From: Carlo Caione <carlo@caione.org> To: dhowells@redhat.com, herbert@gondor.apana.org.au, davem@davemloft.net, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux@endlessm.com Cc: Carlo Caione <carlo@endlessm.com> Subject: [PATCH RESEND] X.509: Recognize the legacy OID 1.3.14.3.2.29 (sha1WithRSASignature) Date: Mon, 7 Aug 2017 10:01:51 +0200 [thread overview] Message-ID: <20170807080151.5313-1-carlo@caione.org> (raw) From: Carlo Caione <carlo@endlessm.com> We have found some ACER laptops shipping with certificates signed using the 1.3.14.3.2.29 OID. This is causing the message EFI: Problem loading in-kernel X.509 certificate (-65) to be printed at boot. This OID is Rivest, Shamir and Adleman (RSA) algorithm that uses the Secure Hash Algorithm 1 (SHA1) (obsolete), usually referred to as sha1WithRSASignature. sha1WithRSASignature is a deprecated equivalent of sha1WithRSAEncryption. It originates from the NIST Open Systems Environment (OSE) Implementor's Workshop (OIW). It is supported for compatibility with Microsoft's certificate APIs and tools, particularly makecert.exe, which default(ed/s) to this OID for SHA-1. We introduce sha1WithRSASignature as new supported OID making it equivalent to sha1WithRSAEncryption. This is solving the issue when loading the in-kernel X.509 certificates that can now be correctly read. Signed-off-by: Carlo Caione <carlo@endlessm.com> --- crypto/asymmetric_keys/x509_cert_parser.c | 1 + include/linux/oid_registry.h | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index dd03fead1ca3..cdbc8c2def79 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -203,6 +203,7 @@ int x509_note_pkey_algo(void *context, size_t hdrlen, break; case OID_sha1WithRSAEncryption: + case OID_sha1WithRSASignature: ctx->cert->sig->hash_algo = "sha1"; ctx->cert->sig->pkey_algo = "rsa"; break; diff --git a/include/linux/oid_registry.h b/include/linux/oid_registry.h index d2fa9ca42e9a..26faee80357f 100644 --- a/include/linux/oid_registry.h +++ b/include/linux/oid_registry.h @@ -62,6 +62,7 @@ enum OID { OID_certAuthInfoAccess, /* 1.3.6.1.5.5.7.1.1 */ OID_sha1, /* 1.3.14.3.2.26 */ + OID_sha1WithRSASignature, /* 1.3.14.3.2.29 */ OID_sha256, /* 2.16.840.1.101.3.4.2.1 */ OID_sha384, /* 2.16.840.1.101.3.4.2.2 */ OID_sha512, /* 2.16.840.1.101.3.4.2.3 */ -- 2.13.3
WARNING: multiple messages have this Message-ID (diff)
From: Carlo Caione <carlo@caione.org> To: dhowells@redhat.com, herbert@gondor.apana.org.au, davem@davemloft.net, keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, linux@endlessm.com Cc: Carlo Caione <carlo@endlessm.com> Subject: [PATCH RESEND] X.509: Recognize the legacy OID 1.3.14.3.2.29 (sha1WithRSASignature) Date: Mon, 07 Aug 2017 08:01:51 +0000 [thread overview] Message-ID: <20170807080151.5313-1-carlo@caione.org> (raw) From: Carlo Caione <carlo@endlessm.com> We have found some ACER laptops shipping with certificates signed using the 1.3.14.3.2.29 OID. This is causing the message EFI: Problem loading in-kernel X.509 certificate (-65) to be printed at boot. This OID is Rivest, Shamir and Adleman (RSA) algorithm that uses the Secure Hash Algorithm 1 (SHA1) (obsolete), usually referred to as sha1WithRSASignature. sha1WithRSASignature is a deprecated equivalent of sha1WithRSAEncryption. It originates from the NIST Open Systems Environment (OSE) Implementor's Workshop (OIW). It is supported for compatibility with Microsoft's certificate APIs and tools, particularly makecert.exe, which default(ed/s) to this OID for SHA-1. We introduce sha1WithRSASignature as new supported OID making it equivalent to sha1WithRSAEncryption. This is solving the issue when loading the in-kernel X.509 certificates that can now be correctly read. Signed-off-by: Carlo Caione <carlo@endlessm.com> --- crypto/asymmetric_keys/x509_cert_parser.c | 1 + include/linux/oid_registry.h | 1 + 2 files changed, 2 insertions(+) diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index dd03fead1ca3..cdbc8c2def79 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -203,6 +203,7 @@ int x509_note_pkey_algo(void *context, size_t hdrlen, break; case OID_sha1WithRSAEncryption: + case OID_sha1WithRSASignature: ctx->cert->sig->hash_algo = "sha1"; ctx->cert->sig->pkey_algo = "rsa"; break; diff --git a/include/linux/oid_registry.h b/include/linux/oid_registry.h index d2fa9ca42e9a..26faee80357f 100644 --- a/include/linux/oid_registry.h +++ b/include/linux/oid_registry.h @@ -62,6 +62,7 @@ enum OID { OID_certAuthInfoAccess, /* 1.3.6.1.5.5.7.1.1 */ OID_sha1, /* 1.3.14.3.2.26 */ + OID_sha1WithRSASignature, /* 1.3.14.3.2.29 */ OID_sha256, /* 2.16.840.1.101.3.4.2.1 */ OID_sha384, /* 2.16.840.1.101.3.4.2.2 */ OID_sha512, /* 2.16.840.1.101.3.4.2.3 */ -- 2.13.3
next reply other threads:[~2017-08-07 8:01 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-08-07 8:01 Carlo Caione [this message] 2017-08-07 8:01 ` [PATCH RESEND] X.509: Recognize the legacy OID 1.3.14.3.2.29 (sha1WithRSASignature) Carlo Caione 2017-08-21 7:27 ` Carlo Caione 2017-08-21 7:27 ` Carlo Caione 2017-09-07 8:44 ` Carlo Caione 2017-09-07 8:44 ` Carlo Caione
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20170807080151.5313-1-carlo@caione.org \ --to=carlo@caione.org \ --cc=carlo@endlessm.com \ --cc=davem@davemloft.net \ --cc=dhowells@redhat.com \ --cc=herbert@gondor.apana.org.au \ --cc=keyrings@vger.kernel.org \ --cc=linux-crypto@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux@endlessm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.