Messages in this thread |  | | Subject | Re: [PATCH 5/6] ima: do not include field length in template digest calc for ima template | From | Mimi Zohar <> | Date | Mon, 18 Nov 2013 10:50:40 -0500 |
| |
On Mon, 2013-11-18 at 17:30 +0200, Dmitry Kasatkin wrote: > On Fri, Nov 15, 2013 at 3:45 PM, Roberto Sassu <roberto.sassu@polito.it> wrote:
> > @@ -160,12 +161,13 @@ static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data, > > return rc; > > > > for (i = 0; i < num_fields; i++) { > > - rc = crypto_shash_update(&desc.shash, > > - (const u8 *) &field_data[i].len, > > - sizeof(field_data[i].len)); > > - if (rc) > > - break; > > - > > + if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) { > > + rc = crypto_shash_update(&desc.shash, > > + (const u8 *) &field_data[i].len, > > + sizeof(field_data[i].len)); > > + if (rc) > > + break; > > + } > > What was actually the point in including field length in the hash calculation? > Does it really make it cryptographically stronger? > If not then remove it at all...
We should be able to walk the measurement list without needing to understand template specific data. All of the template data, including the field lengths, needs to be included in the template hash.
Mimi
|  |