lkml.org 
[lkml]   [2021]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v10 9/9] certs: Add support for using elliptic curve keys for signing modules
    Date
    From: Stefan Berger <stefanb@linux.ibm.com>

    This patch adds support for using elliptic curve keys for signing
    modules. It uses a NIST P384 (secp384r1) key if the user chooses an
    elliptic curve key and will have ECDSA support built into the kernel.

    Note: A developer choosing an ECDSA key for signing modules has to
    manually delete the signing key (rm certs/signing_key.*) when falling
    back to building an older version of a kernel that only supports RSA
    keys since otherwise ECDSA-signed modules will not be usable when that
    older kernel runs and the ECDSA key was still used for signing modules.

    Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>

    ---

    v8->v9:
    - Automatically select CONFIG_ECDSA for built-in ECDSA support
    - Added help documentation

    This patch builds on top Nayna's series for 'kernel build support for
    loading the kernel module signing key'.
    - https://lkml.org/lkml/2021/2/18/856
    ---
    certs/Kconfig | 22 ++++++++++++++++++++++
    certs/Makefile | 14 ++++++++++++++
    crypto/asymmetric_keys/pkcs7_parser.c | 4 ++++
    3 files changed, 40 insertions(+)

    diff --git a/certs/Kconfig b/certs/Kconfig
    index 48675ad319db..919db43ce80b 100644
    --- a/certs/Kconfig
    +++ b/certs/Kconfig
    @@ -15,6 +15,28 @@ config MODULE_SIG_KEY
    then the kernel will automatically generate the private key and
    certificate as described in Documentation/admin-guide/module-signing.rst

    +choice
    + prompt "Type of module signing key to be generated"
    + default MODULE_SIG_KEY_TYPE_RSA
    + help
    + The type of module signing key type to generated. This option
    + does not apply if a #PKCS11 URI is used.
    +
    +config MODULE_SIG_KEY_TYPE_RSA
    + bool "RSA"
    + depends on MODULE_SIG || IMA_APPRAISE_MODSIG
    + help
    + Use an RSA key for module signing.
    +
    +config MODULE_SIG_KEY_TYPE_ECDSA
    + bool "ECDSA"
    + select CRYPTO_ECDSA
    + depends on MODULE_SIG || IMA_APPRAISE_MODSIG
    + help
    + Use an elliptic curve key (NIST P384) for module signing.
    +
    +endchoice
    +
    config SYSTEM_TRUSTED_KEYRING
    bool "Provide system-wide ring of trusted keys"
    depends on KEYS
    diff --git a/certs/Makefile b/certs/Makefile
    index 3fe6b73786fa..c487d7021c54 100644
    --- a/certs/Makefile
    +++ b/certs/Makefile
    @@ -69,6 +69,18 @@ else
    SIGNER = -signkey $(obj)/signing_key.key
    endif # CONFIG_IMA_APPRAISE_MODSIG

    +X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text)
    +
    +# Support user changing key type
    +ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA
    +keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1
    +$(if $(findstring ecdsa-with-,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY)))
    +endif
    +
    +ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA
    +$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY)))
    +endif
    +
    $(obj)/signing_key.pem: $(obj)/x509.genkey
    @$(kecho) "###"
    @$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
    @@ -86,12 +98,14 @@ ifeq ($(CONFIG_IMA_APPRAISE_MODSIG),y)
    -batch -x509 -config $(obj)/x509.genkey \
    -outform PEM -out $(CA_KEY) \
    -keyout $(CA_KEY) -extensions ca_ext \
    + $(keytype_openssl) \
    $($(quiet)redirect_openssl)
    endif # CONFIG_IMA_APPRAISE_MODSIG
    $(Q)openssl req -new -nodes -utf8 \
    -batch -config $(obj)/x509.genkey \
    -outform PEM -out $(obj)/signing_key.csr \
    -keyout $(obj)/signing_key.key -extensions myexts \
    + $(keytype_openssl) \
    $($(quiet)redirect_openssl)
    $(Q)openssl x509 -req -days 36500 -in $(obj)/signing_key.csr \
    -outform PEM -out $(obj)/signing_key.crt $(SIGNER) \
    diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
    index 967329e0a07b..2546ec6a0505 100644
    --- a/crypto/asymmetric_keys/pkcs7_parser.c
    +++ b/crypto/asymmetric_keys/pkcs7_parser.c
    @@ -269,6 +269,10 @@ int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen,
    ctx->sinfo->sig->pkey_algo = "rsa";
    ctx->sinfo->sig->encoding = "pkcs1";
    break;
    + case OID_id_ecdsa_with_sha256:
    + ctx->sinfo->sig->pkey_algo = "ecdsa";
    + ctx->sinfo->sig->encoding = "x962";
    + break;
    default:
    printk("Unsupported pkey algo: %u\n", ctx->last_oid);
    return -ENOPKG;
    --
    2.29.2
    \
     
     \ /
      Last update: 2021-03-05 01:52    [W:4.034 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site