Eric Lee / smarc-fsl-linux-kernel

31 May, 2016

1 commit

  • 446985428   Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 ... Browse Code »

    Pull crypto fixes from Herbert Xu:
    "This fixes the following issues:

    - missing selection in public_key that may result in a build failure

    - Potential crash in error path in omap-sham

    - ccp AES XTS bug that affects requests larger than 4096"

    * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
    crypto: ccp - Fix AES XTS error for request sizes above 4096
    crypto: public_key: select CRYPTO_AKCIPHER
    crypto: omap-sham - potential Oops on error in probe

    Linus Torvalds
     

19 May, 2016

1 commit

  • bad6a185b   crypto: public_key: select CRYPTO_AKCIPHER ... Browse Code »

    In some rare randconfig builds, we can end up with
    ASYMMETRIC_PUBLIC_KEY_SUBTYPE enabled but CRYPTO_AKCIPHER disabled,
    which fails to link because of the reference to crypto_alloc_akcipher:

    crypto/built-in.o: In function `public_key_verify_signature':
    :(.text+0x110e4): undefined reference to `crypto_alloc_akcipher'

    This adds a Kconfig 'select' statement to ensure the dependency
    is always there.

    Cc:
    Signed-off-by: Arnd Bergmann
    Signed-off-by: Herbert Xu

    Arnd Bergmann
     

12 Apr, 2016

1 commit

  • 99716b7ca   KEYS: Make the system trusted keyring depend on the asymmetric key type ... Browse Code »

    Make the system trusted keyring depend on the asymmetric key type as
    there's not a lot of point having it if you can't then load asymmetric keys
    onto it.

    This requires the ASYMMETRIC_KEY_TYPE to be made a bool, not a tristate, as
    the Kconfig language doesn't then correctly force ASYMMETRIC_KEY_TYPE to
    'y' rather than 'm' if SYSTEM_TRUSTED_KEYRING is 'y'.

    Making SYSTEM_TRUSTED_KEYRING *select* ASYMMETRIC_KEY_TYPE instead doesn't
    work as the Kconfig interpreter then wrongly complains about dependency
    loops.

    Signed-off-by: David Howells

    David Howells
     

06 Apr, 2016

1 commit

  • e68503bd6   KEYS: Generalise system_verify_data() to provide access to internal content ... Browse Code »

    Generalise system_verify_data() to provide access to internal content
    through a callback. This allows all the PKCS#7 stuff to be hidden inside
    this function and removed from the PE file parser and the PKCS#7 test key.

    If external content is not required, NULL should be passed as data to the
    function. If the callback is not required, that can be set to NULL.

    The function is now called verify_pkcs7_signature() to contrast with
    verify_pefile_signature() and the definitions of both have been moved into
    linux/verification.h along with the key_being_used_for enum.

    Signed-off-by: David Howells

    David Howells
     

04 Mar, 2016

1 commit

  • d43de6c78   akcipher: Move the RSA DER encoding check to the crypto layer ... Browse Code »

    Move the RSA EMSA-PKCS1-v1_5 encoding from the asymmetric-key public_key
    subtype to the rsa crypto module's pkcs1pad template. This means that the
    public_key subtype no longer has any dependencies on public key type.

    To make this work, the following changes have been made:

    (1) The rsa pkcs1pad template is now used for RSA keys. This strips off the
    padding and returns just the message hash.

    (2) In a previous patch, the pkcs1pad template gained an optional second
    parameter that, if given, specifies the hash used. We now give this,
    and pkcs1pad checks the encoded message E(M) for the EMSA-PKCS1-v1_5
    encoding and verifies that the correct digest OID is present.

    (3) The crypto driver in crypto/asymmetric_keys/rsa.c is now reduced to
    something that doesn't care about what the encryption actually does
    and and has been merged into public_key.c.

    (4) CONFIG_PUBLIC_KEY_ALGO_RSA is gone. Module signing must set
    CONFIG_CRYPTO_RSA=y instead.

    Thoughts:

    (*) Should the encoding style (eg. raw, EMSA-PKCS1-v1_5) also be passed to
    the padding template? Should there be multiple padding templates
    registered that share most of the code?

