From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <mbroz@redhat.com>
Received: from mail.saout.de ([127.0.0.1])
 by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id F-ywT8K5F3qZ for <dm-crypt@saout.de>;
 Wed, 10 Oct 2012 23:55:14 +0200 (CEST)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
 by mail.saout.de (Postfix) with ESMTP
 for <dm-crypt@saout.de>; Wed, 10 Oct 2012 23:55:13 +0200 (CEST)
Message-ID: <5075EEBA.6090609@redhat.com>
Date: Wed, 10 Oct 2012 23:55:06 +0200
From: Milan Broz <mbroz@redhat.com>
MIME-Version: 1.0
References: <C89931D1-F9CB-4C76-9622-521397A2DB98@mokafive.com>
 <Pine.LNX.4.64.1210100858220.25744@file.rdu.redhat.com>
 <alpine.DEB.2.02.1210101351250.27430@salmon-of-wisdom>
 <5075E6B1.6040203@seznam.cz>
 <alpine.DEB.2.02.1210101434220.27430@salmon-of-wisdom>
In-Reply-To: <alpine.DEB.2.02.1210101434220.27430@salmon-of-wisdom>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [dm-crypt] verity for GRUB?
List-Id: <dm-crypt.saout.de>
List-Unsubscribe: <http://www.saout.de/mailman/options/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=unsubscribe>
List-Archive: <http://www.saout.de/pipermail/dm-crypt/>
List-Post: <mailto:dm-crypt@saout.de>
List-Help: <mailto:dm-crypt-request@saout.de?subject=help>
List-Subscribe: <http://www.saout.de/mailman/listinfo/dm-crypt>,
 <mailto:dm-crypt-request@saout.de?subject=subscribe>
To: Geoffrey Thomas <gthomas@mokafive.com>
Cc: "wad@chromium.org" <wad@chromium.org>, "dm-crypt@saout.de" <dm-crypt@saout.de>, "msb@chromium.org" <msb@chromium.org>, "ellyjones@chromium.org" <ellyjones@chromium.org>, Mikulas Patocka <mpatocka@redhat.com>, "agk@redhat.com" <agk@redhat.com>

On 10/10/2012 11:43 PM, Geoffrey Thomas wrote:
> On Wed, 10 Oct 2012, Milan Broz wrote:
> 
>> Is there anything from libcryptsetup you want to use or it is just about
>> kernel code?
>>
>> If you want to use code from cryptsetup (cryptsetup/lib/verity/*), what exactly
>> you need and which licence is ok for you (GPL2+ or LGPL?)
>> (GPL3 will be incompatible with other cryptsetup code.)
> 
> Hm. I _thought_ I could adapt lib/verity/verity_hash.c for what I need, 
> but it appears to only support a whole-disk verification, not verification 
> of individual blocks.

Well, yes, because cryptsetup does not need that.

Also it uses crypto backend wrappers, so I am afraid you cannot just take
this library without a lot of changes....

> That said, if you're willing to take patches to 
> extend libverity's API, I can add the functionality I need. I believe that 
> GPLv2+ should work fine for GRUB.

I see no major problem with relicensing (but need to check properly).
If it helps to use it more broadly, it would be nice (with available
source code for everyone).

If you have any patches, just send them (to list or create new issue
on project page).

What is not clear here (not related to problems above) is where
you want to store root hash and how grub2 will securely obtain it...

Thanks,
Milan