* [PATCH 0/2] Convert lib/digsig.c to SHA-1 library
@ 2025-08-15 2:17 Eric Biggers
2025-08-15 2:17 ` [PATCH 1/2] integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS Eric Biggers
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Eric Biggers @ 2025-08-15 2:17 UTC (permalink / raw)
To: linux-integrity, Mimi Zohar, Roberto Sassu, Dmitry Kasatkin
Cc: Eric Snowberg, linux-crypto, Eric Biggers
This series converts lib/digsig.c to use the SHA-1 library API.
Please consider taking this series through the integrity tree.
Eric Biggers (2):
integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS
lib/digsig: Use SHA-1 library instead of crypto_shash
lib/Kconfig | 3 +--
lib/digsig.c | 46 +++++---------------------------------
security/integrity/Kconfig | 1 +
3 files changed, 8 insertions(+), 42 deletions(-)
base-commit: 8f5ae30d69d7543eee0d70083daf4de8fe15d585
--
2.50.1
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 1/2] integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS 2025-08-15 2:17 [PATCH 0/2] Convert lib/digsig.c to SHA-1 library Eric Biggers @ 2025-08-15 2:17 ` Eric Biggers 2025-08-15 16:48 ` Paul Menzel 2025-08-15 2:17 ` [PATCH 2/2] lib/digsig: Use SHA-1 library instead of crypto_shash Eric Biggers 2025-08-19 18:11 ` [PATCH 0/2] Convert lib/digsig.c to SHA-1 library Mimi Zohar 2 siblings, 1 reply; 6+ messages in thread From: Eric Biggers @ 2025-08-15 2:17 UTC (permalink / raw) To: linux-integrity, Mimi Zohar, Roberto Sassu, Dmitry Kasatkin Cc: Eric Snowberg, linux-crypto, Eric Biggers Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS, since INTEGRITY_ASYMMETRIC_KEYS selects several options that depend on CRYPTO. This unblocks the removal of the CRYPTO selection from SIGNATURE. SIGNATURE (lib/digsig.c) itself will no longer need CRYPTO, but INTEGRITY_ASYMMETRIC_KEYS was depending on it indirectly via the chain SIGNATURE => INTEGRITY_SIGNATURE => INTEGRITY_ASYMMETRIC_KEYS. Signed-off-by: Eric Biggers <ebiggers@kernel.org> --- security/integrity/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 3c45f4f3455fb..916d4f2bfc441 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -34,10 +34,11 @@ config INTEGRITY_ASYMMETRIC_KEYS bool "Enable asymmetric keys support" depends on INTEGRITY_SIGNATURE default n select ASYMMETRIC_KEY_TYPE select ASYMMETRIC_PUBLIC_KEY_SUBTYPE + select CRYPTO select CRYPTO_RSA select X509_CERTIFICATE_PARSER help This option enables digital signature verification using asymmetric keys. -- 2.50.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS 2025-08-15 2:17 ` [PATCH 1/2] integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS Eric Biggers @ 2025-08-15 16:48 ` Paul Menzel 0 siblings, 0 replies; 6+ messages in thread From: Paul Menzel @ 2025-08-15 16:48 UTC (permalink / raw) To: Eric Biggers Cc: linux-integrity, Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, linux-crypto Dear Eric, Thank you for your patch. Am 15.08.25 um 04:17 schrieb Eric Biggers: > Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS, since > INTEGRITY_ASYMMETRIC_KEYS selects several options that depend on CRYPTO. > > This unblocks the removal of the CRYPTO selection from SIGNATURE. > SIGNATURE (lib/digsig.c) itself will no longer need CRYPTO, but > INTEGRITY_ASYMMETRIC_KEYS was depending on it indirectly via the chain > SIGNATURE => INTEGRITY_SIGNATURE => INTEGRITY_ASYMMETRIC_KEYS. > > Signed-off-by: Eric Biggers <ebiggers@kernel.org> > --- > security/integrity/Kconfig | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig > index 3c45f4f3455fb..916d4f2bfc441 100644 > --- a/security/integrity/Kconfig > +++ b/security/integrity/Kconfig > @@ -34,10 +34,11 @@ config INTEGRITY_ASYMMETRIC_KEYS > bool "Enable asymmetric keys support" > depends on INTEGRITY_SIGNATURE > default n > select ASYMMETRIC_KEY_TYPE > select ASYMMETRIC_PUBLIC_KEY_SUBTYPE > + select CRYPTO > select CRYPTO_RSA > select X509_CERTIFICATE_PARSER > help > This option enables digital signature verification using > asymmetric keys. Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Kind regards, Paul ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/2] lib/digsig: Use SHA-1 library instead of crypto_shash 2025-08-15 2:17 [PATCH 0/2] Convert lib/digsig.c to SHA-1 library Eric Biggers 2025-08-15 2:17 ` [PATCH 1/2] integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS Eric Biggers @ 2025-08-15 2:17 ` Eric Biggers 2025-08-15 16:48 ` Paul Menzel 2025-08-19 18:11 ` [PATCH 0/2] Convert lib/digsig.c to SHA-1 library Mimi Zohar 2 siblings, 1 reply; 6+ messages in thread From: Eric Biggers @ 2025-08-15 2:17 UTC (permalink / raw) To: linux-integrity, Mimi Zohar, Roberto Sassu, Dmitry Kasatkin Cc: Eric Snowberg, linux-crypto, Eric Biggers Now that a SHA-1 library API is available, use it instead of crypto_shash. This is simpler and faster. Signed-off-by: Eric Biggers <ebiggers@kernel.org> --- lib/Kconfig | 3 +-- lib/digsig.c | 46 ++++++---------------------------------------- 2 files changed, 7 insertions(+), 42 deletions(-) diff --git a/lib/Kconfig b/lib/Kconfig index c483951b624ff..e629449dd2a36 100644 --- a/lib/Kconfig +++ b/lib/Kconfig @@ -475,12 +475,11 @@ config MPILIB which is used by IMA/EVM digital signature extension. config SIGNATURE tristate depends on KEYS - select CRYPTO - select CRYPTO_SHA1 + select CRYPTO_LIB_SHA1 select MPILIB help Digital signature verification. Currently only RSA is supported. Implementation is done using GnuPG MPI library diff --git a/lib/digsig.c b/lib/digsig.c index 04b5e55ed95f5..5ddcc52f76863 100644 --- a/lib/digsig.c +++ b/lib/digsig.c @@ -16,19 +16,15 @@ #include <linux/err.h> #include <linux/module.h> #include <linux/slab.h> #include <linux/key.h> -#include <linux/crypto.h> -#include <crypto/hash.h> #include <crypto/sha1.h> #include <keys/user-type.h> #include <linux/mpi.h> #include <linux/digsig.h> -static struct crypto_shash *shash; - static const char *pkcs_1_v1_5_decode_emsa(const unsigned char *msg, unsigned long msglen, unsigned long modulus_bitlen, unsigned long *outlen) { @@ -197,16 +193,16 @@ static int digsig_verify_rsa(struct key *key, * */ int digsig_verify(struct key *keyring, const char *sig, int siglen, const char *data, int datalen) { - int err = -ENOMEM; struct signature_hdr *sh = (struct signature_hdr *)sig; - struct shash_desc *desc = NULL; + struct sha1_ctx ctx; unsigned char hash[SHA1_DIGEST_SIZE]; struct key *key; char name[20]; + int err; if (siglen < sizeof(*sh) + 2) return -EINVAL; if (sh->algo != PUBKEY_ALGO_RSA) @@ -229,51 +225,21 @@ int digsig_verify(struct key *keyring, const char *sig, int siglen, if (IS_ERR(key)) { pr_err("key not found, id: %s\n", name); return PTR_ERR(key); } - desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash), - GFP_KERNEL); - if (!desc) - goto err; - - desc->tfm = shash; - - crypto_shash_init(desc); - crypto_shash_update(desc, data, datalen); - crypto_shash_update(desc, sig, sizeof(*sh)); - crypto_shash_final(desc, hash); - - kfree(desc); + sha1_init(&ctx); + sha1_update(&ctx, data, datalen); + sha1_update(&ctx, sig, sizeof(*sh)); + sha1_final(&ctx, hash); /* pass signature mpis address */ err = digsig_verify_rsa(key, sig + sizeof(*sh), siglen - sizeof(*sh), hash, sizeof(hash)); -err: key_put(key); return err ? -EINVAL : 0; } EXPORT_SYMBOL_GPL(digsig_verify); -static int __init digsig_init(void) -{ - shash = crypto_alloc_shash("sha1", 0, 0); - if (IS_ERR(shash)) { - pr_err("shash allocation failed\n"); - return PTR_ERR(shash); - } - - return 0; - -} - -static void __exit digsig_cleanup(void) -{ - crypto_free_shash(shash); -} - -module_init(digsig_init); -module_exit(digsig_cleanup); - MODULE_LICENSE("GPL"); -- 2.50.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/2] lib/digsig: Use SHA-1 library instead of crypto_shash 2025-08-15 2:17 ` [PATCH 2/2] lib/digsig: Use SHA-1 library instead of crypto_shash Eric Biggers @ 2025-08-15 16:48 ` Paul Menzel 0 siblings, 0 replies; 6+ messages in thread From: Paul Menzel @ 2025-08-15 16:48 UTC (permalink / raw) To: Eric Biggers Cc: linux-integrity, Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, linux-crypto Dear Eric, Thank you for your patch. Am 15.08.25 um 04:17 schrieb Eric Biggers: > Now that a SHA-1 library API is available, use it instead of > crypto_shash. This is simpler and faster. > > Signed-off-by: Eric Biggers <ebiggers@kernel.org> > --- > lib/Kconfig | 3 +-- > lib/digsig.c | 46 ++++++---------------------------------------- > 2 files changed, 7 insertions(+), 42 deletions(-) > > diff --git a/lib/Kconfig b/lib/Kconfig > index c483951b624ff..e629449dd2a36 100644 > --- a/lib/Kconfig > +++ b/lib/Kconfig > @@ -475,12 +475,11 @@ config MPILIB > which is used by IMA/EVM digital signature extension. > > config SIGNATURE > tristate > depends on KEYS > - select CRYPTO > - select CRYPTO_SHA1 > + select CRYPTO_LIB_SHA1 > select MPILIB > help > Digital signature verification. Currently only RSA is supported. > Implementation is done using GnuPG MPI library > > diff --git a/lib/digsig.c b/lib/digsig.c > index 04b5e55ed95f5..5ddcc52f76863 100644 > --- a/lib/digsig.c > +++ b/lib/digsig.c > @@ -16,19 +16,15 @@ > > #include <linux/err.h> > #include <linux/module.h> > #include <linux/slab.h> > #include <linux/key.h> > -#include <linux/crypto.h> > -#include <crypto/hash.h> > #include <crypto/sha1.h> > #include <keys/user-type.h> > #include <linux/mpi.h> > #include <linux/digsig.h> > > -static struct crypto_shash *shash; > - > static const char *pkcs_1_v1_5_decode_emsa(const unsigned char *msg, > unsigned long msglen, > unsigned long modulus_bitlen, > unsigned long *outlen) > { > @@ -197,16 +193,16 @@ static int digsig_verify_rsa(struct key *key, > * > */ > int digsig_verify(struct key *keyring, const char *sig, int siglen, > const char *data, int datalen) > { > - int err = -ENOMEM; > struct signature_hdr *sh = (struct signature_hdr *)sig; > - struct shash_desc *desc = NULL; > + struct sha1_ctx ctx; > unsigned char hash[SHA1_DIGEST_SIZE]; > struct key *key; > char name[20]; > + int err; > > if (siglen < sizeof(*sh) + 2) > return -EINVAL; > > if (sh->algo != PUBKEY_ALGO_RSA) > @@ -229,51 +225,21 @@ int digsig_verify(struct key *keyring, const char *sig, int siglen, > if (IS_ERR(key)) { > pr_err("key not found, id: %s\n", name); > return PTR_ERR(key); > } > > - desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash), > - GFP_KERNEL); > - if (!desc) > - goto err; > - > - desc->tfm = shash; > - > - crypto_shash_init(desc); > - crypto_shash_update(desc, data, datalen); > - crypto_shash_update(desc, sig, sizeof(*sh)); > - crypto_shash_final(desc, hash); > - > - kfree(desc); > + sha1_init(&ctx); > + sha1_update(&ctx, data, datalen); > + sha1_update(&ctx, sig, sizeof(*sh)); > + sha1_final(&ctx, hash); > > /* pass signature mpis address */ > err = digsig_verify_rsa(key, sig + sizeof(*sh), siglen - sizeof(*sh), > hash, sizeof(hash)); > > -err: > key_put(key); > > return err ? -EINVAL : 0; > } > EXPORT_SYMBOL_GPL(digsig_verify); > > -static int __init digsig_init(void) > -{ > - shash = crypto_alloc_shash("sha1", 0, 0); > - if (IS_ERR(shash)) { > - pr_err("shash allocation failed\n"); > - return PTR_ERR(shash); > - } > - > - return 0; > - > -} > - > -static void __exit digsig_cleanup(void) > -{ > - crypto_free_shash(shash); > -} > - > -module_init(digsig_init); > -module_exit(digsig_cleanup); > - > MODULE_LICENSE("GPL"); Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> Kind regards, Paul ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 0/2] Convert lib/digsig.c to SHA-1 library 2025-08-15 2:17 [PATCH 0/2] Convert lib/digsig.c to SHA-1 library Eric Biggers 2025-08-15 2:17 ` [PATCH 1/2] integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS Eric Biggers 2025-08-15 2:17 ` [PATCH 2/2] lib/digsig: Use SHA-1 library instead of crypto_shash Eric Biggers @ 2025-08-19 18:11 ` Mimi Zohar 2 siblings, 0 replies; 6+ messages in thread From: Mimi Zohar @ 2025-08-19 18:11 UTC (permalink / raw) To: Eric Biggers, linux-integrity, Roberto Sassu, Dmitry Kasatkin Cc: Eric Snowberg, linux-crypto On Thu, 2025-08-14 at 19:17 -0700, Eric Biggers wrote: > This series converts lib/digsig.c to use the SHA-1 library API. > > Please consider taking this series through the integrity tree. > > Eric Biggers (2): Thanks, Eric. Mimi ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-08-19 18:11 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-08-15 2:17 [PATCH 0/2] Convert lib/digsig.c to SHA-1 library Eric Biggers 2025-08-15 2:17 ` [PATCH 1/2] integrity: Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS Eric Biggers 2025-08-15 16:48 ` Paul Menzel 2025-08-15 2:17 ` [PATCH 2/2] lib/digsig: Use SHA-1 library instead of crypto_shash Eric Biggers 2025-08-15 16:48 ` Paul Menzel 2025-08-19 18:11 ` [PATCH 0/2] Convert lib/digsig.c to SHA-1 library Mimi Zohar
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).