    Signed-off-by: David Howells
    Signed-off-by: Tadeusz Struk
    Acked-by: Herbert Xu

    David Howells
     

10 Feb, 2016

1 commit

23 Jul, 2014

1 commit

18 Jul, 2014

1 commit

09 Jul, 2014

2 commits

08 Jul, 2014

2 commits

  • 22d01afb2   PKCS#7: Provide a key type for testing PKCS#7 ... Browse Code »

    Provide a key type for testing the PKCS#7 parser. It is given a non-detached
    PKCS#7 message as payload:

    keyctl padd pkcs7_test a @s out

    stuff.txt:
    echo "The quick red fox jumped over the lazy brown dog" >stuff.txt

    certs: key1.x509 key2.x509 key3.x509 key4.x509
    cat key{1,3}.x509 >$@

    ###############################################################################
    #
    # Generate a signed key
    #
    # openssl x509 -text -inform PEM -noout -in key2.x509
    #
    ###############################################################################
    key2.x509: key2.x509_unsigned key1.priv key1.x509
    openssl x509 \
    -req -in key2.x509_unsigned \
    -out key2.x509 \
    -extfile key2.genkey -extensions myexts \
    -CA key1.x509 \
    -CAkey key1.priv \
    -CAcreateserial

    key2.priv key2.x509_unsigned: key2.genkey
    openssl req -new -nodes -utf8 -sha1 -days 36500 \
    -batch -outform PEM \
    -config key2.genkey \
    -keyout key2.priv \
    -out key2.x509_unsigned

    key2.genkey:
    @echo Generating X.509 key generation config
    @echo >$@ "[ req ]"
    @echo >>$@ "default_bits = 4096"
    @echo >>$@ "distinguished_name = req_distinguished_name"
    @echo >>$@ "prompt = no"
    @echo >>$@ "string_mask = utf8only"
    @echo >>$@ "x509_extensions = myexts"
    @echo >>$@
    @echo >>$@ "[ req_distinguished_name ]"
    @echo >>$@ "O = Magrathea"
    @echo >>$@ "CN = PKCS7 key 2"
    @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2"
    @echo >>$@
    @echo >>$@ "[ myexts ]"
    @echo >>$@ "basicConstraints=critical,CA:FALSE"
    @echo >>$@ "keyUsage=digitalSignature"
    @echo >>$@ "subjectKeyIdentifier=hash"
    @echo >>$@ "authorityKeyIdentifier=keyid"

    ###############################################################################
    #
    # Generate a couple of signing keys
    #
    # openssl x509 -text -inform PEM -noout -in key1.x509
    #
    ###############################################################################
    key1.x509: key1.x509_unsigned key4.priv key4.x509
    openssl x509 \
    -req -in key1.x509_unsigned \
    -out key1.x509 \
    -extfile key1.genkey -extensions myexts \
    -CA key4.x509 \
    -CAkey key4.priv \
    -CAcreateserial

    key1.priv key1.x509_unsigned: key1.genkey
    openssl req -new -nodes -utf8 -sha1 -days 36500 \
    -batch -outform PEM \
    -config key1.genkey \
    -keyout key1.priv \
    -out key1.x509_unsigned

    key1.genkey:
    @echo Generating X.509 key generation config
    @echo >$@ "[ req ]"
    @echo >>$@ "default_bits = 4096"
    @echo >>$@ "distinguished_name = req_distinguished_name"
    @echo >>$@ "prompt = no"
    @echo >>$@ "string_mask = utf8only"
    @echo >>$@ "x509_extensions = myexts"
    @echo >>$@
    @echo >>$@ "[ req_distinguished_name ]"
    @echo >>$@ "O = Magrathea"
    @echo >>$@ "CN = PKCS7 key 1"
    @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2"
    @echo >>$@
    @echo >>$@ "[ myexts ]"
    @echo >>$@ "basicConstraints=critical,CA:TRUE"
    @echo >>$@ "keyUsage=digitalSignature,keyCertSign"
    @echo >>$@ "subjectKeyIdentifier=hash"
    @echo >>$@ "authorityKeyIdentifier=keyid"

    ###############################################################################
    #
    # Generate a signed key
    #
    # openssl x509 -text -inform PEM -noout -in key4.x509
    #
    ###############################################################################
    key4.x509: key4.x509_unsigned key3.priv key3.x509
    openssl x509 \
    -req -in key4.x509_unsigned \
    -out key4.x509 \
    -extfile key4.genkey -extensions myexts \
    -CA key3.x509 \
    -CAkey key3.priv \
    -CAcreateserial

    key4.priv key4.x509_unsigned: key4.genkey
    openssl req -new -nodes -utf8 -sha1 -days 36500 \
    -batch -outform PEM \
    -config key4.genkey \
    -keyout key4.priv \
    -out key4.x509_unsigned

    key4.genkey:
    @echo Generating X.509 key generation config
    @echo >$@ "[ req ]"
    @echo >>$@ "default_bits = 4096"
    @echo >>$@ "distinguished_name = req_distinguished_name"
    @echo >>$@ "prompt = no"
    @echo >>$@ "string_mask = utf8only"
    @echo >>$@ "x509_extensions = myexts"
    @echo >>$@
    @echo >>$@ "[ req_distinguished_name ]"
    @echo >>$@ "O = Magrathea"
    @echo >>$@ "CN = PKCS7 key 4"
    @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2"
    @echo >>$@
    @echo >>$@ "[ myexts ]"
    @echo >>$@ "basicConstraints=critical,CA:TRUE"
    @echo >>$@ "keyUsage=digitalSignature,keyCertSign"
    @echo >>$@ "subjectKeyIdentifier=hash"
    @echo >>$@ "authorityKeyIdentifier=keyid"

