From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752941AbdEPTAX (ORCPT ); Tue, 16 May 2017 15:00:23 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:45686 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752154AbdEPTAS (ORCPT ); Tue, 16 May 2017 15:00:18 -0400 Subject: Re: [Linux-ima-devel] [PATCH 0/7] IMA: new parser for ima_restore_measurement_list() To: linux-ima-devel@lists.sourceforge.net Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org References: <20170516125347.10574-1-roberto.sassu@huawei.com> From: Ken Goldman Date: Tue, 16 May 2017 15:00:15 -0400 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.1.0 MIME-Version: 1.0 In-Reply-To: <20170516125347.10574-1-roberto.sassu@huawei.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 x-cbid: 17051619-0012-0000-0000-000014402F13 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00007073; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000212; SDB=6.00861384; UDB=6.00427228; IPR=6.00641048; BA=6.00005352; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00015484; XFM=3.00000015; UTC=2017-05-16 19:00:15 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17051619-0013-0000-0000-00004DB096F3 Message-Id: <4f5bc289-92cb-1ce2-4496-387efbb11769@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-05-16_05:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1705160150 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 5/16/2017 8:53 AM, Roberto Sassu wrote: > A new IMA measurement list format, called Crypto Agile, will be introduced > shortly to take full advantage of the algorithm flexibility of TPM 2.0. > With the new format, it will be possible to provide for each list entry > multiple digests, each calculated with an algorithm supported by the TPM. > Those digests will be used by remote entities to verify the integrity of > the measurements list. > > The current (SHA1) and the new (Crypto Agile) format definitions are: > > SHA1: pcr[4] digest[20] > template_name_len[4] template_name[template_name_len] > template_data_len[4] template_data[template_data_len] > > Crypto Agile: pcr[4] total_digest_len[4] > digest1_len[4] digest1[digest1_len] ... > digestN_len[4] digestN[digestN_len] > template_name_len[4] template_name[template_name_len] > template_data_len[4] template_data[template_data_len] 1 - In this proposed format, how does the parser or consumer of the log know what algorithm is used for digestN. For example, the TCG standard format uses TPML_DIGEST_VALUES uint32_t count - the number of digests TPMT_HA TPMT_HA digests[] where a TPMT_HA is algorithm identifier digest byte array 2 - Not a criticism, just a question for understanding ... Would it be true that the total_digest_length == the sum of all the digestN_len values plus 4 bytes for each length. Does it determine how many digests there are by when the total length is consumed?