Subject: Re: [Keyrings] Re: [PATCH 01/04] Add multi-precision-integer maths
	library
From: Trond Myklebust <trond.myklebust@fys.uio.no>
To: David =?ISO-8859-1?Q?H=E4rdeman?= <david@2gen.com>
Cc: Adrian Bunk <bunk@stusta.de>, Christoph Hellwig <hch@infradead.org>,
       keyrings@linux-nfs.org, linux-kernel@vger.kernel.org
In-Reply-To: <20060128165732.GA8633@hardeman.nu>
References: <20060127092817.GB24362@infradead.org> <1138312694656@2gen.com>
	 <1138312695665@2gen.com> <6403.1138392470@warthog.cambridge.redhat.com>
	 <20060127204158.GA4754@hardeman.nu> <20060128002241.GD3777@stusta.de>
	 <20060128104611.GA4348@hardeman.nu>
	 <1138466271.8770.77.camel@lade.trondhjem.org>
	 <20060128165732.GA8633@hardeman.nu>
Content-Type: text/plain; charset=utf-8
Date: Sat, 28 Jan 2006 22:20:29 -0500
Message-Id: <1138504829.8770.125.camel@lade.trondhjem.org>
Mime-Version: 1.0
Content-Transfer-Encoding: 8BIT
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1350
Lines: 34

On Sat, 2006-01-28 at 17:57 +0100, David Härdeman wrote:

> What about the first paragraph of what I wrote? You are going to want to 
> keep often-used keys around somehow, proxy certificates is not a 
> solution for your own use of your personal keys and with the exception 
> of hardware solutions such as smart cards, the keys will be safer in the 
> kernel than in a user-space daemon...

I don't get this explanation at all.

Why would you want to use proxy certificates for you own use? Use your
own certificate for your own processes, and issue one or more proxy
certificates to any daemon that you want to authorise to do some limited
task.

...and what does this statement about "keys being safer in the kernel"
mean?

> Further, the mpi and dsa code can also be used for supporting signed 
> modules and binaries...the "store dsa-keys in kernel" part adds 376 
> lines of code (counted with wc so comments and includes etc are also 
> counted)...

Signed modules sounds like a better motivation, but is a full dsa
implementation in the kernel really necessary to achieve this?

Cheers,
  Trond

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/