Re: [TrouSerS-tech] [PATCH 1/1] add TPM2 version of create_tpm2_key and libtpm2.so engine

[Jason Gunthorpe <jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>]

On Tue, Jan 03, 2017 at 04:17:06PM -0800, James Bottomley wrote:
> On Tue, 2017-01-03 at 16:40 -0700, Jason Gunthorpe wrote:

> > I'm not disputing your analysis, just remarking that it seem very
> > undesirable to ban *all* sign-only keys just to support a single
> > legacy SSL configuration.
> 
> It's not just a single situation.  MD5-SHA1 is where it will fall apart
> on backwards compatibility but my current TPM doesn't understand
> anything other than sha1 or sha256, so it wouldn't allow more state of
> the art algorithms like sha224, sha384 or sha512 either.

Okay, yes, that is horrible :( If it is that bad it might not be worth
the effort..

> I'm just not sure I see enough benefits to trying to preserve the
> decrypt vs sign distinction, whereas I do see the floods of complaints
> from users who got it wrong or think it should work as advertised.

I probably wouldn't change the process for key generation - make the
tools default to decrypt keys and have an advanced option for
sign-only.

Jason

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most 
engaging tech sites, SlashDot.org! http://sdm.link/slashdot