31 May, 2019
1 commit
-
Based on 1 normalized pattern(s):
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later versionextracted by the scancode license scanner the SPDX license identifier
GPL-2.0-or-later
has been chosen to replace the boilerplate/reference in 3029 file(s).
Signed-off-by: Thomas Gleixner
Reviewed-by: Allison Randal
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
Signed-off-by: Greg Kroah-Hartman
18 Apr, 2019
2 commits
-
Previous akcipher .verify() just `decrypts' (using RSA encrypt which is
using public key) signature to uncover message hash, which was then
compared in upper level public_key_verify_signature() with the expected
hash value, which itself was never passed into verify().This approach was incompatible with EC-DSA family of algorithms,
because, to verify a signature EC-DSA algorithm also needs a hash value
as input; then it's used (together with a signature divided into halves
`r||s') to produce a witness value, which is then compared with `r' to
determine if the signature is correct. Thus, for EC-DSA, nor
requirements of .verify() itself, nor its output expectations in
public_key_verify_signature() wasn't sufficient.Make improved .verify() call which gets hash value as input and produce
complete signature check without any output besides status.Now for the top level verification only crypto_akcipher_verify() needs
to be called and its return value inspected.Make sure that `digest' is in kmalloc'd memory (in place of `output`) in
{public,tpm}_key_verify_signature() as insisted by Herbert Xu, and will
be changed in the following commit.Cc: David Howells
Cc: keyrings@vger.kernel.org
Signed-off-by: Vitaly Chikunov
Reviewed-by: Denis Kenzior
Signed-off-by: Herbert Xu -
In preparation for new akcipher verify call remove sign/verify callbacks
from RSA backends and make PKCS1 driver call encrypt/decrypt instead.This also complies with the well-known idea that raw RSA should never be
used for sign/verify. It only should be used with proper padding scheme
such as PKCS1 driver provides.Cc: Giovanni Cabiddu
Cc: qat-linux@intel.com
Cc: Tom Lendacky
Cc: Gary Hook
Cc: Horia Geantă
Cc: Aymen Sghaier
Signed-off-by: Vitaly Chikunov
Reviewed-by: Horia Geantă
Acked-by: Gary R Hook
Signed-off-by: Herbert Xu
18 Jan, 2019
1 commit
-
Include internal/rsa.h in rsa-pkcs1pad.c to get the declaration of
rsa_pkcs1pad_tmpl. This fixes the following sparse warning:crypto/rsa-pkcs1pad.c:698:24: warning: symbol 'rsa_pkcs1pad_tmpl' was not declared. Should it be static?
Cc: Andrzej Zaborowski
Signed-off-by: Eric Biggers
Signed-off-by: Herbert Xu
26 Oct, 2018
1 commit
-
The original pkcs1pad implementation allowed to pad/unpad raw RSA
output. However, this has been taken out in commit:
commit c0d20d22e0ad ("crypto: rsa-pkcs1pad - Require hash to be present")This patch restored this ability as it is needed by the asymmetric key
implementation.Signed-off-by: Denis Kenzior
Signed-off-by: David Howells
Tested-by: Marcel Holtmann
Reviewed-by: Marcel Holtmann
Signed-off-by: James Morris
28 Sep, 2018
1 commit
-
The encryption mode of pkcs1pad never uses out_sg and out_buf, so
there's no need to allocate the buffer, which presently is not even
being freed.CC: Herbert Xu
CC: linux-crypto@vger.kernel.org
CC: "David S. Miller"
Signed-off-by: Dan Aloni
Signed-off-by: Herbert Xu
15 Feb, 2018
1 commit
-
After checking all possible call chains to kzalloc here,
my tool finds that this kzalloc is never called in atomic context.
Thus GFP_ATOMIC is not necessary, and it can be replaced with GFP_KERNEL.This is found by a static analysis tool named DCNS written by myself.
Signed-off-by: Jia-Ju Bai
Signed-off-by: Herbert Xu
03 Nov, 2017
1 commit
-
Now that -EBUSY return code only indicates backlog queueing
we can safely remove the now redundant check for the
CRYPTO_TFM_REQ_MAY_BACKLOG flag when -EBUSY is returned.Signed-off-by: Gilad Ben-Yossef
Signed-off-by: Herbert Xu
20 Jun, 2017
1 commit
-
Otherwise, we enable all sorts of forgeries via timing attack.
