Messages in this thread | | | Date | Tue, 27 Oct 2015 12:42:55 +0200 | From | Jarkko Sakkinen <> | Subject | Re: [PATCH] keys, trusted: select TPM2 hash algorithm |
| |
n Mon, Oct 26, 2015 at 07:44:39AM +0200, Jarkko Sakkinen wrote: > On Sun, Oct 25, 2015 at 03:21:31PM -0400, Mimi Zohar wrote: > > On Sat, 2015-10-24 at 15:42 +0300, Jarkko Sakkinen wrote: > > > Added 'hashalg=' option for selecting the hash algorithm. > > > > > > Currently available options are: > > > > > > * sha1 > > > * sha256 > > > * sha384 > > > * sha512 > > > * sm3_256 > > > > Please consider using crypto/hash_info.c: hash_algo_name[], which > > already define the algorithm string names. Use > > include/crypto/hash_info.c to include a reference to this array. > > It wold work for me. I did ad-hoc because first example that I looked > at was EcryptFS. > > I need to add sm3_256 to that array. > > I've found three different ways to write it: > > * sm3256 (various google hits) > * sm3-256 (various google hits) > * sm3_256 (TPM 2.0 Structures specification) > > Maybe the second option would be the most appropriate? > > > Boot command line options should be prefixed with the subsystem name. > > So instead of hashalg, please use tpm_hashalg. The boot command line > > option needs to be documented in Documentation/kernel-parameters.txt. > > I see. My commit message is clearly inadequate. It's an option for the > keyring syscalls.
BTW, in IMA I see you have the hash algorithm as a boot parameter. I guess it makes sense there because it works implicitly in the background?
Sealing a trusted key is an explicit operation. That's why I thought it'd be better to have it as an option for the syscall. Does this logic make sense to your or not?
> > Mimi
PS. Hey one more thing: this was supposed to be RFC, forgot to add --subject-prefix="PATCH RFC". Sorry about that.
> /Jarkko
/Jarkko
| |