Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4]

[David Howells <dhowells@redhat.com>]

Andy Lutomirski <luto@kernel.org> wrote:

> I think this is way more complicated than it has to be.  Can't we look up
> certificates by their subjectPublicKeyInfo?

I want to be able to handle an X.509 chain to a root key that we have in the
kernel.  X.509 certs don't chain on subjectPublicKeyInfo unless that happens
to be what's in the SKID (which is a pretty indefinite standard in its own
right:-( ).  So we need to be able to match on the two things I made available
anyway.  PKCS#7 matches on one of them too, so that then just works.

> Why is PKCS#7 better than whatever we're using now?

It has a standard form[*].  It has standard ways to specify things such as the
key to use and the digest to use.  It can carry multiple signatures from
different keys and can carry key chains (something that's more likely to be
useful for kexec or firmware, admittedly).  It can be generated by extant
tools (though adding it onto a module needs a special tool).

 [*] We can agree it's a somewhat, um, ropy standard, but it's still a
     standard.

What we're using now isn't very extensible without changing the magic string
or putting in an override in one of the fields.

David