From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
To: Mimi Zohar <zohar@linux.ibm.com>,
Vitaly Chikunov <vt@altlinux.org>,
linux-integrity@vger.kernel.org,
Jia Zhang <zhang.jia@linux.alibaba.com>
Subject: Re: [PATCH ima-evm-utils v3] ima-evm-utils: Support SM2 algorithm for sign and verify
Date: Fri, 9 Jul 2021 17:06:34 +0800 [thread overview]
Message-ID: <bb6afba7-255f-5254-5ac7-e793c24d56d3@linux.alibaba.com> (raw)
In-Reply-To: <10f55257f543cc1d63e7a8ae36cbf2433a01c30b.camel@linux.ibm.com>
On 7/7/21 10:28 AM, Mimi Zohar wrote:
> On Fri, 2021-07-02 at 11:18 +0800, Tianjia Zhang wrote:
>> Hi,
>>
>> Any comment?
>
> Except for a few older distros, Travis complains:
>
> openssl dgst -sm3 sm3-hash.txt
> + evmctl -v ima_hash --hashalgo sm3 --xattr-user sm3-hash.txt
> hash(sm3):
> 04111ab21d8355cfa17f8e61194831e81a8f22bec8c728fefb747ed035eb5082aa2b
> Did not find expected hash for sm3:
> user.ima=0x011ab21d8355cfa17f8e61194831e81a8f22bec8c728fefb747ed035
> eb5082aa2b
> Actual output below:
> # file: sm3-hash.txt
> user.ima=0x04111ab21d8355cfa17f8e61194831e81a8f22bec8c728fefb747ed0
> 35eb5082aa2b
>
Thanks for pointing it out, This is caused by incorrect use of
hdr-prefix and will be fixed in the next version.
>>> diff --git a/tests/gen-keys.sh b/tests/gen-keys.sh
>>> index 46130cf..a75dc2e 100755
>>> --- a/tests/gen-keys.sh
>>> +++ b/tests/gen-keys.sh
>>> @@ -112,6 +112,28 @@ for m in \
>>> fi
>>> done
>>>
>>> +# SM2
>>> +for curve in sm2; do
>>> + if [ "$1" = clean ] || [ "$1" = force ]; then
>>> + rm -f test-$curve.cer test-$curve.key test-$curve.pub
>>> + fi
>>> + if [ "$1" = clean ]; then
>>> + continue
>>> + fi
>>> + if [ ! -e test-$curve.key ]; then
>>> + log openssl req -verbose -new -nodes -utf8 -days 10000 -batch -x509 \
>>> + -sm3 -sigopt "distid:1234567812345678" \
>>> + -config test-ca.conf \
>>> + -copy_extensions copyall \
>>> + -newkey $curve \
>>> + -out test-$curve.cer -outform DER \
>>> + -keyout test-$curve.key
>>> + if [ -s test-$curve.key ]; then
>>> + log openssl pkey -in test-$curve.key -out test-$curve.pub -pubout
>>> + fi
>>> + fi
>>> +done
>
> I'm also seeing:
> - openssl req -verbose -new -nodes -utf8 -days 10000 -batch -x509 -sm3
> -sigopt distid:1234567812345678 -config test-ca.conf -copy_extensions
> copyall -newkey sm2 -out test-sm2.cer -outform DER -keyout test-sm2.key
> req: Unrecognized flag copy_extensions
>
This command is for openssl 3.0, and '-copy_extensions copyall' is also
a parameter supported on 3.0. At present, the mainstream version of
openssl 1.1.1 only partially supports SM2 signatures. For example, the
USERID in the SM2 specification cannot be used, and the certificate
cannot be operated in the command using the SM2/3 algorithm combination,
just like the modification of libimaevm.c in this patch, this cannot be
done directly through the openssl command, even if the '-copy_extensions
copyall' parameter is deleted, this command will be failed on openssl
1.1.1. The final solution may be openssl 3.0.
On openssl 1.1.1, there is no problem to operate the signature of the
SM2/3 algorithm combination through the API. If it is possible, the
sign_verify test of sm2/3 is not required. What is your opinion?
> thanks,
>
> Mimi
>
Cheers,
Tianjia
next prev parent reply other threads:[~2021-07-09 9:06 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-26 8:44 [PATCH ima-evm-utils v3] ima-evm-utils: Support SM2 algorithm for sign and verify Tianjia Zhang
2021-07-02 3:18 ` Tianjia Zhang
2021-07-07 2:28 ` Mimi Zohar
2021-07-09 9:06 ` Tianjia Zhang [this message]
2021-07-09 12:05 ` Mimi Zohar
2021-07-12 12:12 ` Tianjia Zhang
2021-07-12 12:35 ` Mimi Zohar
2021-07-12 12:45 ` Tianjia Zhang
2021-07-12 20:27 ` Petr Vorel
2021-07-12 22:44 ` Mimi Zohar
2021-07-14 13:07 ` Tianjia Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bb6afba7-255f-5254-5ac7-e793c24d56d3@linux.alibaba.com \
--to=tianjia.zhang@linux.alibaba.com \
--cc=linux-integrity@vger.kernel.org \
--cc=vt@altlinux.org \
--cc=zhang.jia@linux.alibaba.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).