Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4] | Date | Wed, 20 May 2015 14:36:09 +0100 |
| |
Andy Lutomirski <luto@kernel.org> wrote:
> I think this is way more complicated than it has to be. Can't we look up > certificates by their subjectPublicKeyInfo?
I want to be able to handle an X.509 chain to a root key that we have in the kernel. X.509 certs don't chain on subjectPublicKeyInfo unless that happens to be what's in the SKID (which is a pretty indefinite standard in its own right:-( ). So we need to be able to match on the two things I made available anyway. PKCS#7 matches on one of them too, so that then just works.
> Why is PKCS#7 better than whatever we're using now?
It has a standard form[*]. It has standard ways to specify things such as the key to use and the digest to use. It can carry multiple signatures from different keys and can carry key chains (something that's more likely to be useful for kexec or firmware, admittedly). It can be generated by extant tools (though adding it onto a module needs a special tool).
[*] We can agree it's a somewhat, um, ropy standard, but it's still a standard.
What we're using now isn't very extensible without changing the magic string or putting in an override in one of the fields.
David
| |