Commit be08f0c6 authored Apr 11, 2019 by Vitaly Chikunov Committed by Herbert Xu Apr 18, 2019

integrity: support EC-RDSA signatures for asymmetric_verify

Allow to use EC-RDSA signatures for IMA by determining signature type by
the hash algorithm name. This works good for EC-RDSA since Streebog and
EC-RDSA should always be used together.

Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: linux-integrity@vger.kernel.org
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent 32fbdbd3

security/integrity/digsig_asymmetric.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -104,9 +104,16 @@ int asymmetric_verify(struct key keyring, const char sig,

		memset(&pks, 0, sizeof(pks));

		pks.pkey_algo = "rsa";
		pks.hash_algo = hash_algo_name[hdr->hash_algo];
		if (hdr->hash_algo == HASH_ALGO_STREEBOG_256 \|\|
		hdr->hash_algo == HASH_ALGO_STREEBOG_512) {
		/* EC-RDSA and Streebog should go together. */
		pks.pkey_algo = "ecrdsa";
		pks.encoding = "raw";
		} else {
		pks.pkey_algo = "rsa";
		pks.encoding = "pkcs1";
		}
		pks.digest = (u8 *)data;
		pks.digest_size = datalen;
		pks.s = hdr->sig;

Admin message