Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   =?iso-2022-jp?B?aGVyYmVydGhibGkoGyRCTXs5MEduGyhCKQ==?= 
        <herberthbli@tencent.com>
To:     Jarkko Sakkinen <jarkko@kernel.org>,
        Hongbo Li <herbert.tencent@gmail.com>
CC:     "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "herbert@gondor.apana.org.au" <herbert@gondor.apana.org.au>,
        "dhowells@redhat.com" <dhowells@redhat.com>,
        "zohar@linux.ibm.com" <zohar@linux.ibm.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>
Subject: Re: [PATCH 0/5] crypto: add rsa pss support for x509(Internet mail)
Thread-Topic: [PATCH 0/5] crypto: add rsa pss support for x509(Internet mail)
Thread-Index: AQHXKuZ2jiQgEg4HGkWw/fvJB5257A==
Date:   Wed, 7 Apr 2021 08:54:39 +0000
Message-ID: <0115cbd5a3154e8d868e98d564eba997@tencent.com>
References: <1617714686-25754-1-git-send-email-herbert.tencent@gmail.com>
 <YG1vakmzanwPGsvU@kernel.org>
Accept-Language: zh-CN, en-US
Content-Language: en-US
Content-Type: text/plain; charset="iso-2022-jp"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Precedence: bulk

=1B$B:_=1B(B 2021/4/7 16:38, Jarkko Sakkinen =1B$B<LF;=1B(B:=0A=
> On Tue, Apr 06, 2021 at 09:11:21PM +0800, Hongbo Li wrote:=0A=
>> From: Hongbo Li <herberthbli@tencent.com>=0A=
>>=0A=
>> This series of patches adds support for x509 cert signed by RSA=0A=
>> with PSS encoding method. RSA PSS is described in rfc8017.=0A=
> Please also briefly describe it here AND also provide link to the=0A=
> RFC. In the way this currently is, it is too time consuming to=0A=
> review the patch set.=0A=
>=0A=
> /Jarkko=0A=
=0A=
Thanks, will add that in the following patches.=0A=
=0A=
=0A=
>> This series of patches adds support for x509 cert signed by RSA=0A=
>> with PSS encoding method. RSA PSS is described in rfc8017.=0A=
>>=0A=
>> Patch1 make x509 support rsa pss algo and parse hash parameter.=0A=
>>=0A=
>> Patch2 add rsa pss template.=0A=
>>=0A=
>> Patch3 add test vector for rsa pss.=0A=
>>=0A=
>> Patch4 is the ecdsa ima patch borrowed from Stefan Berge's ecdsa=0A=
>>        patch series, rsa-pss's ima patch is made on top of this patch.=
=0A=
>>=0A=
>> Patch5 is the rsa-pss's ima patch.=0A=
>>=0A=
>> Test by the following script, it tests different saltlen, hash, mgfhash.=
=0A=
>>=0A=
>> keyctl newring test @u=0A=
>>=0A=
>> while :; do=0A=
>>     for modbits in 1024 2048 4096; do=0A=
>> 	if [ $modbits -eq 1024 ]; then=0A=
>> 	    saltlen=3D(-1 -2 0 20 32 48 64 94)=0A=
>> 	elif [ $modbits -eq 2048 ]; then=0A=
>> 	    saltlen=3D(-1 -2 0 20 32 48 64 222)=0A=
>> 	else=0A=
>> 	    saltlen=3D(-1 -2 0 20 32 48 64 478)=0A=
>> 	fi=0A=
>>=0A=
>> 	for slen in ${saltlen[@]}; do=0A=
>> 	    for hash in sha1 sha224 sha256 sha384 sha512; do=0A=
>> 		for mgfhash in sha1 sha224 sha256 sha384 sha512; do=0A=
>> 		    certfile=3D"cert.der"=0A=
>> 		    echo slen $slen=0A=
>> 		    openssl req \=0A=
>> 			    -x509 \=0A=
>> 			    -${hash} \=0A=
>> 			    -newkey rsa:$modbits \=0A=
>> 			    -keyout key.pem \=0A=
>> 			    -days 365 \=0A=
>> 			    -subj '/CN=3Dtest' \=0A=
>> 			    -nodes \=0A=
>> 			    -sigopt rsa_padding_mode:pss \=0A=
>> 			    -sigopt rsa_mgf1_md:$mgfhash \=0A=
>> 			    -sigopt rsa_pss_saltlen:${slen} \=0A=
>> 			    -outform der \=0A=
>> 			    -out ${certfile} 2>/dev/null=0A=
>>=0A=
>> 		    exp=3D0=0A=
>> 		    id=3D$(keyctl padd asymmetric testkey %keyring:test < "${certfile}=
")=0A=
>> 		    rc=3D$?=0A=
>> 		    if [ $rc -ne $exp ]; then=0A=
>> 			case "$exp" in=0A=
>> 			    0) echo "Error: Could not load rsa-pss certificate!";;=0A=
>> 			esac=0A=
>> 			echo "modbits $modbits sha: $hash mgfhash $mgfhash saltlen: $slen"=0A=
>> 			exit 1=0A=
>> 		    else=0A=
>> 			case "$rc" in=0A=
>> 			    0) echo "load cert: keyid: $id modbits $modbits hash: $hash mgfha=
sh $mgfhash saltlen $slen"=0A=
>> 			esac=0A=
>> 		    fi=0A=
>> 		done=0A=
>> 	    done=0A=
>> 	done=0A=
>>     done=0A=
>> done=0A=
>>=0A=
>> Hongbo Li (5):=0A=
>>   x509: add support for rsa-pss=0A=
>>   crypto: support rsa-pss encoding=0A=
>>   crypto: add rsa pss test vector=0A=
>>   crypto: ecdsa ima support=0A=
>>   ima: add support for rsa pss verification=0A=
>>=0A=
>>  crypto/Makefile                           |   7 +-=0A=
>>  crypto/asymmetric_keys/Makefile           |   7 +-=0A=
>>  crypto/asymmetric_keys/public_key.c       |   5 ++=0A=
>>  crypto/asymmetric_keys/x509_cert_parser.c |  71 ++++++++++++++++-=0A=
>>  crypto/rsa.c                              |  14 ++--=0A=
>>  crypto/rsa_helper.c                       | 127 +++++++++++++++++++++++=
+++++++=0A=
>>  crypto/testmgr.c                          |   7 ++=0A=
>>  crypto/testmgr.h                          |  87 ++++++++++++++++++++=0A=
>>  include/crypto/internal/rsa.h             |  25 +++++-=0A=
>>  include/keys/asymmetric-type.h            |   6 ++=0A=
>>  include/linux/oid_registry.h              |   2 +=0A=
>>  security/integrity/digsig_asymmetric.c    |  34 ++++----=0A=
>>  12 files changed, 363 insertions(+), 29 deletions(-)=0A=
>>=0A=
>> -- =0A=
>> 1.8.3.1=0A=
>>=0A=
>>=0A=
>=0A=
=0A=