lkml.org 
[lkml]   [2012]   [Sep]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [GIT PULL] Asymmetric keys and module signing
    Date
    Kasatkin, Dmitry <dmitry.kasatkin@intel.com> wrote:

    > Just one question about key description...
    > request_asymmetric_key uses format for key description: "<signer>: <key-id>".
    > Preparsing code creates description from those values.
    > I see that key id is not 8 bytes anymore but full hash size of 20 bytes.

    Remember: This is for viewing via /proc/keys and KEYCTL_DESCRIBE as much as
    for matching.

    > For practical reasons for IMA it might be nice to save some space in
    > xattrs and use shorter key id/description.

    That's reasonable.

    > As I understand from implementation, if key name is provided with "keyctl
    > add", it will not be replaced with preparsed value.

    Correct.

    > And we can actually use any keyid we want?

    Yes.

    Note: The key type ->match() function is not required to limit itself to a
    direct strcmp(). It is at liberty to partially match the description or any
    other data attached to the key.

    Look at asymmetric_key_match() in crypto/asymmetric/asymmetric_type.c. If you
    do a search for:

    "id:<hex-string>"

    this will do a partial tail match on the key fingerprint:

    [root@andromeda ~]# keyctl padd asymmetric "" @s </tmp/uefi-x509
    289786205
    [root@andromeda ~]# cat /proc/keys
    1145c95d I--Q--- 1 perm 39390000 0 0 asymmetri Red Hat Test Certificate: 3580cf35d76b3b667a40df66691cbcf87353b23c: X509.RSA 7353b23c []
    ...
    [root@andromeda ~]# keyctl search @s asymmetric "id:53b23c"
    289786205


    As an optimisation, it might be worth internally calling keyring_search_aux()
    with our own match function that takes a binary key ID and storing the
    fingerprint as binary rather than hex (attached to key->type_data.p[1]).

    The type match function can only take text strings as it has to be invoked
    from userspace.

    David


    \
     
     \ /
      Last update: 2012-09-25 21:41    [W:3.216 / U:0.108 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site