Messages in this thread |  | | Date | Mon, 18 Nov 2013 21:40:59 +0200 | Subject | Re: [PATCH 5/6] ima: do not include field length in template digest calc for ima template | From | Dmitry Kasatkin <> |
| |
On Mon, Nov 18, 2013 at 5:50 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote: > On Mon, 2013-11-18 at 17:30 +0200, Dmitry Kasatkin wrote: >> On Fri, Nov 15, 2013 at 3:45 PM, Roberto Sassu <roberto.sassu@polito.it> wrote: > >> > @@ -160,12 +161,13 @@ static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data, >> > return rc; >> > >> > for (i = 0; i < num_fields; i++) { >> > - rc = crypto_shash_update(&desc.shash, >> > - (const u8 *) &field_data[i].len, >> > - sizeof(field_data[i].len)); >> > - if (rc) >> > - break; >> > - >> > + if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) { >> > + rc = crypto_shash_update(&desc.shash, >> > + (const u8 *) &field_data[i].len, >> > + sizeof(field_data[i].len)); >> > + if (rc) >> > + break; >> > + } >> >> What was actually the point in including field length in the hash calculation? >> Does it really make it cryptographically stronger? >> If not then remove it at all... > > We should be able to walk the measurement list without needing to > understand template specific data. All of the template data, including > the field lengths, needs to be included in the template hash. >
Sorry, how adding field length helps walking measurement list? It makes it even more tricky...
Previously, I could calculate the hash over the whole template data from binary_measurement_list to get template hash. Now every field must be processed separately to get template hash...
- Dmitry
> Mimi >
-- Thanks, Dmitry
|  |