Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2]

From	David Howells <dhowells@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2]
Date	2016-01-05 17:00 +0100
Message-ID	<qNCbF-4Sl-21@gated-at.bofh.it> (permalink)
References	<qNC1Y-4OF-27@gated-at.bofh.it>
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw

David Howells <dhowells@redhat.com> wrote:

> If a certificate is self-signed, don't bother checking the validity of the
> signature.  The cert cannot be checked by validation against the next one
> in the chain as this is the root of the chain.  Trust for this certificate
> can only be determined by whether we obtained it from a trusted location
> (ie. it was built into the kernel at compile time).
> 
> This also fixes a bug whereby certificates were being assumed to be
> self-signed if they had neither AKID nor SKID, the symptoms of which show
> up as an attempt to load a certificate failing with -ERANGE or -EBADMSG.
> This is produced from the RSA module when the result of calculating "m =
> s^e mod n" is checked.

Oops - I forgot to change the patch description.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-05 16:50 +0100
  Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-05 17:00 +0100
  Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-05 17:10 +0100
    Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-05 17:40 +0100
      Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-06 13:40 +0100
        Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-06 14:30 +0100
          Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-06 15:10 +0100
            Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-06 15:20 +0100
          Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Petko Manolov <petkan@mip-labs.com> - 2016-01-06 18:10 +0100
    Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-05 17:50 +0100
      Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Petko Manolov <petkan@mip-labs.com> - 2016-01-05 18:10 +0100

csiph-web