also while the system is running (e.g. after software
> > package installation).
>
> Does this address Linus's objections? If not then we cannot proceed.

I don't get why integrity digest cache is brought up in patch set
discussion in the first place. It is RFC patch set. It is misleading
to bring up everywhere as it was something we would need to take in
the account.

Let's worry about that once it is even a feature.

BR, Jarkko