From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755225AbcCBML0 (ORCPT ); Wed, 2 Mar 2016 07:11:26 -0500 Received: from e23smtp09.au.ibm.com ([202.81.31.142]:60999 "EHLO e23smtp09.au.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753358AbcCBMLX (ORCPT ); Wed, 2 Mar 2016 07:11:23 -0500 X-IBM-Helo: d23dlp03.au.ibm.com X-IBM-MailFrom: zohar@linux.vnet.ibm.com X-IBM-RcptTo: keyrings@vger.kernel.org;linux-kernel@vger.kernel.org;linux-security-module@vger.kernel.org Message-ID: <1456920627.2780.60.camel@linux.vnet.ibm.com> Subject: Re: [RFC PATCH 0/7] KEYS: Adjust public key signature handling From: Mimi Zohar To: David Howells Cc: keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Date: Wed, 02 Mar 2016 07:10:27 -0500 In-Reply-To: <20160229182136.27797.75917.stgit@warthog.procyon.org.uk> References: <20160229182136.27797.75917.stgit@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16030212-0033-0000-0000-00000309613E Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi David, On Mon, 2016-02-29 at 18:21 +0000, David Howells wrote: > These patches do the following: > > (1) Retain a signature in an asymmetric-type key and associate with it the > identifiers that will match a key that can be used to verify it. > > (2) Differentiate an X.509 cert that cannot be used versus one that cannot > be verified due to unavailable crypto. This is noted in the > structures involved. > > (3) Determination of the self-signedness of an X.509 cert is improved to > include checks on the subject/issuer names and the key > algorithm/signature algorithm types. > > (4) Self-signed X.509 certificates are consistency checked early on if the > appropriate crypto is available. > > This set of patches is a prelude to a set that changes how trustworthiness > is determined. These patches don't apply directly on top of linux-security. Maybe they apply on top of an updated version of the "X.509: Software public key subtype changes" patch set. In which branch are these patches? thanks, Mimi