lkml.org 
[lkml]   [2013]   [Nov]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 5/6] ima: do not include field length in template digest calc for ima template
From
Date
On Mon, 2013-11-18 at 21:40 +0200, Dmitry Kasatkin wrote:
> On Mon, Nov 18, 2013 at 5:50 PM, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> > On Mon, 2013-11-18 at 17:30 +0200, Dmitry Kasatkin wrote:
> >> On Fri, Nov 15, 2013 at 3:45 PM, Roberto Sassu <roberto.sassu@polito.it> wrote:
> >
> >> > @@ -160,12 +161,13 @@ static int ima_calc_field_array_hash_tfm(struct ima_field_data *field_data,
> >> > return rc;
> >> >
> >> > for (i = 0; i < num_fields; i++) {
> >> > - rc = crypto_shash_update(&desc.shash,
> >> > - (const u8 *) &field_data[i].len,
> >> > - sizeof(field_data[i].len));
> >> > - if (rc)
> >> > - break;
> >> > -
> >> > + if (strcmp(td->name, IMA_TEMPLATE_IMA_NAME) != 0) {
> >> > + rc = crypto_shash_update(&desc.shash,
> >> > + (const u8 *) &field_data[i].len,
> >> > + sizeof(field_data[i].len));
> >> > + if (rc)
> >> > + break;
> >> > + }
> >>
> >> What was actually the point in including field length in the hash calculation?
> >> Does it really make it cryptographically stronger?
> >> If not then remove it at all...
> >
> > We should be able to walk the measurement list without needing to
> > understand template specific data. All of the template data, including
> > the field lengths, needs to be included in the template hash.
> >
>
> Sorry, how adding field length helps walking measurement list?
> It makes it even more tricky...

The new template architecture adds sending the field length.

> Previously, I could calculate the hash over the whole template data
> from binary_measurement_list to get template hash.

> Now every field must be processed separately to get template hash...

You still calculate the template hash based on the entire template data,
including the lengths. Without including the lengths in the hash
calculation, you would need to parse the individual template field
data.

Mimi



\
 
 \ /
  Last update: 2013-11-18 21:21    [W:1.199 / U:0.140 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site