From: Stefan Berger <stefanb@linux.vnet.ibm.com>
To: dhowells@redhat.com, keyrings@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, herbert@gondor.apana.org.au,
davem@davemloft.net, linux-crypto@vger.kernel.org,
patrick@puiterwijk.org, Stefan Berger <stefanb@linux.ibm.com>
Subject: [PATCH v2 0/3] Add support for x509 certs with NIST p256 and p192 keys
Date: Tue, 26 Jan 2021 14:11:12 -0500 [thread overview]
Message-ID: <20210126191115.434842-1-stefanb@linux.vnet.ibm.com> (raw)
From: Stefan Berger <stefanb@linux.ibm.com>
This series of patches adds support for x509 certificates signed by a CA
that uses NIST p256 or p192 keys for signing. It also adds support for
certificates where the public key is a NIST p256 or p192 key. The math
for ECDSA signature verification is also added.
Since self-signed certificates are verified upon loading, the following
script can be used for testing:
keyctrl newring test @u
while :; do
for hash in sha1 sha224 sha256 sha384 sha512; do
openssl req \
-x509 \
-${hash} \
-newkey ec \
-pkeyopt ec_paramgen_curve:prime256v1 \
-keyout key.pem \
-days 365 \
-subj '/CN=test' \
-nodes \
-outform der \
-out cert.der
keyctl padd asymmetric testkey %keyring:test < cert.der
if [ $? -ne 0 ]; then
echo "ERROR"
exit 1
fi
done
done
It also works with restricted keyrings where an RSA key is used to sign
a NIST P256/P192 key. Scripts for testing are here:
https://github.com/stefanberger/eckey-testing
The ECDSA signature verification will be used by IMA Appraisal where ECDSA
file signatures stored in RPM packages will use substantially less space
than if RSA signatures were to be used.
Stefan
v1->v2:
- using faster vli_sub rather than newly added vli_mod_fast to 'reduce'
result
- rearranged switch statements to follow after RSA
- 3rd patch from 1st posting is now 1st patch
Stefan Berger (3):
x509: Detect sm2 keys by their parameters OID
x509: Add support for parsing x509 certs with NIST p256 keys
x509: Add support for NIST p192 keys in certificates and akcipher
crypto/Makefile | 9 +-
crypto/asymmetric_keys/public_key.c | 19 ++
crypto/asymmetric_keys/x509_cert_parser.c | 45 ++-
crypto/ecc.c | 317 ++++++++++++++++++++++
crypto/ecc.h | 2 +
crypto/ecc_curve_defs.h | 4 +
crypto/eccsignature.asn1 | 4 +
include/linux/oid_registry.h | 6 +
8 files changed, 403 insertions(+), 3 deletions(-)
create mode 100644 crypto/eccsignature.asn1
--
2.25.4
next reply other threads:[~2021-01-27 13:30 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-26 19:11 Stefan Berger [this message]
2021-01-26 19:11 ` [PATCH v2 1/3] x509: Detect sm2 keys by their parameters OID Stefan Berger
2021-01-26 19:11 ` [PATCH v2 2/3] x509: Add support for parsing x509 certs with NIST p256 keys Stefan Berger
2021-01-26 19:11 ` [PATCH v2 3/3] x509: Add support for NIST p192 keys in certificates and akcipher Stefan Berger
2021-01-27 9:17 ` [PATCH v2 0/3] Add support for x509 certs with NIST p256 and p192 keys David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210126191115.434842-1-stefanb@linux.vnet.ibm.com \
--to=stefanb@linux.vnet.ibm.com \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=herbert@gondor.apana.org.au \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=patrick@puiterwijk.org \
--cc=stefanb@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).