From: Eric Biggers <ebiggers@kernel.org>
To: Massimiliano Marretta <massimiliano.marretta@egicon.com>
Cc: David Howells <dhowells@redhat.com>,
David Woodhouse <dwmw2@infradead.org>,
Nathan Chancellor <nathan@kernel.org>,
Nicolas Schier <nsc@kernel.org>,
keyrings@vger.kernel.org, linux-kbuild@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 0/2] Add bulk signing support for PKCS#11 keys
Date: Fri, 9 Oct 2026 15:52:28 +0200 [thread overview]
Message-ID: <20261009135228.GA321175@quark> (raw)
In-Reply-To: <20261009101915.495734-1-massimiliano.marretta@egicon.com>
On Fri, Oct 09, 2026 at 12:19:13PM +0200, Massimiliano Marretta wrote:
> Add support for signing kernel modules in bulk when the signing
> key is stored on a PKCS#11 token.
>
> Currently scripts/sign-file signs one module per invocation. When
> the key lives on a PKCS#11 token (e.g. a Nitrokey HSM or a
> SmartCard-HSM), every invocation pays a fixed initialization cost
> of 25-36 seconds, which dominates the actual signing time. For a
> typical build with hundreds of modules this is impractical.
Can you elaborate on what problem you're trying to solve by using not
only asymmetric signatures, but also an HSM to hold the private key?
Have you considered hash-based integrity checking
(https://lore.kernel.org/linux-modules/20260505-module-hashes-v5-0-e174a5a49fce@weissschuh.net/)?
- Eric
next prev parent reply other threads:[~2026-10-09 13:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-09 10:19 Massimiliano Marretta
2026-10-09 10:19 ` [PATCH 1/2] scripts/sign-file: add bulk module signing support Massimiliano Marretta
2026-10-09 10:19 ` [PATCH 2/2] kbuild: sign modules in bulk when the signing key is on PKCS#11 Massimiliano Marretta
2026-10-09 13:52 ` Eric Biggers [this message]
2026-10-09 16:13 ` [PATCH 0/2] Add bulk signing support for PKCS#11 keys Massimiliano Marretta
2026-10-09 16:26 ` Eric Biggers
2026-10-09 17:10 ` Massimiliano Marretta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261009135228.GA321175@quark \
--to=ebiggers@kernel.org \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=massimiliano.marretta@egicon.com \
--cc=nathan@kernel.org \
--cc=nsc@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®