d43de6c780
Move the RSA EMSA-PKCS1-v1_5 encoding from the asymmetric-key public_key
subtype to the rsa crypto module's pkcs1pad template. This means that the
public_key subtype no longer has any dependencies on public key type.
To make this work, the following changes have been made:
(1) The rsa pkcs1pad template is now used for RSA keys. This strips off the
padding and returns just the message hash.
(2) In a previous patch, the pkcs1pad template gained an optional second
parameter that, if given, specifies the hash used. We now give this,
and pkcs1pad checks the encoded message E(M) for the EMSA-PKCS1-v1_5
encoding and verifies that the correct digest OID is present.
(3) The crypto driver in crypto/asymmetric_keys/rsa.c is now reduced to
something that doesn't care about what the encryption actually does
and and has been merged into public_key.c.
(4) CONFIG_PUBLIC_KEY_ALGO_RSA is gone. Module signing must set
CONFIG_CRYPTO_RSA=y instead.
Thoughts:
(*) Should the encoding style (eg. raw, EMSA-PKCS1-v1_5) also be passed to
the padding template? Should there be multiple padding templates
registered that share most of the code?
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
94 lines
2.5 KiB
C
94 lines
2.5 KiB
C
/* Asymmetric public-key algorithm definitions
|
|
*
|
|
* See Documentation/crypto/asymmetric-keys.txt
|
|
*
|
|
* Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
|
|
* Written by David Howells (dhowells@redhat.com)
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public Licence
|
|
* as published by the Free Software Foundation; either version
|
|
* 2 of the Licence, or (at your option) any later version.
|
|
*/
|
|
|
|
#ifndef _LINUX_PUBLIC_KEY_H
|
|
#define _LINUX_PUBLIC_KEY_H
|
|
|
|
#include <crypto/hash_info.h>
|
|
|
|
enum pkey_algo {
|
|
PKEY_ALGO_DSA,
|
|
PKEY_ALGO_RSA,
|
|
PKEY_ALGO__LAST
|
|
};
|
|
|
|
extern const char *const pkey_algo_name[PKEY_ALGO__LAST];
|
|
|
|
/* asymmetric key implementation supports only up to SHA224 */
|
|
#define PKEY_HASH__LAST (HASH_ALGO_SHA224 + 1)
|
|
|
|
enum pkey_id_type {
|
|
PKEY_ID_PGP, /* OpenPGP generated key ID */
|
|
PKEY_ID_X509, /* X.509 arbitrary subjectKeyIdentifier */
|
|
PKEY_ID_PKCS7, /* Signature in PKCS#7 message */
|
|
PKEY_ID_TYPE__LAST
|
|
};
|
|
|
|
extern const char *const pkey_id_type_name[PKEY_ID_TYPE__LAST];
|
|
|
|
/*
|
|
* The use to which an asymmetric key is being put.
|
|
*/
|
|
enum key_being_used_for {
|
|
VERIFYING_MODULE_SIGNATURE,
|
|
VERIFYING_FIRMWARE_SIGNATURE,
|
|
VERIFYING_KEXEC_PE_SIGNATURE,
|
|
VERIFYING_KEY_SIGNATURE,
|
|
VERIFYING_KEY_SELF_SIGNATURE,
|
|
VERIFYING_UNSPECIFIED_SIGNATURE,
|
|
NR__KEY_BEING_USED_FOR
|
|
};
|
|
extern const char *const key_being_used_for[NR__KEY_BEING_USED_FOR];
|
|
|
|
/*
|
|
* Cryptographic data for the public-key subtype of the asymmetric key type.
|
|
*
|
|
* Note that this may include private part of the key as well as the public
|
|
* part.
|
|
*/
|
|
struct public_key {
|
|
void *key;
|
|
u32 keylen;
|
|
enum pkey_algo pkey_algo : 8;
|
|
enum pkey_id_type id_type : 8;
|
|
};
|
|
|
|
extern void public_key_destroy(void *payload);
|
|
|
|
/*
|
|
* Public key cryptography signature data
|
|
*/
|
|
struct public_key_signature {
|
|
u8 *s; /* Signature */
|
|
u32 s_size; /* Number of bytes in signature */
|
|
u8 *digest;
|
|
u8 digest_size; /* Number of bytes in digest */
|
|
enum pkey_algo pkey_algo : 8;
|
|
enum hash_algo pkey_hash_algo : 8;
|
|
};
|
|
|
|
extern struct asymmetric_key_subtype public_key_subtype;
|
|
struct key;
|
|
extern int verify_signature(const struct key *key,
|
|
const struct public_key_signature *sig);
|
|
|
|
struct asymmetric_key_id;
|
|
extern struct key *x509_request_asymmetric_key(struct key *keyring,
|
|
const struct asymmetric_key_id *id,
|
|
const struct asymmetric_key_id *skid,
|
|
bool partial);
|
|
|
|
int public_key_verify_signature(const struct public_key *pkey,
|
|
const struct public_key_signature *sig);
|
|
|
|
#endif /* _LINUX_PUBLIC_KEY_H */
|