Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1331029 > unrolled thread

Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a raw signature

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a raw signature David Howells <dhowells@redhat.com> - 2016-02-10 11:20 +0100
    Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a  raw signature David Woodhouse <dwmw2@infradead.org> - 2016-02-10 11:30 +0100
    Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a  raw signature Juerg Haefliger <juerg.haefliger@hpe.com> - 2016-02-10 14:10 +0100
    Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a  raw signature Juerg Haefliger <juerg.haefliger@hpe.com> - 2016-02-10 14:30 +0100
      Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a  raw signature Juerg Haefliger <juerg.haefliger@hpe.com> - 2016-02-18 10:30 +0100

#1331029 — Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a raw signature

Juerg Haefliger <juerg.haefliger@hpe.com> wrote:

> This patch adds support for signing a kernel module with a raw
> detached PKCS#7 signature/message.
> 
> The signature is not converted and is simply appended to the module so
> it needs to be in the right format. Using openssl, a valid signature can
> be generated like this:
>   $ openssl smime -sign -nocerts -noattr -binary -in <module> -inkey \
>     <key> -signer <x509> -outform der -out <raw sig>
> 
> The resulting raw signature from the above command is (more or less)
> identical to the raw signature that sign-file itself can produce like
> this:
>   $ scripts/sign-file -d <hash algo> <key> <x509> <module>

What's the usage case for this?  Can it be done instead with openssl PKCS#11?

David

[toc] | [next] | [standalone]

#1331035 — Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a raw signature

[Multipart message — attachments visible in raw view] — view raw

On Wed, 2016-02-10 at 10:12 +0000, David Howells wrote:
> Juerg Haefliger <juerg.haefliger@hpe.com> wrote:
> 
> > This patch adds support for signing a kernel module with a raw
> > detached PKCS#7 signature/message.
> > 
> > The signature is not converted and is simply appended to the module so
> > it needs to be in the right format. Using openssl, a valid signature can
> > be generated like this:
> >   $ openssl smime -sign -nocerts -noattr -binary -in  -inkey \
> >      -signer  -outform der -out 
> > 
> > The resulting raw signature from the above command is (more or less)
> > identical to the raw signature that sign-file itself can produce like
> > this:
> >   $ scripts/sign-file -d    
> 
> What's the usage case for this?  Can it be done instead with openssl PKCS#11?

Ah, right. That's what it was doing. Yeah, I have a vague recollection
of looking at this as we were doing the conversion to C, and concluding
that it was indeed a hackish workaround for the fact that the existing
setup didn't allow using external crypto devices via PKCS#11.

If you want to generate your signatures using external hardware, then
using sign-file with a PKCS#11 key definitely seems like the way to do
it. I believe I even tested it with the p11-kit remote mechanism, doing
the signing on a remote system over SSH.

There doesn't seem to be much of an excuse for doing otherwise on
security grounds — if this is the build system and you're going to
trust the modules which were built here, then copying them to separate
system and producing the signatures there is not really any different
to just allowing this system to invoke the signature-creation for
itself via PKCS#11, is it?

-- 
-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@intel.com                              Intel Corporation

[toc] | [prev] | [next] | [standalone]

#1331139 — Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a raw signature

On 02/10/2016 11:12 AM, David Howells wrote:
> Juerg Haefliger <juerg.haefliger@hpe.com> wrote:
> 
>> This patch adds support for signing a kernel module with a raw
>> detached PKCS#7 signature/message.
>>
>> The signature is not converted and is simply appended to the module so
>> it needs to be in the right format. Using openssl, a valid signature can
>> be generated like this:
>>   $ openssl smime -sign -nocerts -noattr -binary -in <module> -inkey \
>>     <key> -signer <x509> -outform der -out <raw sig>
>>
>> The resulting raw signature from the above command is (more or less)
>> identical to the raw signature that sign-file itself can produce like
>> this:
>>   $ scripts/sign-file -d <hash algo> <key> <x509> <module>
> 
> What's the usage case for this?  Can it be done instead with openssl PKCS#11?

Our internal signing service doesn't support PKCS#11. I have to submit the blobs
and get detached PKCS#7 messages back. I don't claim I fully understand all the
different signing mechanisms but everything worked just fine until support for
signing with a detached signature was removed. IMO that's a regression, which
I'm trying to fix with this patch.

...Juerg



> David
> 

[toc] | [prev] | [next] | [standalone]

#1331164 — Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a raw signature

On 02/10/2016 11:12 AM, David Howells wrote:
> Juerg Haefliger <juerg.haefliger@hpe.com> wrote:
> 
>> This patch adds support for signing a kernel module with a raw
>> detached PKCS#7 signature/message.
>>
>> The signature is not converted and is simply appended to the module so
>> it needs to be in the right format. Using openssl, a valid signature can
>> be generated like this:
>>   $ openssl smime -sign -nocerts -noattr -binary -in <module> -inkey \
>>     <key> -signer <x509> -outform der -out <raw sig>
>>
>> The resulting raw signature from the above command is (more or less)
>> identical to the raw signature that sign-file itself can produce like
>> this:
>>   $ scripts/sign-file -d <hash algo> <key> <x509> <module>
> 
> What's the usage case for this?  Can it be done instead with openssl PKCS#11?

Our internal signing service doesn't support PKCS#11. I have to submit the blobs
and get detached PKCS#7 messages back. I don't claim I fully understand all the
different signing mechanisms but everything worked just fine until support for
signing with a detached signature was removed. IMO that's a regression, which
I'm trying to fix with this patch.

...Juerg



> David
> 

[toc] | [prev] | [next] | [standalone]

#1337188 — Re: [PATCH v2] scripts/sign-file.c: Add support for signing with a raw signature

On 02/10/2016 02:24 PM, Juerg Haefliger wrote:
> On 02/10/2016 11:12 AM, David Howells wrote:
>> Juerg Haefliger <juerg.haefliger@hpe.com> wrote:
>>
>>> This patch adds support for signing a kernel module with a raw
>>> detached PKCS#7 signature/message.
>>>
>>> The signature is not converted and is simply appended to the module so
>>> it needs to be in the right format. Using openssl, a valid signature can
>>> be generated like this:
>>>   $ openssl smime -sign -nocerts -noattr -binary -in <module> -inkey \
>>>     <key> -signer <x509> -outform der -out <raw sig>
>>>
>>> The resulting raw signature from the above command is (more or less)
>>> identical to the raw signature that sign-file itself can produce like
>>> this:
>>>   $ scripts/sign-file -d <hash algo> <key> <x509> <module>
>>
>> What's the usage case for this?  Can it be done instead with openssl PKCS#11?
> 
> Our internal signing service doesn't support PKCS#11. I have to submit the blobs
> and get detached PKCS#7 messages back. I don't claim I fully understand all the
> different signing mechanisms but everything worked just fine until support for
> signing with a detached signature was removed. IMO that's a regression, which
> I'm trying to fix with this patch.

Any comments?

Thanks
...Juerg

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web