Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1439669

Re: [PATCH v8 6/6] crypto: AF_ALG - add support for key_id

Show all headers | View raw

On Fri, 8 Jul 2016, Tadeusz Struk wrote:

> Hi Mat,
> On 07/06/2016 12:38 PM, Mat Martineau wrote:
>>> So it looks like the only thing that we need to return to the user in
>>> this case is the return code. Do you agree?
>>
>> The way verify_signature is implemented today, the only output is the
>> return code. For verify, maybe no read is required (just sendmsg() and
>> check the return code).
>>
>> But this isn't the extent of the problem: verify_signature needs both
>> the signature to be verified and the expected hash as inputs. How is the
>> expected hash provided? Would you include it as a cmsg header?
>> ALG_OP_VERIFY should have consistent inputs and outputs whether the key
>> was set with ALG_SET_KEY_ID or ALG_SET_KEY.
>
> The signature of verify_signature() is quite different from the other
> new public key handlers, i.e. create_signature(), encrypt_blob(), and
> decrypt_blob(). For verify_signature() we need the following parameters:
> encrypted src, hash function to use, expected digest.
> The expected digest could be optional if we would modify the
> verify_signature() to return the decrypted buffer.
> I think the best solution for now would be to just return -ENOPROTOOPT
> for verify_signature in SET_KEY_ID mode.
> All the four operations will be supported in the SET_KEY mode and
> all but verify_signature() will be supported in the SET_KEY_ID mode.
> This can added later if we will find a way to pass all parameters in a
> consistent way. What do you think? If you are ok with that I will send a
> new version soon.

Are the inputs and outputs defined for ALG_OP_VERIFY in SET_KEY mode going 
to work for hardware keys (like TPM) in SET_KEY_ID mode? That's needed if 
the verify SET_KEY_ID mode is to be added later.

--
Mat Martineau
Intel OTC

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v8 6/6] crypto: AF_ALG - add support for key_id Tadeusz Struk <tadeusz.struk@intel.com> - 2016-06-24 01:00 +0200
  Re: [PATCH v8 6/6] crypto: AF_ALG - add support for key_id Mat Martineau <mathew.j.martineau@linux.intel.com> - 2016-06-29 20:50 +0200
    Re: [PATCH v8 6/6] crypto: AF_ALG - add support for key_id Tadeusz Struk <tadeusz.struk@intel.com> - 2016-07-05 22:30 +0200
      Re: [PATCH v8 6/6] crypto: AF_ALG - add support for key_id Mat Martineau <mathew.j.martineau@linux.intel.com> - 2016-07-06 21:40 +0200
        Re: [PATCH v8 6/6] crypto: AF_ALG - add support for key_id Tadeusz Struk <tadeusz.struk@intel.com> - 2016-07-08 17:30 +0200
          Re: [PATCH v8 6/6] crypto: AF_ALG - add support for key_id Mat Martineau <mathew.j.martineau@linux.intel.com> - 2016-07-08 18:50 +0200
            Re: [PATCH v8 6/6] crypto: AF_ALG - add support for key_id Tadeusz Struk <tadeusz.struk@intel.com> - 2016-07-08 19:30 +0200

csiph-web