lkml.org 
[lkml]   [2015]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4]
Date
Andy Lutomirski <luto@amacapital.net> wrote:

> That being said, are you actually planning on implementing X.509 chain
> validation correctly? ISTM you can't really do it usefully, as we
> don't even know what time it is when we run this code.

We can't validate certificates based on time. We've been there, tried that
and patched it out again. The problem is that we can't trust the system clock
until we've done NTP - and possibly not even then. A dodgy or unset system
clock can lead to the system not booting, even for installation.

David


\
 
 \ /
  Last update: 2015-05-21 16:21    [W:0.192 / U:0.696 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site