Re: [RFC 1/1] ima: digital signature verification using asymmetrickeys

[Vivek Goyal]

On Mon, Jan 28, 2013 at 04:54:06PM +0200, Kasatkin, Dmitry wrote:
> On Fri, Jan 25, 2013 at 11:01 PM, Vivek Goyal <vgoyal@xxxxxxxxxx> wrote:
> > Hi,
> >
> > I am trying to read and understand IMA code. How does digital signature
> > mechanism work.
> >
> > IIUC, evmctl will install a file's signature in security.ima. And later
> > process_measurement() will do following.
> >
> > Calculate digest of file in ima_collect_measurement() and then
> > ima_appraise_measurement() actually compares signatuer against the
> > digest.
> >
> > If yes, ima_collect_measurement() always calculates digest either using
> > md5/sha1 but signatures might have used sha256 or something else. So
> > how does it work. What am I missing.
> 
> Hi,
> 
> Yes, currently it is possible to use only single configured algorithm, which is
> in generally enough. Consider it like a policy.
> Soon it will be a patch which allows to use any hash algorithms, supported by
> asymmetric key verification API.

Ok. I am hoping that it will be more than the kernel command line we
support. In the sense that for digital signatures one needs to parse
the signature, look at what hash algorithm has been used  and then
collect the hash accordingly. It is little different then IMA requirement
of calculating one pre-determine hash for all files.

Thanks
Vivek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/