Received-SPF: pass (google.com: domain of linux-crypto+bounces-4366-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <4d33654876b91a954e581727b6eb2c5e94128cb1.camel@HansenPartnership.com>
Subject: Re: [PATCH RESEND] KEYS: trusted: Use ASN.1 encoded OID
From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Jarkko Sakkinen <jarkko@kernel.org>, linux-integrity@vger.kernel.org
Cc: keyrings@vger.kernel.org, David Woodhouse <dwmw2@infradead.org>, Eric
 Biggers <ebiggers@kernel.org>, Herbert Xu <herbert@gondor.apana.org.au>,
 "David S. Miller" <davem@davemloft.net>, Andrew Morton
 <akpm@linux-foundation.org>, Mimi Zohar <zohar@linux.ibm.com>, David
 Howells <dhowells@redhat.com>, Paul Moore <paul@paul-moore.com>, James
 Morris <jmorris@namei.org>, "Serge E. Hallyn" <serge@hallyn.com>, "open
 list:CRYPTO API" <linux-crypto@vger.kernel.org>,  open list
 <linux-kernel@vger.kernel.org>, "open list:SECURITY SUBSYSTEM"
 <linux-security-module@vger.kernel.org>
Date: Thu, 23 May 2024 11:43:13 -0400
In-Reply-To: <D1H4WNKWCB5K.2HJG7RMX7L33V@kernel.org>
References: <20240523131931.22350-1-jarkko@kernel.org>
	 <9c96f39ed2161dd7f0c3a7964cba2de3169fae3b.camel@HansenPartnership.com>
	 <D1H2P674GFY0.3O8WYK2P1GZ2K@kernel.org>
	 <9dfeb6e3d568452ab1227484405b1fc221bd25c1.camel@HansenPartnership.com>
	 <D1H4WNKWCB5K.2HJG7RMX7L33V@kernel.org>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.42.4 
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Thu, 2024-05-23 at 18:37 +0300, Jarkko Sakkinen wrote:
> On Thu May 23, 2024 at 6:30 PM EEST, James Bottomley wrote:
> > On Thu, 2024-05-23 at 16:54 +0300, Jarkko Sakkinen wrote:
> > > On Thu May 23, 2024 at 4:38 PM EEST, James Bottomley wrote:
> > > > On Thu, 2024-05-23 at 16:19 +0300, Jarkko Sakkinen wrote:
> > > > > There's no reason to encode OID_TPMSealedData at run-time, as
> > > > > it never changes.
> > > > > 
> > > > > Replace it with the encoded version, which has exactly the
> > > > > same size:
> > > > > 
> > > > >         67 81 05 0A 01 05
> > > > > 
> > > > > Include OBJECT IDENTIFIER (0x06) tag and length as the
> > > > > epilogue so that the OID can be simply copied to the blob.
> > > > 
> > > > This is true, but if we're going to do this, we should expand
> > > > the OID registry functions (in lib/oid_registry.c) to do
> > > > something like encode_OID.  The registry already contains the
> > > > hex above minus the two prefixes (which are easy to add).
> > > 
> > > Yes, I do agree with this idea, and I named variable the I named
> > > it to make it obvious that generation is possible.
> > > 
> > > It would be best to have a single source, which could be just
> > > a CSV file with entries like:
> > > 
> > > <Name>,<OID number>
> > > 
> > > And then in scripts/ there should be a script that takes this
> > > source and generates oid_registry.gen.{h,c}. The existing
> > > oid_registry.h should really just include oid_registry.gen.h
> > > then to make this transparent change.
> > > 
> > > And then in the series where OID's are encoded per-subsystem
> > > patch that takes pre-encoded OID into use.
> > > 
> > > Happy to review such patch set if it is pushed forward.
> > 
> > Heh, OK, since I'm the one who thinks it's quite easy, I'll give it
> > a go.
> 
> I guess if it cleaned up multiple sites in kernel then it could
> be considered useful. I'd guess that there is at least a few
> locations that also encode OID.

This should be the only one currently.  The ASN.1 encoding was added to
the kernel to support the trusted keys pipe use case.  However, if you
want the kernel to construct and pipe out asymmetric keys, that would
be the second use case.

James