Received: by 2002:a05:7412:251c:b0:e2:908c:2ebd with SMTP id w28csp824662rda; Sun, 22 Oct 2023 11:23:13 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGvYWtM7ZO6pACre4K78BMUlLRuoAaIeW0uZvjgHT8WgH9imqiMH5GKGO0dRgRx4GJMdEBZ X-Received: by 2002:a17:90b:4d83:b0:27d:a0e5:2a67 with SMTP id oj3-20020a17090b4d8300b0027da0e52a67mr7492837pjb.18.1697998993582; Sun, 22 Oct 2023 11:23:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1697998993; cv=none; d=google.com; s=arc-20160816; b=S0d3A5BdOmdp25ad0I0dZdkECMwJVpCfhS1H7gzPyj/ce97m+yaSdzz2quywx4SCww gOtg/+IaMVFGiAfRC+Br13FeyZW1zVqPQhN8seMoxL8t/c8TsGvogdlUaMTwlAxKEKxq QnJY5NV8FkxdFfQ5oYgIRYt4ZwKtHkRxcLjyx7EmX+yy5obp4bNZU/wmj9TAutPEpjif pGZ4RLED9x8ikJ+tryGljdbR0m+mbyDoeGwN2+FR3lEERAYWI6SX9wUY3mZpUCa+yXOK MtFvIwGuDu5j6APpns2FDCTA/wX4vdz8T4A2CxtqM+m4OMDREBN0y6cC1hdofhvsYnsd m+iQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=IXDb03/nMdyFNBY2tplz4IHYZT3E0MOfqPsaAJS0POs=; fh=ZKeIuptHfu0ur5542U7+rrG8FHxPmiCyZ2kCNgr4/mw=; b=m3Nvuivn+BRvqGjMZHd/9t96u/6QOLExxUP6J1N9Bg7DNqAh8B2t3DgQyaAqceCUXF W1VnhDKmZIlvcPzyri5aTgvc7BJnKGcGcCdbfi9TKYIky5qDv/oiq0OlVHoJksSLJhkX bsj+uhIl4omgVN2w251cYNQLS/pMj1MAeptUnybxnuke9+PCJk14+0PUPoQ19BmfBTp0 N4owxhE/fMbHTJx5H6rwnX+cw1EmO/9+fjZEQsE5hFJA3T2QAPBLu+JkIaKgSftsIf+4 2NMIntJsozH+rI9lokfcXgZZnS+XaOI3knq2C1KiCAZQJqKF4LczXTlzoqMuifqSmvqd cFYw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@canonical.com header.s=20210705 header.b=rsjxDL3C; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=canonical.com Return-Path: Received: from groat.vger.email (groat.vger.email. [2620:137:e000::3:5]) by mx.google.com with ESMTPS id t8-20020a17090a510800b0026f4d1e6940si7998190pjh.160.2023.10.22.11.23.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 22 Oct 2023 11:23:13 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5; Authentication-Results: mx.google.com; dkim=pass header.i=@canonical.com header.s=20210705 header.b=rsjxDL3C; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=canonical.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by groat.vger.email (Postfix) with ESMTP id BEC9B808D28D; Sun, 22 Oct 2023 11:23:10 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at groat.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232290AbjJVSXG (ORCPT + 99 others); Sun, 22 Oct 2023 14:23:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59300 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232515AbjJVSWz (ORCPT ); Sun, 22 Oct 2023 14:22:55 -0400 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AB7ADD41 for ; Sun, 22 Oct 2023 11:22:49 -0700 (PDT) Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 385F53FA6A for ; Sun, 22 Oct 2023 18:22:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1697998968; bh=IXDb03/nMdyFNBY2tplz4IHYZT3E0MOfqPsaAJS0POs=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=rsjxDL3CqaODCfC5sfwR0CiMVRDqBgn2Tulmyo/UKYiBHsqa3X9Jpjk2wjRZlyQF8 s8YlrBFR5cBKri34tEcD4q98WF/o8sNjFSPLWzg38Vh/DkZevlSJT+rWnC5VR0A32M Id/ZqjQhe6mD+ywMstc81E57Jf9Ix2jqCn0vaXC863i4MwrX1vZDg4tWGpefG/7Cry kBliVECG0HpLqjeFM29Ng7nDi+fiq+ejJ40gcd/Z0LXVeQwqG0MLj7gWKnv4kAQJiU Gl8IRdggC6FN6Xi/31lSON1u+5gcOiSY3hxcNBFzTqt5aDq9NXw/yOrPKiCnDpTcHz YZqIJaQcaNqEA== Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-407d3e55927so16349815e9.1 for ; Sun, 22 Oct 2023 11:22:48 