leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ima: Support EC keys for signature verification

Browse Source 
Add support for IMA signature verification for EC keys. Since SHA type
of hashes can be used by RSA and ECDSA signature schemes we need to
look at the key and derive from the key which signature scheme to use.
Since this can be applied to all types of keys, we change the selection
of the encoding type to be driven by the key's signature scheme rather
than by the hash type.

Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: linux-integrity@vger.kernel.org
Cc: David Howells <dhowells@redhat.com>
Cc: keyrings@vger.kernel.org
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
Reviewed-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Acked-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Stefan Berger 2021-03-16 17:07:38 -04:00 committed by Herbert Xu
parent 299f561a66
commit 947d705972
2 changed files with 20 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/keys/asymmetric-type.h
View File

@ -72,6 +72,12 @@ const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
return key->payload.data[asym_key_ids];
}
static inline
const struct public_key *asymmetric_key_public_key(const struct key *key)
{
return key->payload.data[asym_crypto];
}
extern struct key *find_asymmetric_key(struct key *keyring,
const struct asymmetric_key_id *id_0,
const struct asymmetric_key_id *id_1,

30
security/integrity/digsig_asymmetric.c
View File

@ -84,6 +84,7 @@ int asymmetric_verify(struct key *keyring, const char *sig,
{
struct public_key_signature pks;
struct signature_v2_hdr *hdr = (struct signature_v2_hdr *)sig;
const struct public_key *pk;
struct key *key;
int ret;
@ -105,23 +106,20 @@ int asymmetric_verify(struct key *keyring, const char *sig,
memset(&pks, 0, sizeof(pks));
pks.hash_algo = hash_algo_name[hdr->hash_algo];
switch (hdr->hash_algo) {
case HASH_ALGO_STREEBOG_256:
case HASH_ALGO_STREEBOG_512:
/* EC-RDSA and Streebog should go together. */
pks.pkey_algo = "ecrdsa";
pks.encoding = "raw";
break;
case HASH_ALGO_SM3_256:
/* SM2 and SM3 should go together. */
pks.pkey_algo = "sm2";
pks.encoding = "raw";
break;
default:
pks.pkey_algo = "rsa";
pk = asymmetric_key_public_key(key);
pks.pkey_algo = pk->pkey_algo;
if (!strcmp(pk->pkey_algo, "rsa"))
pks.encoding = "pkcs1";
break;
}
else if (!strncmp(pk->pkey_algo, "ecdsa-", 6))
/* edcsa-nist-p192 etc. */
pks.encoding = "x962";
else if (!strcmp(pk->pkey_algo, "ecrdsa") ||
!strcmp(pk->pkey_algo, "sm2"))
pks.encoding = "raw";
else
return -ENOPKG;
pks.digest = (u8 *)data;
pks.digest_size = datalen;
pks.s = hdr->sig;