Re: [GIT PULL] Crypto keys and module signing

[Nick Bowler]

On 2011-12-10 12:50 +0000, David Howells wrote:
> Arkadiusz MiÅkiewicz <a.miskiewicz@xxxxxxxxx> wrote:
> > and prehaps kernel could load keys from initramfs?
> 
> How do you trust the keys?  If you have a TPM, then yes you can do that.

Exactly the same way you trust the kernel image itself.  If you can't
trust the integrity of your initramfs (and thus the keys stored within
it), then you also cannot trust the integrity of the kernel image and
thus this whole signing exercise is moot.

Cheers,
-- 
Nick Bowler, Elliptic Technologies (http://www.elliptictech.com/)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/