From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753191AbbH1VJd (ORCPT ); Fri, 28 Aug 2015 17:09:33 -0400 Received: from outbound.smtp.vt.edu ([198.82.183.121]:59018 "EHLO omr1.cc.vt.edu" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752609AbbH1VJc (ORCPT ); Fri, 28 Aug 2015 17:09:32 -0400 X-Mailer: exmh version 2.8.0 04/21/2012 with nmh-1.6+dev To: David Howells Cc: David Woodhouse , linux-kernel@vger.kernel.org Subject: Re: Module signing broken after SYSTEM_DATA_VERIFICATION commit? From: Valdis.Kletnieks@vt.edu In-Reply-To: <11332.1440757434@warthog.procyon.org.uk> References: <186755.1440729515@turing-police.cc.vt.edu> <11332.1440757434@warthog.procyon.org.uk> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="==_Exmh_1440796162_2157P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit Date: Fri, 28 Aug 2015 17:09:22 -0400 Message-ID: <5375.1440796162@turing-police.cc.vt.edu> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --==_Exmh_1440796162_2157P Content-Type: text/plain; charset="us-ascii" Content-Id: <5350.1440796152.1@turing-police.cc.vt.edu> On Fri, 28 Aug 2015 11:23:54 +0100, David Howells said: > Valdis Kletnieks wrote: > > > [ 31.829322] PKCS7: Unknown OID: [32] 2.16.840.1.101.3.4.2.3 > > [ 31.829328] PKCS7: Unknown OID: [180] 2.16.840.1.101.3.4.2.3 > > OID_sha1, /* 1.3.14.3.2.26 */ > OID_sha256, /* 2.16.840.1.101.3.4.2.1 */ > > I suspect I'm missing something here in oid_registry.h. Looking online, I > see: > > id-sha256 OBJECT IDENTIFIER ::= { hashAlgs 1 } > id-sha384 OBJECT IDENTIFIER ::= { hashAlgs 2 } > id-sha512 OBJECT IDENTIFIER ::= { hashAlgs 3 } > id-sha224 OBJECT IDENTIFIER ::= { hashAlgs 4 } > id-sha512-224 OBJECT IDENTIFIER ::= { hashAlgs 5 } > id-sha512-256 OBJECT IDENTIFIER ::= { hashAlgs 6 } > > Are you perchance using sha512 hashes in your signatures? % grep MODULE_SIG /usr/src/linux-next/.config CONFIG_MODULE_SIG=y # CONFIG_MODULE_SIG_FORCE is not set CONFIG_MODULE_SIG_ALL=y # CONFIG_MODULE_SIG_SHA1 is not set # CONFIG_MODULE_SIG_SHA224 is not set # CONFIG_MODULE_SIG_SHA256 is not set # CONFIG_MODULE_SIG_SHA384 is not set CONFIG_MODULE_SIG_SHA512=y CONFIG_MODULE_SIG_HASH="sha512" CONFIG_MODULE_SIG_KEY="signing_key.pem" --==_Exmh_1440796162_2157P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Exmh version 2.5 07/13/2001 iQIVAwUBVeDOAgdmEQWDXROgAQLFzg//Qe7o2Q+OZvXOAzC157FQi4zrcSXf9N3x kOFEn5sRL1SMSC6ad/bcgx1GiF/T6xWO0vaGHTGeKc70i8chwVaOGJb8a/khSO3i bGjaHswh7SlmC9Js+58+x+HNY7JCx9UpRUq4lHrzVmrdko41Ze6LIDslloQB7GNX qjFecXr4Aj+APmHhJt052+DIV6/nIqq8GDm+dXsv+/wMPmWYeRRw+hPi1nCLx77l Vxa3jlqVEXzehT7iC8du8ynJMWykbRVENeF0HAMAR6qkfzlfoFVQW4x/7rI6Q9VX xr44zp18TpSfi8xHK6dbG3JIrBefJTMr6OG//MTRndD3pTVk1ri4FsUNj8gkRrt1 xBvLiYTYlnadjgugg3AYheKoE4BiExDS3Nn7aMDJB+HLCEgRq0rhNWNIC2K87SLc F1rh89pETZmLoUxXiVDe6g7lIWf+R9IQOBvEn2r7XB5ZEHpHQQJTkMpzJ0H4PIsf qfza0a8Kpqf5UpBm+1pbMvmrkn+rCN9wFM58fa+jCqCyTVMcQOv2bWyIVj8rSXmV //JZ0fEIDWqdvGX8EQZorkrcXA7w9JcxItD+CisL73HyAmNXxX4BP3j4ulz/cJGE WE5KY9yHpOspnyclExbVX/Yr6zGd9TF2JOmmzvBUaYAMqDc0eiXezjX4jAhA0Aq0 Zid1b2+3geE= =B5ax -----END PGP SIGNATURE----- --==_Exmh_1440796162_2157P--