Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1193921

Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, 2015-07-27 at 23:43 +0100, David Howells wrote:
> 
>     PKCS#7: Require authenticated attributes
>     
>     Require there to be authenticated attributes in the PKCS#7/CMS message so
>     that an attacker can't drop them to provide greater opportunity for
>     manipulating the message.

There doesn't seem to be a lot of point in this part. If the
authenticated attribute isn't being *checked*, then the attacker
doesn't need to drop it at all. There's no point in merely requiring
its *existence*.

As part of the firmware signatures, if we are asked to check the
filename then yes we should require it to be present *and* match. But
if we aren't checking (which we can't for modules since we don't know
what's being loaded), why require it to be present at all?

-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@intel.com                              Intel Corporation

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures David Howells <dhowells@redhat.com> - 2015-07-28 00:50 +0200
  Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures Andy Lutomirski <luto@amacapital.net> - 2015-07-28 01:20 +0200
    Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures David Howells <dhowells@redhat.com> - 2015-07-28 11:10 +0200
  Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures David Woodhouse <dwmw2@infradead.org> - 2015-07-28 11:20 +0200
    Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures David Howells <dhowells@redhat.com> - 2015-07-28 11:30 +0200

csiph-web