davidlt
/
kernel-ark
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

integrity: support EC-RDSA signatures for asymmetric_verify 

Allow to use EC-RDSA signatures for IMA by determining signature type by
the hash algorithm name. This works good for EC-RDSA since Streebog and
EC-RDSA should always be used together.

Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: linux-integrity@vger.kernel.org
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Vitaly Chikunov 2019-04-11 18:51:22 +03:00 committed by Herbert Xu
parent 32fbdbd32e
commit be08f0c681
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
security/integrity/digsig_asymmetric.c
View File

@ -104,9 +104,16 @@ int asymmetric_verify(struct key *keyring, const char *sig,
memset(&pks, 0, sizeof(pks));
pks.pkey_algo = "rsa";
pks.hash_algo = hash_algo_name[hdr->hash_algo];
pks.encoding = "pkcs1";
if (hdr->hash_algo == HASH_ALGO_STREEBOG_256 ||
hdr->hash_algo == HASH_ALGO_STREEBOG_512) {
/* EC-RDSA and Streebog should go together. */
pks.pkey_algo = "ecrdsa";
pks.encoding = "raw";
} else {
pks.pkey_algo = "rsa";
pks.encoding = "pkcs1";
}
pks.digest = (u8 *)data;
pks.digest_size = datalen;
pks.s = hdr->sig;