Signed-off-by: Jason A. Donenfeld
Suggested-by: Stephan Müller
Cc: stable@vger.kernel.org
Cc: Herbert Xu
Cc: linux-crypto@vger.kernel.org
Signed-off-by: Herbert Xu
10 Jun, 2017
1 commit
-
crypto_akcipher_maxsize() asks for the output buffer size without
caring for errors. It allways assume that will be called after
a valid setkey. Comply with it and return what he wants.crypto_akcipher_maxsize() now returns an unsigned int.
Remove the unnecessary check.Signed-off-by: Tudor Ambarus
Signed-off-by: Herbert Xu
22 Sep, 2016
1 commit
-
As the software RSA implementation now produces fixed-length
output, we need to eliminate leading zeros in the calling code
instead.This patch does just that for pkcs1pad decryption while signature
verification was fixed in an earlier patch.Fixes: 9b45b7bba3d2 ("crypto: rsa - Generate fixed-length output")
Reported-by: Mat Martineau
Signed-off-by: Herbert Xu
19 Jul, 2016
1 commit
-
To allow for child request context the struct akcipher_request child_req
needs to be at the end of the structure.Signed-off-by: Tadeusz Struk
Signed-off-by: Herbert Xu
03 Jul, 2016
1 commit
-
As the software RSA implementation now produces fixed-length
output, we need to eliminate leading zeros in the calling code
instead.This patch does just that for pkcs1pad signature verification.
Fixes: 9b45b7bba3d2 ("crypto: rsa - Generate fixed-length output")
Reported-by: Stephan Mueller
Signed-off-by: Herbert Xu
01 Jul, 2016
5 commits
-
In the vast majority of cases (2^-32 on 32-bit and 2^-64 on 64-bit)
cases, the result from encryption/signing will require no padding.This patch makes these two operations write their output directly
to the final destination. Only in the exceedingly rare cases where
fixup is needed to we copy it out and back to add the leading zeroes.This patch also makes use of the crypto_akcipher_set_crypt API
instead of writing the akcipher request directly.Signed-off-by: Herbert Xu
-
Rather than repeatedly checking the key size on each operation,
we should be checking it once when the key is set.Signed-off-by: Herbert Xu
-
We don't currently support using akcipher in atomic contexts,
so GFP_KERNEL should always be used.Signed-off-by: Herbert Xu
-
The helper pkcs1pad_sg_set_buf tries to split a buffer that crosses
a page boundary into two SG entries. This is unnecessary. This
patch removes that.Signed-off-by: Herbert Xu
-
The only user of rsa-pkcs1pad always uses the hash so there is
no reason to support the case of not having a hash.This patch also changes the digest info lookup so that it is
only done once during template instantiation rather than on each
operation.Signed-off-by: Herbert Xu
15 Apr, 2016
1 commit
-
The output buffer length has to be at least as big as the key_size.
It is then updated to the actual output size by the implementation.Cc:
Signed-off-by: Tadeusz Struk
Signed-off-by: Herbert Xu
04 Mar, 2016
1 commit
-
This adds hash param to pkcs1pad.
The pkcs1pad template can work with or without the hash.
When hash param is provided then the verify operation will
also verify the output against the known digest.Signed-off-by: Tadeusz Struk
Signed-off-by: David Howells
Acked-by: Herbert Xu
22 Dec, 2015
1 commit
-
Avoid the s390 compile "warning: 'pkcs1pad_encrypt_sign_complete'
uses dynamic stack allocation" reported by kbuild test robot. Don't
use a flat zero-filled buffer, instead zero the contents of the SGL.Signed-off-by: Andrew Zaborowski
Signed-off-by: Herbert Xu
09 Dec, 2015
1 commit
-
This patch adds PKCS#1 v1.5 standard RSA padding as a separate template.
This way an RSA cipher with padding can be obtained by instantiating
"pkcs1pad(rsa)". The reason for adding this is that RSA is almost
never used without this padding (or OAEP) so it will be needed for
either certificate work in the kernel or the userspace, and I also hear
that it is likely implemented by hardware RSA in which case hardware
implementations of the whole of pkcs1pad(rsa) can be provided.Signed-off-by: Andrew Zaborowski
Signed-off-by: Herbert Xu