From: Mimi Zohar <zohar@linux.ibm.com>
To: Vitaly Chikunov <vt@altlinux.org>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
linux-integrity@vger.kernel.org
Subject: Re: [PATCH v7 00/11] ima-evm-utils: Convert v2 signatures from RSA to EVP_PKEY API
Date: Mon, 24 Jun 2019 15:09:53 -0400 [thread overview]
Message-ID: <1561403393.4340.58.camel@linux.ibm.com> (raw)
In-Reply-To: <20190624161638.xz6ebfvxzilh2gew@altlinux.org>
On Mon, 2019-06-24 at 19:16 +0300, Vitaly Chikunov wrote:
> Mimi,
>
> On Mon, Jun 24, 2019 at 10:42:32AM -0400, Mimi Zohar wrote:
> > On Sun, 2019-06-23 at 12:00 +0300, Vitaly Chikunov wrote:
> > > Convert sign v2 from RSA API (with manual formatting PKCS1) to more generic
> > > EVP_PKEY API, allowing to generate more types of OpenSSL supported signatures.
> > > This is done to enable EC-RDSA signatures, which are already supported in the
> > > Kernel. With some small fixes.
> > >
> > > All patches tested on x86_64 to not break anything.
> > >
> > > Changes since v6:
> > > - Remove "Make sure sig buffer is always MAX_SIGNATURE_SIZE" commit. Instead,
> > > change assumption of sign_hash_v2() about @sig size.
> >
> > With and without this change, the sha family is working properly, but
> > with this patch set, I'm now seeing "sign_hash_v2: signing failed:
> > (invalid digest)" for gost/streebog. Previously it worked.
>
> Sounds strange. For me it's working good for streebog now and then.
>
> = Testing algo gost2012_256-A hash streebog256 =
> test.txt: verification is OK
> ...
>
> Maybe somehow your test env is getting broken?
>
> I test on Debian 9, manually compiled openssl and then gost-engine
> from git. Env is like this:
>
> PATH=$HOME/src/openssl/apps:$HOME/src/ima-evm-utils/src/.libs:$PATH
> LD_LIBRARY_PATH=$HOME/src/openssl:$HOME/src/ima-evm-utils/src/.libs
> OPENSSL_CONF=$HOME/src/gost-engine/build/openssl.conf
> OPENSSL_ENGINES=$HOME/src/gost-engine/build/bin
>
> ima-evm-utils is ./configure'd with
>
> export OPENSSL_LIBS="-L$HOME/src/openssl -lssl -lcrypto"
>
> and then make'd without install, and test run.
Ok. I'm using a version, which I built when you first sent the
patches for the crypto engine support.
Mimi
next prev parent reply other threads:[~2019-06-24 19:10 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-23 9:00 [PATCH v7 00/11] ima-evm-utils: Convert v2 signatures from RSA to EVP_PKEY API Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 01/11] ima-evm-utils: Convert read_pub_key " Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 02/11] ima-evm-utils: Convert read_priv_key " Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 03/11] ima-evm-utils: Convert cmd_import and calc keyid v2 " Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 04/11] ima-evm-utils: Start converting find_keyid " Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 05/11] ima-evm-utils: Convert verify_hash_v2 " Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 06/11] ima-evm-utils: Replace find_keyid with find_keyid_pkey Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 07/11] ima-evm-utils: Convert sign_hash_v2 to EVP_PKEY API Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 08/11] ima-evm-utils: Replace calc_keyid_v2 with calc_pkeyid_v2 Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 09/11] ima-evm-utils: Remove RSA_ASN1_templates Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 10/11] ima-evm-utils: Pass status codes from sign and hash functions to the callers Vitaly Chikunov
2019-06-23 9:00 ` [PATCH v7 11/11] ima-evm-utils: Log hash_algo with hash value in verbose mode Vitaly Chikunov
2019-06-24 14:42 ` [PATCH v7 00/11] ima-evm-utils: Convert v2 signatures from RSA to EVP_PKEY API Mimi Zohar
2019-06-24 16:16 ` Vitaly Chikunov
2019-06-24 19:09 ` Mimi Zohar [this message]
2019-06-24 19:23 ` Vitaly Chikunov
2019-06-24 19:47 ` Mimi Zohar
2019-06-24 20:11 ` Vitaly Chikunov
2019-06-25 2:56 ` Mimi Zohar
2019-06-26 14:42 ` Dmitry Kasatkin
2019-06-26 15:02 ` Mimi Zohar
2019-06-26 15:07 ` Dmitry Kasatkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1561403393.4340.58.camel@linux.ibm.com \
--to=zohar@linux.ibm.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=linux-integrity@vger.kernel.org \
--cc=vt@altlinux.org \
--cc=zohar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.