Re: [PATCH ima-evm-utils v8 3/3] Read keyid from the cert appended to the key file

[Mimi Zohar <zohar@linux.ibm.com>]

Hi Vitaly,

On Mon, 2021-07-12 at 08:44 +0300, Vitaly Chikunov wrote:
> 
> @@ -43,26 +43,43 @@ cat > test-ca.conf <<- EOF
>  	basicConstraints=CA:TRUE
>  	subjectKeyIdentifier=hash
>  	authorityKeyIdentifier=keyid:always,issuer
> +
> +	[ skid ]
> +	basicConstraints=CA:TRUE
> +	subjectKeyIdentifier=12345678
> +	authorityKeyIdentifier=keyid:always,issuer
>  EOF
>  fi

On my system:
$ openssl version
OpenSSL 1.1.1g FIPS  21 Apr 2020

Not sure this has anything to do with the reason that "skid" is not
supported.   The resulting files are empty.

ls -lat *skid*
-rw-rw-r--. 1 mimi mimi 0 Jul 14 12:02 test-rsa1024_skid.key
-rw-rw-r--. 1 mimi mimi 0 Jul 14 12:02 test-rsa1024_skid.pub

- openssl pkey -in test-rsa1024.key -out test-rsa1024.pub -pubout
- openssl req -verbose -new -nodes -utf8 -sha1 -days 10000 -batch -x509
-extensions skid -config test-ca.conf -newkey rsa:1024 -out test-
rsa1024_skid.cer -outform DER -keyout test-rsa1024_skid.key
Using configuration from test-ca.conf
Error Loading extension section skid   <===


Then the rest of the tests fail.  Probably should check not only if the
file exists, but the size of the file as well.

- openssl pkey -in test-rsa1024_skid.key -out test-rsa1024_skid.pub
-pubout
Can't open test-rsa1024_skid.key for reading, No such file or directory
140493815547712:error:02001002:system library:fopen:No such file or
directory:crypto/bio/bss_file.c:69:fopen('test-rsa1024_skid.key','r')
140493815547712:error:2006D080:BIO routines:BIO_new_file:no such
file:crypto/bio/bss_file.c:76:
unable to load key


- openssl x509 -inform DER -in test-rsa1024_skid.cer
Can't open test-rsa1024_skid.cer for reading, No such file or directory
139636313208640:error:02001002:system library:fopen:No such file or
directory:crypto/bio/bss_file.c:69:fopen('test-rsa1024_skid.cer','rb')
139636313208640:error:2006D080:BIO routines:BIO_new_file:no such
file:crypto/bio/bss_file.c:76:
unable to load certificate

Mimi