Re: [Linux-ima-devel] Query about evmctl and hash algo

[Mimi Z. <zo...@li...>]

On Wed, 2013-03-13 at 13:26 -0400, Vivek Goyal wrote:
> On Wed, Mar 13, 2013 at 11:34:28AM -0400, Vivek Goyal wrote:
> > Hi Dmitry,
> > 
> > I used evmctl to sign an executable. I used an x.509 cert. I generated
> > cert and specified to use -sha256 algorithm.
> > 
> > But I noticed that evmctl ignores x.509 values and by default calculates
> > sha1 hash.
> > 
> > I thought we should honor x.509 certificate and use the hashing algorithm
> > as specified in the cert. What do you think?
> > 
> 
> Or may be I have misunderstood it and x.509 does not impose the type
> of hash algorithm that should be used for signing. And user is free to 
> use any hash algorithm.

Vivek, we definitely want to be able to collect, store, and appraise
files based on the signature hash algorithm.  For now, the kernel only
supports sha1.  Dmitry has some kernel patches in his
linux-digsig/#working branch, which are not yet quite ready to be posted
or upstreamed.

Before being able to support hashes larger than md5/sha1, we also need
to modify the existing 'ima' template.  Otherwise we would need to hash
the file twice - once for the measurement list and again based on the
signature.  I've pushed out some patches yesterday, which also are not
quite ready for review, to the "next-multiple-template" branch.  These
patches are based on the 'template' patches written 3+ years ago, but
were never upstreamed.  Below is the patch description from the first
patch.

    The original 'ima' template data includes just the file hash and
    filename.  The hash algorithm size is limited to 20 bytes (md5/sha1).
    The filename is a null terminated string, limited to 255 characters.
    To overcome these limitations, and provide additional file metadata,
    this patch set introduces multiple templates of variable length sizes.
    Future patches will address TPM v2.0 changes.
    
    This first patch adds the template data length to the
    binary_runtime_measurements list.  As new templates are defined,
    userspace will continue being able to verify the measurement list
    against the PCR value, yet skip unknown templates.
    
    For the patches to be bisect safe and not break userspace, defer
    adding the ability to change the template, until the 'ima-ng' template
    definition is complete.

The patches to support larger hashes, will be included prior, to the
last patch in this patch set, which changes the default 'ima' template
to 'ima-ng' template and adds a boot command line option for backwards
compatibility.  For a better understanding of what needs to be done,
please refer to the individual patch descriptions.

thanks,

Mimih