    ###############################################################################
    #
    # Generate a couple of signing keys
    #
    # openssl x509 -text -inform PEM -noout -in key3.x509
    #
    ###############################################################################
    key3.priv key3.x509: key3.genkey
    openssl req -new -nodes -utf8 -sha1 -days 36500 \
    -batch -x509 -outform PEM \
    -config key3.genkey \
    -keyout key3.priv \
    -out key3.x509

    key3.genkey:
    @echo Generating X.509 key generation config
    @echo >$@ "[ req ]"
    @echo >>$@ "default_bits = 4096"
    @echo >>$@ "distinguished_name = req_distinguished_name"
    @echo >>$@ "prompt = no"
    @echo >>$@ "string_mask = utf8only"
    @echo >>$@ "x509_extensions = myexts"
    @echo >>$@
    @echo >>$@ "[ req_distinguished_name ]"
    @echo >>$@ "O = Magrathea"
    @echo >>$@ "CN = PKCS7 key 3"
    @echo >>$@ "emailAddress = slartibartfast@magrathea.h2g2"
    @echo >>$@
    @echo >>$@ "[ myexts ]"
    @echo >>$@ "basicConstraints=critical,CA:TRUE"
    @echo >>$@ "keyUsage=digitalSignature,keyCertSign"
    @echo >>$@ "subjectKeyIdentifier=hash"
    @echo >>$@ "authorityKeyIdentifier=keyid"

    clean:
    $(RM) *~
    $(RM) key1.* key2.* key3.* key4.* stuff.* out certs

    Signed-off-by: David Howells

    David Howells
     
  • 2e3fadbf7   PKCS#7: Implement a parser [RFC 2315] ... Browse Code »

    Implement a parser for a PKCS#7 signed-data message as described in part of
    RFC 2315.

    Signed-off-by: David Howells
    Acked-by: Vivek Goyal
    Reviewed-by: Kees Cook

    David Howells
     

01 Nov, 2013

1 commit

  • dbed71416   KEYS: The RSA public key algorithm needs to select MPILIB ... Browse Code »

    The RSA public key algorithm needs to select MPILIB directly in Kconfig as the
    'select' directive is not recursive and is thus MPILIB is not enabled by
    selecting MPILIB_EXTRA.

    Without this, the following errors can occur:

    crypto/built-in.o: In function `RSA_verify_signature':
    rsa.c:(.text+0x1d347): undefined reference to `mpi_get_nbits'
    rsa.c:(.text+0x1d354): undefined reference to `mpi_get_nbits'
    rsa.c:(.text+0x1d36e): undefined reference to `mpi_cmp_ui'
    rsa.c:(.text+0x1d382): undefined reference to `mpi_cmp'
    rsa.c:(.text+0x1d391): undefined reference to `mpi_alloc'
    rsa.c:(.text+0x1d3b0): undefined reference to `mpi_powm'
    rsa.c:(.text+0x1d3c3): undefined reference to `mpi_free'
    rsa.c:(.text+0x1d3d8): undefined reference to `mpi_get_buffer'
    rsa.c:(.text+0x1d4d4): undefined reference to `mpi_free'
    rsa.c:(.text+0x1d503): undefined reference to `mpi_get_nbits'

    Reported-by: Randy Dunlap
    Signed-off-by: David Howells
    Acked-by: Randy Dunlap

    David Howells
     

26 Oct, 2013

1 commit

25 Sep, 2013

1 commit

  • 206ce59a1   KEYS: Move the algorithm pointer array from x509 to public_key.c ... Browse Code »

    Move the public-key algorithm pointer array from x509_public_key.c to
    public_key.c as it isn't X.509 specific.

    Note that to make this configure correctly, the public key part must be
    dependent on the RSA module rather than the other way round. This needs a
    further patch to make use of the crypto module loading stuff rather than using
    a fixed table.

    Signed-off-by: David Howells
    Reviewed-by: Kees Cook
    Reviewed-by: Josh Boyer

    David Howells
     

08 Oct, 2012

4 commits