Re: [PATCH] ima-evm-utils: simplify digest alias handling

[Vitaly Chikunov <vt@altlinux.org>]

Mimi,

On Tue, Feb 12, 2019 at 02:17:19PM -0500, Mimi Zohar wrote:
> On Tue, 2019-02-12 at 20:23 +0300, Vitaly Chikunov wrote:
> > On Tue, Feb 12, 2019 at 11:23:40AM -0500, Mimi Zohar wrote:
> > > Definitely a lot better.
> > > 
> > > > diff --git a/src/libimaevm.c b/src/libimaevm.c
> > > > index d9ffa13..ed77211 100644
> > > > --- a/src/libimaevm.c
> > > > +++ b/src/libimaevm.c
> > > > @@ -63,7 +63,7 @@
> > > >  #include "imaevm.h"
> > > >  #include "hash_info.h"
> > > > 
> > > > -const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
> > > > +const char *pkey_hash_algo[PKEY_HASH__LAST] = {
> > > 
> > > Dropping the "const"?
> > 
> > I will undo this change.
> > 
> > > >  	[PKEY_HASH_MD4]		= "md4",
> > > >  	[PKEY_HASH_MD5]		= "md5",
> > > >  	[PKEY_HASH_SHA1]	= "sha1",
> > > > @@ -72,8 +72,13 @@ const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
> > > >  	[PKEY_HASH_SHA384]	= "sha384",
> > > >  	[PKEY_HASH_SHA512]	= "sha512",
> > > >  	[PKEY_HASH_SHA224]	= "sha224",
> > > > -	[PKEY_HASH_STREEBOG_256] = "md_gost12_256,streebog256",
> > > > -	[PKEY_HASH_STREEBOG_512] = "md_gost12_512,streebog512",
> > > > +	[PKEY_HASH_STREEBOG_256] = "md_gost12_256",
> > > > +	[PKEY_HASH_STREEBOG_512] = "md_gost12_512",
> > > > +};
> > > > +
> > > > +const char *pkey_hash_algo_alias[PKEY_HASH__LAST] = {
> > > > +	[PKEY_HASH_STREEBOG_256] = "streebog256",
> > > > +	[PKEY_HASH_STREEBOG_512] = "streebog512",
> > > >  };
> > > > 
> > > 
> > > If the upstream kernel name is defined as "streebog", the alias would
> > > be "gost".
> > 
> > To me it seems that meaning of what here is alias is really not
> > important.  There is two names in OpenSSL md_gost12_X and streebogX,
> > where streebogX is newer and less accessible, and md_gost12_X is
> > more accessible in older version. While in the kernel name is streebogX.
> > 
> > Probably it's better to distinguish as openssl and kernel names, and not
> > the name and alias.
> 
> The original design matched the kernel haah_info.h.

But for libimaevm we have openssl as crypto library not the kernel. That
pkey_hash_algo/hash_algo_name lists names does not need to reflect kernel
names at all for things to work, since only openssl is interfaced. It is
question of user interface and compatibility with older libs.