Messages in this thread | | | Date | Fri, 1 Mar 2013 00:02:43 +0100 (CET) | From | Jiri Kosina <> | Subject | Re: [GIT PULL] Load keys from signed PE binaries |
| |
On Thu, 28 Feb 2013, Matthew Garrett wrote:
> > Let me formulate my point more clearly -- Microsoft very likely going to > > sign hello world EFI PE binary, no matter the contents of .keylist > > section, as they don't give a damn about this section, as it has zero > > semantic value to them, right? > > > > They sign the binary. By signing the binary, they are *NOT* establishing > > cryptographic chain of trust to the key stored in .keylist, but your > > patchset seems to imply so. > > Mr Evil Blackhat's binary is then a mechanism for circumventing the > Windows trust mechanism,
Yes, the "hello world" one.
But the real harm is being done by the i_own_your_ring0.ko module, which can be modprobed on all the systems where the signed "hello world" binary has been keyctl-ed before it was blacklisted.
In other words -- you blacklist the population of the key on systems by blakclisting the key-carrying binary, but the key remains trusted on whatever system the binary has been processed by keyctl before. Right?
If so, that's a clear difference from normal X.509 chain of trust (i.e. the difference between having the key signed, and having the binary signed).
-- Jiri Kosina SUSE Labs
| |