Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756738AbbEVH5P (ORCPT ); Fri, 22 May 2015 03:57:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52737 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756579AbbEVH5L (ORCPT ); Fri, 22 May 2015 03:57:11 -0400 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: References: <20150520162059.GC10473@localhost> <20150521213829.GH23057@wotan.suse.de> <20150521230105.GL23057@wotan.suse.de> To: Andy Lutomirski Cc: dhowells@redhat.com, "Luis R. Rodriguez" , Andy Lutomirski , Rusty Russell , Michal Marek , Matthew Garrett , keyrings@linux-nfs.org, Dmitry Kasatkin , "linux-kernel@vger.kernel.org" , Seth Forshee , LSM List , David Woodhouse Subject: Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4] MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <32618.1432281384.1@warthog.procyon.org.uk> Date: Fri, 22 May 2015 08:56:24 +0100 Message-ID: <32619.1432281384@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1212 Lines: 26 Andy Lutomirski wrote: > Without tagging the purpose of the signed file, you simply don't have > a cryptographic guarantee of that. The bad guy can load something > else that was signed for an entirely different purpose into the wrong > device, possibly crashing it, causing buffer overflows because the > format is wrong, or doing any number of other bad things. One suggestion David Woodhouse made with regard to tagging is that the tag could just be added into the digest before it is signed/verified and not actually stored in the signature. This means that if you try loading the firmware for the wrong request, the signature verification will fail. It's an interesting approach that's simple to achieve, but it has the downside that the signature will be invalid in the mismatch situation and you can't tell whether it's because the module is being misused or the signature is just wrong. However, that might be livable with. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/