Re: [PATCH RESEND] KEYS: trusted: Use ASN.1 encoded OID

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Thu, 2024-05-23 at 16:19 +0300, Jarkko Sakkinen wrote:
> There's no reason to encode OID_TPMSealedData at run-time, as it
> never changes.
> 
> Replace it with the encoded version, which has exactly the same size:
> 
>         67 81 05 0A 01 05
> 
> Include OBJECT IDENTIFIER (0x06) tag and length as the epilogue so
> that the OID can be simply copied to the blob.

This is true, but if we're going to do this, we should expand the OID
registry functions (in lib/oid_registry.c) to do something like
encode_OID.  The registry already contains the hex above minus the two
prefixes (which are easy to add).

I also note:

> @ -51,8 +52,8 @@ static int tpm2_key_encode(struct
> trusted_key_payload *payload,
>         if (!scratch)
>                 return -ENOMEM;
>  
> -       work = asn1_encode_oid(work, end_work, tpm2key_oid,
> -                              asn1_oid_len(tpm2key_oid));
> +       work = memcpy(work, OID_TPMSealedData_ASN1,
> sizeof(OID_TPMSealedData_ASN1));
> +       work += sizeof(OID_TPMSealedData_ASN1);

You lost the actually fits check.  This is somewhat irrelevant for TPM
keys because the OID is first in the structure and thus will never
overflow, but it might matter for other uses.

James