From patchwork Sun Oct 22 18:22:02 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dimitri John Ledkov X-Patchwork-Id: 15726 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:ce89:0:b0:403:3b70:6f57 with SMTP id p9csp882321vqx; Sun, 22 Oct 2023 11:22:48 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHaAqYumexUi8VNv/CzkX4sITSUPw1Jnb/lkGdZ3uQQVe82/DW5/WQenvgyamFNi6qY4Npc X-Received: by 2002:a17:903:120c:b0:1c6:943:baca with SMTP id l12-20020a170903120c00b001c60943bacamr7405058plh.28.1697998967940; Sun, 22 Oct 2023 11:22:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1697998967; cv=none; d=google.com; s=arc-20160816; b=Aqfp4jD4gd4xZwOA4wsohi6mSyZdjYfi58UefNf4gkQjeT4b679irGlyKm7YNI0QEW s12UeeWdxxFETcASTDv6KuYS+R3HnsfrBEhZpojQLYhf+5GMyaG49bvgxN2p6WfCpf2x EEzgh9/QdCjw7nenD2TzrNyP0vA8NUUYyYlae/cyBUf1DJLmLF2dhX8BwWKi+WhaJb/Z nVfrgba4uxSscUsg70mLsQ0CC5ekvYio6PpdfWLxzuNBb0m+tiSgxsXexjMQ5c1pwWK2 /RvpsYszlw28S9Ey6wduq9CjhtRvm33nKzbt0kqsbID2hoJ93u9qgxw4YisvUicLIfOQ JtCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=Tl2mFhMN0hrea9vAgi8pl3E5fM4js6s2Rqa0QUC5Vas=; fh=JF9Ldl7gJTeNGvUjc/qCvrMOTCGrVIUkYKa6ThyV7aA=; b=g8k9cWaZEzXnfDb0zwwJjR2WaZor9uKbTqTRYN4xPpBv2GUv2ZA3yT7G7EB0M1moEJ U1kSZ36g1D6DAL6Z2hKQ8VraFcXaJ2/NljBuuIF4pDNaspC8ZnGAeZ2EPuaeMnaUjSmB g4jUGO9cgWUbfaZEOxiaC9kk2Nx1uJZc3wXG18metqIMFw4zRoFkcyfyodlT4e5NrlVj wxTUt/Lv6oQzH8//OwYxfgRfFu06PCHoMklxfXtfZiZHhmyrbLgHqk3UU3mOsnq4hRxa ziUaxzy9grt+wbZrUF+AO9qCmkhghvn7tIn+725brqori0euQ0803aTcqCk3/XUO8SZg RZLw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@canonical.com header.s=20210705 header.b=mxYoCgX+; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=canonical.com Received: from lipwig.vger.email (lipwig.vger.email. [23.128.96.33]) by mx.google.com with ESMTPS id ay8-20020a1709028b8800b001c9fe071f2bsi4839675plb.8.2023.10.22.11.22.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 22 Oct 2023 11:22:47 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33; Authentication-Results: mx.google.com; dkim=pass header.i=@canonical.com header.s=20210705 header.b=mxYoCgX+; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=canonical.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 2B64880545AF; Sun, 22 Oct 2023 11:22:45 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229500AbjJVSWY (ORCPT + 27 others); Sun, 22 Oct 2023 14:22:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50922 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229452AbjJVSWX (ORCPT ); Sun, 22 Oct 2023 14:22:23 -0400 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 687A1DD for ; Sun, 22 Oct 2023 11:22:18 -0700 (PDT) Received: from mail-lj1-f200.google.com (mail-lj1-f200.google.com [209.85.208.200]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 1D2673FA6A for ; Sun, 22 Oct 2023 18:22:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1697998937; bh=Tl2mFhMN0hrea9vAgi8pl3E5fM4js6s2Rqa0QUC5Vas=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=mxYoCgX+SSmBQlfN+aUey4jfoUIKDDuKFoiMoCzhoeE/2Ej/MnopRyzHlNQheF9JN ePoFnNZLXLlnvl4khA1TdE2q8JxX69bZ3tqsFwTIccBepWqskzgG7RtvhjyPDDy4Ui 7C9kxgTu2iBFN1lD2ZFtC9nAkWEwZSIk6+6yQ6MjVIU7FFlaPx0odZE7APqdZJ58MO RiTq9VN/u05ay/pzqm1Zh3zcrP608L47/CBs4q3J1hQaAJ5/Gnn4FSZ4CX4XXcoOmj vhVjqoiSH5Cs+0GHo606iA4KLIxG+Mxll092xB91Ns8uHIsRI84xXbnVROTcCBASsu l4DxnSt5tDfGw== Received: by mail-lj1-f200.google.com with SMTP id 38308e7fff4ca-2ba1949656bso21151051fa.0 for ; Sun, 22 Oct 2023 