Re: ASN.1

["Jarkko Sakkinen" <jarkko.sakkinen@iki.fi>]

On Wed May 22, 2024 at 4:49 PM EEST, Jarkko Sakkinen wrote:
> If we want to considering getting your code to land to the kernel I
> would start with the decoder as it already delivers, as an
> *experimental* feature. Then when it is landed it would not be
> as huge stretch to move forward with the encoder.

About the encoder. It is relatively new and has only caller, and I'm not
sure if we care about it that much.

In my case I just did:

static int tpm2_key_rsa_encode(const struct tpm2_key_rsa *key, u8 *buf)
{
	int pub_len = key->pub_len;
	const u8 *pub = key->pub;
	u8 *start = &buf[4];
	u8 *work = &buf[4];
	u32 seq_len;

	work[0] = 0x02;			/* INTEGER */
	work[1] = 0x82;			/* u16 */
	work[2] = pub_len >> 8;
	work[3] = pub_len & 0xff;
	work = &work[4];
	memcpy(work, pub, pub_len);
	work = &work[pub_len];
	work[0] = 0x02;			/* INTEGER */
	work[1] = 3;			/* < 128 */
	work[2] = 1;			/* 65537 */
	work[3] = 0;
	work[4]	= 1;
	work = &work[5];
	memset(work, 0, 8);
	seq_len = work - start;
	buf[0] = 0x30;			/* SEQUENCE */
	buf[1] = 0x82;			/* u16 */
	buf[2] = seq_len >> 8;
	buf[3] = seq_len & 0xff;

	return seq_len + 4;
}

Not the prettiest looking but it does the job and is actually easy
to verify :-) Decoder is on the other hand old and mature and makes
more sense both in implementation and architecture.

Looking back it was my mistake to let that encoder into the mainline,
I did not use it because it did not make sense to me, or at least
less sense than above, which practically never changes and is easy
to also later verify and fix, despite being somewhat archaic.

Given this if we want to work on ASN1_RUST experimental feature, I
can create a patch that open codes the call site in trusted_tpm2.c
and thus ASN1_ENCODER can be droper entirely. It is not a priority
but could be part of the patch set, or Git branch, which adds
ASN1_RUST.

So what I might do to move forward is early next month to start
with such patch and create asn1rust branch to my tree at:

https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git

And then start looking at the crate and perhaps post here a more
refined suggestion how to move forward.

Early next month because I have a conference demo to do (actually
in Rust but not kernel related) by the end of the month.

The reason I'm concerned about the topic is that keyring has literally
billions of users dependent on it (mostly without knowing but it is used
practically in any Linux installation) and I know that Rust side needs
ASN.1 eventually, so I want to make sure that the integration path works
for us.

So let's now pretend that encoder did not exist and focus only on
decoder :-)

Sounds like a plan? 

BR, Jarkko