From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751697AbdFZMeT (ORCPT ); Mon, 26 Jun 2017 08:34:19 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:37119 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751461AbdFZMeM (ORCPT ); Mon, 26 Jun 2017 08:34:12 -0400 Subject: Re: [Linux-ima-devel] [PATCH v3 0/6] Updated API for TPM 2.0 PCR extend From: Mimi Zohar To: Jarkko Sakkinen , Roberto Sassu Cc: linux-ima-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, tpmdd-devel@lists.sourceforge.net, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Kenneth Goldman Date: Mon, 26 Jun 2017 08:33:59 -0400 In-Reply-To: <20170624090325.kbqhwkrx5qvtxveg@linux.intel.com> References: <20170621142941.32674-1-roberto.sassu@huawei.com> <20170624090325.kbqhwkrx5qvtxveg@linux.intel.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-MML: disable x-cbid: 17062612-1617-0000-0000-000001EC0663 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17062612-1618-0000-0000-000048336623 Message-Id: <1498480439.3387.45.camel@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-06-26_09:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1706260213 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 2017-06-24 at 11:03 +0200, Jarkko Sakkinen wrote: > On Wed, Jun 21, 2017 at 04:29:35PM +0200, Roberto Sassu wrote: > To move this forward and be more constructive here's how I see it > should be done (along the lines, draft): > > int tpm_pcr_extend(u32 chip_num, int pcr_idx, unsigned int alg, > const u8 *hash); > > The paramater 'alg' is crypto ID as specified by crypto subsystem. Based on Kenneth Goldman's input, the new IMA TPM-2.0 crypto hash agile measurement list will contain the TPM crypto hash algorithm ids (TPM crypto-ID).  > TPM driver must have a precompiled table of mappings for crypto IDs > and TPM algorithm IDs. We could map the TPM crypto-IDs to the crypto subsystem IDs and then map them back, but is that necessary? > > In addition it must have dynamically acquired list of TPM alg IDs. > For those algs that static mapping does not exist it must extend > them like we do now everything else except SHA-1 (Naynas changes). Padding/truncating an unknown bank using SHA1 is fine, but at some point, as Roberto pointed out to me, TPM 2.0's might not support SHA- 1.  So for the record, we're hard coding the use of SHA1 for the unknown algorithms whether or not the TPM supports SHA1. > There's absolutely no need to pass digest size like you do BTW as it is > defined by the standard. For algorithms known to the crypto subsystem, that is fine, but for the unknown TPM crypto algorithms, we would need to somehow query the TPM for the digest sizes to create the mapping. Mimi > I also except that where ever this interleaves with trusted keys there > won't be duplicate structures and code. > > /Jarkko >