11:22:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697998936; x=1698603736; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Tl2mFhMN0hrea9vAgi8pl3E5fM4js6s2Rqa0QUC5Vas=; b=vrrwS8Tc9GaOzA6qJjnvjsB5ELAwTmzIyjfwik4EuDEDRPRyycSRy7gCDkoW1wX3w2 bhmZgRrYQFrWPnGVlM1fL/k+a1uws8lBdiNlaxRCGxNYjCRwZkh0G9nIiPXG5gwdHOSr RJ7pWTCkAhDNZCArQ3Wjs8iaOKrgmvpCTYSruuAZg1t7xgfAv6uFSvqIl6kUMIGhCVvI O81/oPssnRT2HPSE8Qi3zVnZjWifGBhZ7nKpWQZdYooGIjmBEbtI28jf7MLs0vInMNDn 1dcQiWu5cAnKpEyKbAPeI7qCjRPnFMelMuuomSV8wMXf9y7vJzhLyYg2bkQwM8kJQuB0 0q8A== X-Gm-Message-State: AOJu0YxyuFGn9ZXvGsx/V7d5UPGqNcblx7x6Huh8/7vzHmeiY/yFlTyo Ny/8pIbGCnGCX2PmeTid/UPgvDIntwcQwW8/ptoi1RB4IvOhbrcxjLx6EMoy/ELwfMWZZS8G+q5 cKiBWECxUPwWQ6NWX8OMGZtrfN0SqJdHeY6ID6t3eVA== X-Received: by 2002:a05:651c:14c:b0:2c5:9a5:a1c2 with SMTP id c12-20020a05651c014c00b002c509a5a1c2mr5064567ljd.30.1697998936190; Sun, 22 Oct 2023 11:22:16 -0700 (PDT) X-Received: by 2002:a05:651c:14c:b0:2c5:9a5:a1c2 with SMTP id c12-20020a05651c014c00b002c509a5a1c2mr5064560ljd.30.1697998935791; Sun, 22 Oct 2023 11:22:15 -0700 (PDT) Received: from localhost ([2001:67c:1560:8007::aac:c15c]) by smtp.gmail.com with ESMTPSA id g3-20020a5d6983000000b00326b8a0e817sm6140877wru.84.2023.10.22.11.22.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 22 Oct 2023 11:22:15 -0700 (PDT) From: Dimitri John Ledkov To: herbert@gondor.apana.org.au Cc: linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 0/6] crypto: pkcs7 x509 add FIPS 202 SHA-3 support Date: Sun, 22 Oct 2023 19:22:02 +0100 Message-Id: <20231022182208.188714-1-dimitri.ledkov@canonical.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Sun, 22 Oct 2023 11:22:45 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1780480965689867483 X-GMAIL-MSGID: 1780480965689867483 Recent patches to cryptodev removed support for insecure, broken or weak x509/pkcs7 signing hashes MD4, MD5, SHA1, SHA-224. This opens room to add SHA-3 family of hashes, which are not yet broken. Add support for FIPS 202 SHA-3 in x509 RSA & ECC certs, pkcs7 signatures, hash info structs. And adjust documentation. This enables using SHA-3 family of hashes for kernel module signing. For SHA3+ECC signing openssl with this patch [0] is needed, currently in openssl development tip. SHA3+RSA signing is supported by stable openssl. kmod needs a patch to recognise SHA3 hash names [1], submitted separately. This patch series is on top of tip of cryptodev git repository commit a2786e8bdd ("crypto: qcom-rng - Add missing dependency on hw_random") [0] https://github.com/openssl/openssl/pull/22147/files [1] https://lore.kernel.org/all/20231022180928.180437-1-dimitri.ledkov@canonical.com/ Dimitri John Ledkov (6): x509: Add OIDs for FIPS 202 SHA-3 hash and signatures crypto: FIPS 202 SHA-3 register in hash info for IMA crypto: rsa-pkcs1pad - Add FIPS 202 SHA-3 support crypto: x509 pkcs7 - allow FIPS 202 SHA-3 signatures crypto: enable automatic module signing with FIPS 202 SHA-3 Documentation/module-signing.txt: bring up to date Documentation/admin-guide/module-signing.rst | 17 ++++++++----- certs/Kconfig | 2 +- crypto/asymmetric_keys/mscode_parser.c | 9 +++++++ crypto/asymmetric_keys/pkcs7_parser.c | 12 ++++++++++ crypto/asymmetric_keys/public_key.c | 5 +++- crypto/asymmetric_keys/x509_cert_parser.c | 24 +++++++++++++++++++ crypto/hash_info.c | 6 +++++ crypto/rsa-pkcs1pad.c | 25 +++++++++++++++++++- crypto/testmgr.c | 12 ++++++++++ include/crypto/hash_info.h | 1 + include/linux/oid_registry.h | 11 +++++++++ include/uapi/linux/hash_info.h | 3 +++ kernel/module/Kconfig | 15 ++++++++++++ 13 files changed, 133 insertions(+), 9 deletions(-)