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697998968; x=1698603768; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=IXDb03/nMdyFNBY2tplz4IHYZT3E0MOfqPsaAJS0POs=; b=iOwpahXUZugUG51wmIRbnco1fLedaC0ViqGIRkz9p4eWtGZ767hO18Q+6gDj95xjlD L3W6V4jvbcpcm6itK4oXoP0fkDPL0ExkmeExmFyi/aEerJ8IMXVU/wjUg8YjtB1rwHTJ CW4yMMpGWhtuWeXP77x07YRtiyK4FsLLBYDuFzjD0iQ+gNifdY9laOOi7X4goydRWrxD Sqfe35EdqySiTRSUt3uWcUGRLmTFvhSS2omDyPeIETvAxk2Fi0FnQJfGonDnzEQrR9nD Nyh0RqLnbzUJEW9tSX1xfhsaF6hxdk4fHYEMPm8HixW0zIXf36rx7YXDTSKCNK3vAA4x t9cQ== X-Gm-Message-State: AOJu0YyLwy8IIt6Gl+5ZArPetr7vNBaj39WEhAXbpjKk5jtoqoZRe/m/ EgRNZht7DhBuldDndCek4fToL+GmivYqe0O8Xz7KECYiFHwemg8htgNw94x0XKGONhmL/3r9pp0 PBMdZTBvypUDyH2HC/djmni+0H0iy2gFagwQZfx7nzg== X-Received: by 2002:a5d:560d:0:b0:32d:14a4:ab3 with SMTP id l13-20020a5d560d000000b0032d14a40ab3mr5517344wrv.24.1697998967930; Sun, 22 Oct 2023 11:22:47 -0700 (PDT) X-Received: by 2002:a5d:560d:0:b0:32d:14a4:ab3 with SMTP id l13-20020a5d560d000000b0032d14a40ab3mr5517338wrv.24.1697998967586; Sun, 22 Oct 2023 11:22:47 -0700 (PDT) Received: from localhost ([2001:67c:1560:8007::aac:c15c]) by smtp.gmail.com with ESMTPSA id b14-20020a5d550e000000b0032d9caeab0fsm6080826wrv.77.2023.10.22.11.22.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 22 Oct 2023 11:22:47 -0700 (PDT) From: Dimitri John Ledkov To: herbert@gondor.apana.org.au, David Howells , David Woodhouse , Luis Chamberlain Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org, linux-modules@vger.kernel.org Subject: [PATCH 5/6] crypto: enable automatic module signing with FIPS 202 SHA-3 Date: Sun, 22 Oct 2023 19:22:07 +0100 Message-Id: <20231022182208.188714-6-dimitri.ledkov@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20231022182208.188714-1-dimitri.ledkov@canonical.com> References: <20231022182208.188714-1-dimitri.ledkov@canonical.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Sun, 22 Oct 2023 11:23:10 -0700 (PDT) Add Kconfig options to use SHA-3 for kernel module signing. 256 size for RSA only, and higher sizes for RSA and NIST P-384. Signed-off-by: Dimitri John Ledkov --- certs/Kconfig | 2 +- kernel/module/Kconfig | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/certs/Kconfig b/certs/Kconfig index 84582de66b..69d192a32d 100644 --- a/certs/Kconfig +++ b/certs/Kconfig @@ -30,7 +30,7 @@ config MODULE_SIG_KEY_TYPE_RSA config MODULE_SIG_KEY_TYPE_ECDSA bool "ECDSA" select CRYPTO_ECDSA - depends on MODULE_SIG_SHA384 || MODULE_SIG_SHA512 + depends on !(MODULE_SIG_SHA256 || MODULE_SIG_SHA3_256) help Use an elliptic curve key (NIST P384) for module signing. Use a strong hash of same or higher bit length, i.e. sha384 or diff --git a/kernel/module/Kconfig b/kernel/module/Kconfig index 9d7d45525f..0ea1b2970a 100644 --- a/kernel/module/Kconfig +++ b/kernel/module/Kconfig @@ -248,6 +248,18 @@ config MODULE_SIG_SHA512 bool "Sign modules with SHA-512" select CRYPTO_SHA512 +config MODULE_SIG_SHA3_256 + bool "Sign modules with SHA3-256" + select CRYPTO_SHA3 + +config MODULE_SIG_SHA3_384 + bool "Sign modules with SHA3-384" + select CRYPTO_SHA3 + +config MODULE_SIG_SHA3_512 + bool "Sign modules with SHA3-512" + select CRYPTO_SHA3 + endchoice config MODULE_SIG_HASH @@ -256,6 +268,9 @@ config MODULE_SIG_HASH default "sha256" if MODULE_SIG_SHA256 default "sha384" if MODULE_SIG_SHA384 default "sha512" if MODULE_SIG_SHA512 + default "sha3-256" if MODULE_SIG_SHA3_256 + default "sha3-384" if MODULE_SIG_SHA3_384 + default "sha3-512" if MODULE_SIG_SHA3_512 choice prompt "Module compression mode" -- 2.34.1