Re: [PATCH v2 0/2] crypto: streebog - add Streebog hash function

Re: [PATCH v2 0/2] crypto: streebog - add Streebog hash function

[Vitaly Chikunov]

Herbert,

On Wed, Oct 17, 2018 at 02:08:51PM +0800, Herbert Xu wrote:
> On Fri, Oct 12, 2018 at 09:41:05AM +0300, Vitaly Chikunov wrote:
> >
> > It is the first part of attempts to add to the Integrity subsystem
> > ability of verifying file and module signatures by Russian GOST
> > algorithms.
> 
> It would be better if these patches are posted together.  That
> way we don't end up with a situation where the algorithm goes into
> the kernel but the ultimate user is rejected.

IMA does not need any particular patching inside of their subtree to
support new hash, because it is using any hash registered in Hash Info
which is still under crypto subtree. I added appropriate patch into v3
which is already posted a week ago, and tested it to work correctly with
ima_appraise=fix.

Thanks,

Re: [PATCH v2 0/2] crypto: streebog - add Streebog hash function

[Mimi Zohar]

On Sat, 2018-11-03 at 08:51 +0300, Vitaly Chikunov wrote:
> Herbert,
> 
> On Wed, Oct 17, 2018 at 02:08:51PM +0800, Herbert Xu wrote:
> > On Fri, Oct 12, 2018 at 09:41:05AM +0300, Vitaly Chikunov wrote:
> > >
> > > It is the first part of attempts to add to the Integrity subsystem
> > > ability of verifying file and module signatures by Russian GOST
> > > algorithms.
> > 
> > It would be better if these patches are posted together.  That
> > way we don't end up with a situation where the algorithm goes into
> > the kernel but the ultimate user is rejected.
> 
> IMA does not need any particular patching inside of their subtree to
> support new hash, because it is using any hash registered in Hash Info
> which is still under crypto subtree. I added appropriate patch into v3
> which is already posted a week ago, and tested it to work correctly with
> ima_appraise=fix.

That's true, but the target subsystem should be made aware of the new
usage.

Thanks, Herbert.

Mimi

Re: [PATCH v2 0/2] crypto: streebog - add Streebog hash function

[Vitaly Chikunov]

Mimi,

On Mon, Nov 05, 2018 at 07:48:33AM -0500, Mimi Zohar wrote:
> On Sat, 2018-11-03 at 08:51 +0300, Vitaly Chikunov wrote:
> > On Wed, Oct 17, 2018 at 02:08:51PM +0800, Herbert Xu wrote:
> > > On Fri, Oct 12, 2018 at 09:41:05AM +0300, Vitaly Chikunov wrote:
> > > >
> > > > It is the first part of attempts to add to the Integrity subsystem
> > > > ability of verifying file and module signatures by Russian GOST
> > > > algorithms.
> > > 
> > > It would be better if these patches are posted together.  That
> > > way we don't end up with a situation where the algorithm goes into
> > > the kernel but the ultimate user is rejected.
> > 
> > IMA does not need any particular patching inside of their subtree to
> > support new hash, because it is using any hash registered in Hash Info
> > which is still under crypto subtree. I added appropriate patch into v3
> > which is already posted a week ago, and tested it to work correctly with
> > ima_appraise=fix.
> 
> That's true, but the target subsystem should be made aware of the new
> usage.

Did you mean by re-sending the patch with Cc to linux-integrity? Or
something more?

Thanks,

Re: [PATCH v2 0/2] crypto: streebog - add Streebog hash function

[Mimi Zohar]

On Mon, 2018-11-05 at 15:55 +0300, Vitaly Chikunov wrote:
> Mimi,
> 
> On Mon, Nov 05, 2018 at 07:48:33AM -0500, Mimi Zohar wrote:
> > On Sat, 2018-11-03 at 08:51 +0300, Vitaly Chikunov wrote:
> > > On Wed, Oct 17, 2018 at 02:08:51PM +0800, Herbert Xu wrote:
> > > > On Fri, Oct 12, 2018 at 09:41:05AM +0300, Vitaly Chikunov wrote:
> > > > >
> > > > > It is the first part of attempts to add to the Integrity subsystem
> > > > > ability of verifying file and module signatures by Russian GOST
> > > > > algorithms.
> > > > 
> > > > It would be better if these patches are posted together.  That
> > > > way we don't end up with a situation where the algorithm goes into
> > > > the kernel but the ultimate user is rejected.
> > > 
> > > IMA does not need any particular patching inside of their subtree to
> > > support new hash, because it is using any hash registered in Hash Info
> > > which is still under crypto subtree. I added appropriate patch into v3
> > > which is already posted a week ago, and tested it to work correctly with
> > > ima_appraise=fix.
> > 
> > That's true, but the target subsystem should be made aware of the new
> > usage.
> 
> Did you mean by re-sending the patch with Cc to linux-integrity? Or
> something more?

Just as future reference.  For now, please feel free to add my
Reviewed-by on the "crypto: streebog - register Streebog in hash info
for IMA" patch.

Mimi