Commit be08f0c6 authored by Vitaly Chikunov's avatar Vitaly Chikunov Committed by Herbert Xu

integrity: support EC-RDSA signatures for asymmetric_verify

Allow to use EC-RDSA signatures for IMA by determining signature type by
the hash algorithm name. This works good for EC-RDSA since Streebog and
EC-RDSA should always be used together.

Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Cc: linux-integrity@vger.kernel.org
Signed-off-by: default avatarVitaly Chikunov <vt@altlinux.org>
Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 32fbdbd3
...@@ -104,9 +104,16 @@ int asymmetric_verify(struct key *keyring, const char *sig, ...@@ -104,9 +104,16 @@ int asymmetric_verify(struct key *keyring, const char *sig,
memset(&pks, 0, sizeof(pks)); memset(&pks, 0, sizeof(pks));
pks.pkey_algo = "rsa";
pks.hash_algo = hash_algo_name[hdr->hash_algo]; pks.hash_algo = hash_algo_name[hdr->hash_algo];
if (hdr->hash_algo == HASH_ALGO_STREEBOG_256 ||
hdr->hash_algo == HASH_ALGO_STREEBOG_512) {
/* EC-RDSA and Streebog should go together. */
pks.pkey_algo = "ecrdsa";
pks.encoding = "raw";
} else {
pks.pkey_algo = "rsa";
pks.encoding = "pkcs1"; pks.encoding = "pkcs1";
}
pks.digest = (u8 *)data; pks.digest = (u8 *)data;
pks.digest_size = datalen; pks.digest_size = datalen;
pks.s = hdr->sig; pks.s = hdr->sig;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment