Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v3 2/8] ima: Switch to ima_hash_algo for boot aggregate
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Roberto Sassu <roberto.sassu@huawei.com>,
        "James.Bottomley@HansenPartnership.com" 
        <James.Bottomley@HansenPartnership.com>,
        "jarkko.sakkinen@linux.intel.com" <jarkko.sakkinen@linux.intel.com>,
        Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc:     "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Silviu Vlasceanu <Silviu.Vlasceanu@huawei.com>,
        "stable@vger.kernel.org" <stable@vger.kernel.org>
Date:   Mon, 02 Mar 2020 09:46:34 -0500
In-Reply-To: <8a6fb34e18b147fa811e82c78fb30d66@huawei.com>
References: <20200210100048.21448-1-roberto.sassu@huawei.com>
         <20200210100048.21448-3-roberto.sassu@huawei.com>
         <1581373420.5585.920.camel@linux.ibm.com>
         <6955307747034265bd282bf68c368f34@huawei.com>
         <1583156506.8544.60.camel@linux.ibm.com>
         <8a6fb34e18b147fa811e82c78fb30d66@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <1583160394.8544.89.camel@linux.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> > > > On Mon, 2020-02-10 at 11:00 +0100, Roberto Sassu wrote: 
> > My initial patch attempted to use any common TPM and kernel hash
> > algorithm to calculate the boot_aggregate.  The discussion with James
> > was pretty clear, which you even stated in the Changelog.  Either we
> > use the IMA default hash algorithm, SHA256 for TPM 2.0 or SHA1 for TPM
> > 1.2 for the boot-aggregate.
> 
> Ok, I didn't understand fully. I thought we should use the default IMA
> algorithm and select SHA256 as fallback choice for TPM 2.0 if there is no
> PCR bank for default algorithm.

Yes, preference is given to the IMA default algorithm, but it should
fall back to using SHA256 or SHA1, based on the TPM.

> I additionally implemented the logic to
> select the first PCR bank if the SHA256 PCR bank is not available but I can
> remove it.
> 
> SHA256 should be the minimum requirement for boot aggregate. The
> advantage of using the default IMA algorithm is that it will be possible to
> select stronger algorithms when they are supported by the TPM. We might
> introduce a new option to specify only the algorithm for boot aggregate,
> like James suggested to support embedded systems. Let me know which
> option you prefer.

I don't remember James saying that, but if the community really wants
that support, then it should be upstreamed independently, as a
separate patch.  Let's first get the basics working.

thanks,

Mimi