From: Eric Biggers <ebiggers@kernel.org>
To: James Bottomley <James.Bottomley@hansenpartnership.com>
Cc: linux-crypto@vger.kernel.org, David Howells <dhowells@redhat.com>,
Blaise Boscaccy <bboscaccy@linux.microsoft.com>
Subject: Re: [PATCH v3 0/5] pkcs7: better handling of signed attributes
Date: Wed, 25 Feb 2026 18:13:31 -0800 [thread overview]
Message-ID: <20260226021331.GA55502@quark> (raw)
In-Reply-To: <20260225211907.7368-1-James.Bottomley@HansenPartnership.com>
On Wed, Feb 25, 2026 at 04:19:02PM -0500, James Bottomley wrote:
> Although the biggest use of signed attributes is PKCS#7 and X509
> specific data, they can be added to a signature to support arbitrary
> and verifiable objects. This makes them particularly useful when you
> want to take an existing signature scheme and extend it with
> additional (but always verified) data in such a way that it still
> looks valid to both the old and new schemes.
What kernel subsystem is going to use this, and how? As-is the only
caller of pkcs7_get_authattr() that you've proposed is in test code.
If this is for some out-of-tree module, we don't do that.
I'll also note that we should generally be aiming to simplify the PKCS#7
signature verification code, not making it even more complex.
- Eric
next prev parent reply other threads:[~2026-02-26 2:13 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-25 21:19 [PATCH v3 0/5] pkcs7: better handling of signed attributes James Bottomley
2026-02-25 21:19 ` [PATCH v3 1/5] certs: break out pkcs7 check into its own function James Bottomley
2026-02-25 21:19 ` [PATCH v3 2/5] crypto: pkcs7: add flag for validated trust on a signed info block James Bottomley
2026-02-25 21:19 ` [PATCH v3 3/5] crypto: pkcs7: allow pkcs7_digest() to be called from pkcs7_trust James Bottomley
2026-02-26 20:31 ` Eric Biggers
2026-02-27 3:50 ` James Bottomley
2026-03-05 7:58 ` Eric Biggers
2026-03-05 14:53 ` James Bottomley
2026-03-05 18:50 ` Eric Biggers
2026-03-05 20:11 ` James Bottomley
2026-03-05 21:36 ` Eric Biggers
2026-03-05 22:06 ` James Bottomley
2026-02-25 21:19 ` [PATCH v3 4/5] crypto: pkcs7: add ability to extract signed attributes by OID James Bottomley
2026-02-25 21:19 ` [PATCH v3 5/5] crypto: pkcs7: add tests for pkcs7_get_authattr James Bottomley
2026-02-26 1:12 ` kernel test robot
2026-02-26 2:13 ` Eric Biggers [this message]
2026-02-26 12:43 ` [PATCH v3 0/5] pkcs7: better handling of signed attributes James Bottomley
2026-03-05 7:55 ` Eric Biggers
2026-03-05 14:46 ` James Bottomley
2026-03-05 18:51 ` Eric Biggers
2026-03-05 20:18 ` James Bottomley
2026-03-05 21:40 ` Eric Biggers
2026-03-05 22:11 ` James Bottomley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260226021331.GA55502@quark \
--to=ebiggers@kernel.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=bboscaccy@linux.microsoft.com \
--cc=dhowells@redhat.com \
--cc=linux-crypto@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox