Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures

[Andy Lutomirski]

On 07/27/2015 12:33 PM, David Howells wrote:
> Hi James,
>
> Can you pull this into security/next please?  Its aim is twofold: firstly,
> make the module signatures of PKCS#7/CMS format rather than a home-brewed
> format and secondly to pave the way for use of the signing code for
> firmware signatures (to follow later).

With all this stuff applied, will the kernel accept PKCS#7 signatures 
that *don't* have authenticated attributes or that are otherwise 
cryptographically insecure in that they fail to provide the property 
that an attacker can't manipulate a valid signature on one message to 
look like a valid signature on a different message?

It looks like fixing that might actually be important if anyone ever 
wants to use this for firmware signing.

At least there's no issue with newer kernels needing to accept module 
signautures generated by old tools, since the newer kernels won't accept 
the underlying modules anyway.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/