Re: [PATCH 5/8] KEYS: Provide software public key query function [ver #2]

From	Herbert Xu <herbert@gondor.apana.org.au>
Newsgroups	linux.kernel
Subject	Re: [PATCH 5/8] KEYS: Provide software public key query function [ver #2]
Date	2016-06-24 12:10 +0200
Message-ID	<rNwdH-6IP-3@gated-at.bofh.it> (permalink)
References	<rNf3b-3EH-3@gated-at.bofh.it>
Organization	Core

Show all headers | View raw

Mat Martineau <mathew.j.martineau@linux.intel.com> wrote:
>
>> +     if (strcmp(encoding, "pkcs1") == 0) {
>> +             /* The data wangled by the RSA algorithm is typically padded
>> +              * and encoded in some manner, such as EMSA-PKCS1-1_5 [RFC3447
>> +              * sec 8.2].
>> +              */
>> +             if (!hash_algo)
>> +                     n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
>> +                                  "pkcs1pad(%s)",
>> +                                  pkey->pkey_algo);
> 
> Did you see Herbert's patch that strips out non-hash pkcs1pad capabilities 
> (and the ensuing discussion)?
> 
> http://www.spinics.net/lists/linux-crypto/index.html#20432
> 
> I'm making use of pkcs1pad(rsa) with a TLS implementation, so it's good to 
> see it supported here.

Indeed I'm nacking this patch because it's exporting a purely
software algorithm to user-space for no good reason.  AFAICS
there is nothing in the pkcs1pad code that cannot be done in
user-space, even assuming that your private key is secret and
only accessible from the kernel.

IOW exporting the raw RSA might make sense because the key may
not be visible to user-space, or that the RSA might be implemented
in hardware offload, but there is no sane reason to export pkcs1pad.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH 5/8] KEYS: Provide software public key query function  [ver #2] Herbert Xu <herbert@gondor.apana.org.au> - 2016-06-24 12:10 +0200
  Re: [PATCH 5/8] KEYS: Provide software public key query function [ver #2] David Howells <dhowells@redhat.com> - 2016-06-24 14:10 +0200
    Re: [PATCH 5/8] KEYS: Provide software public key query function  [ver #2] Herbert Xu <herbert@gondor.apana.org.au> - 2016-06-25 03:40 +0200
      Re: [PATCH 5/8] KEYS: Provide software public key query function [ver #2] David Howells <dhowells@redhat.com> - 2016-06-27 16:30 +0200
        Re: [PATCH 5/8] KEYS: Provide software public key query function  [ver #2] Herbert Xu <herbert@gondor.apana.org.au> - 2016-06-28 07:40 +0200

csiph-web