On Fri, Mar 05, 2021 at 03:59:56PM -0500, Stefan Berger wrote: > From: Stefan Berger <stef...@linux.ibm.com> > > Add support for using elliptic curve keys for signing modules. It uses > a NIST P384 (secp384r1) key if the user chooses an elliptic curve key > and will have ECDSA support built into the kernel. > > Note: A developer choosing an ECDSA key for signing modules has to > manually delete the signing key (rm certs/signing_key.*) when falling > back to building an older version of a kernel that only supports RSA > keys since otherwise ECDSA-signed modules will not be usable when that > older kernel runs and the ECDSA key was still used for signing modules. > > Signed-off-by: Stefan Berger <stef...@linux.ibm.com> > Reviewed-by: Mimi Zohar <zo...@linux.ibm.com>
Acked-by: Jarkko Sakkinen <jar...@kernel.org> /Jarkko > --- > > v8->v9: > - Automatically select CONFIG_ECDSA for built-in ECDSA support > - Added help documentation > > This patch builds on top Nayna's series for 'kernel build support for > loading the kernel module signing key'. > - https://lkml.org/lkml/2021/2/18/856 > --- > certs/Kconfig | 22 ++++++++++++++++++++++ > certs/Makefile | 14 ++++++++++++++ > crypto/asymmetric_keys/pkcs7_parser.c | 4 ++++ > 3 files changed, 40 insertions(+) > > diff --git a/certs/Kconfig b/certs/Kconfig > index 48675ad319db..919db43ce80b 100644 > --- a/certs/Kconfig > +++ b/certs/Kconfig > @@ -15,6 +15,28 @@ config MODULE_SIG_KEY > then the kernel will automatically generate the private key and > certificate as described in > Documentation/admin-guide/module-signing.rst > > +choice > + prompt "Type of module signing key to be generated" > + default MODULE_SIG_KEY_TYPE_RSA > + help > + The type of module signing key type to generated. This option > + does not apply if a #PKCS11 URI is used. > + > +config MODULE_SIG_KEY_TYPE_RSA > + bool "RSA" > + depends on MODULE_SIG || IMA_APPRAISE_MODSIG > + help > + Use an RSA key for module signing. > + > +config MODULE_SIG_KEY_TYPE_ECDSA > + bool "ECDSA" > + select CRYPTO_ECDSA > + depends on MODULE_SIG || IMA_APPRAISE_MODSIG > + help > + Use an elliptic curve key (NIST P384) for module signing. > + > +endchoice > + > config SYSTEM_TRUSTED_KEYRING > bool "Provide system-wide ring of trusted keys" > depends on KEYS > diff --git a/certs/Makefile b/certs/Makefile > index 3fe6b73786fa..c487d7021c54 100644 > --- a/certs/Makefile > +++ b/certs/Makefile > @@ -69,6 +69,18 @@ else > SIGNER = -signkey $(obj)/signing_key.key > endif # CONFIG_IMA_APPRAISE_MODSIG > > +X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) > + > +# Support user changing key type > +ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA > +keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 > +$(if $(findstring ecdsa-with-,$(X509TEXT)),,$(shell rm -f > $(CONFIG_MODULE_SIG_KEY))) > +endif > + > +ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA > +$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f > $(CONFIG_MODULE_SIG_KEY))) > +endif > + > $(obj)/signing_key.pem: $(obj)/x509.genkey > @$(kecho) "###" > @$(kecho) "### Now generating an X.509 key pair to be used for signing > modules." > @@ -86,12 +98,14 @@ ifeq ($(CONFIG_IMA_APPRAISE_MODSIG),y) > -batch -x509 -config $(obj)/x509.genkey \ > -outform PEM -out $(CA_KEY) \ > -keyout $(CA_KEY) -extensions ca_ext \ > + $(keytype_openssl) \ > $($(quiet)redirect_openssl) > endif # CONFIG_IMA_APPRAISE_MODSIG > $(Q)openssl req -new -nodes -utf8 \ > -batch -config $(obj)/x509.genkey \ > -outform PEM -out $(obj)/signing_key.csr \ > -keyout $(obj)/signing_key.key -extensions myexts \ > + $(keytype_openssl) \ > $($(quiet)redirect_openssl) > $(Q)openssl x509 -req -days 36500 -in $(obj)/signing_key.csr \ > -outform PEM -out $(obj)/signing_key.crt $(SIGNER) \ > diff --git a/crypto/asymmetric_keys/pkcs7_parser.c > b/crypto/asymmetric_keys/pkcs7_parser.c > index 967329e0a07b..2546ec6a0505 100644 > --- a/crypto/asymmetric_keys/pkcs7_parser.c > +++ b/crypto/asymmetric_keys/pkcs7_parser.c > @@ -269,6 +269,10 @@ int pkcs7_sig_note_pkey_algo(void *context, size_t > hdrlen, > ctx->sinfo->sig->pkey_algo = "rsa"; > ctx->sinfo->sig->encoding = "pkcs1"; > break; > + case OID_id_ecdsa_with_sha256: > + ctx->sinfo->sig->pkey_algo = "ecdsa"; > + ctx->sinfo->sig->encoding = "x962"; > + break; > default: > printk("Unsupported pkey algo: %u\n", ctx->last_oid); > return -ENOPKG; > -- > 2.29.2 > >
