Messages in this thread | | | Subject | Re: [Keyrings] Re: [PATCH 01/04] Add multi-precision-integer maths library | From | Dax Kelson <> | Date | Sun, 29 Jan 2006 11:49:24 -0700 |
| |
..... Original Message ....... On Sun, 29 Jan 2006 11:38:22 -0500 "Trond Myklebust" <trond.myklebust@fys.uio.no> wrote: >On Sun, 2006-01-29 at 12:33 +0100, David Härdeman wrote: > >> >Why would you want to use proxy certificates for you own use? Use your >> >own certificate for your own processes, and issue one or more proxy >> >certificates to any daemon that you want to authorise to do some limited >> >task. >> >> I meant that you can't use proxy certs for your own use, so you still need >> to store your own cert/key somehow...and I still believe that the kernel >> keyring is the best place... > >Agreed. Now, reread what I said above, and tell me why this is an >argument for doing dsa in the kernel? > >> >...and what does this statement about "keys being safer in the kernel" >> >mean? >> >> swap-out to disk, ptrace, coredump all become non-issues. And in >> combination with some other security features (such as disallowing >> modules, read/write of /dev/mem + /dev/kmem, limited permissions via >> SELinux, etc), it becomes pretty hard for the attacker to get your >> private key even if he/she manages to get access to the root account. > >Turning off coredump is trivial. All the features that LSM provide apply >to userland too (including security_ptrace()), so the SELinux policies >are not an argument for putting stuff in the kernel. > >Only the swap-out to disk is an issue, and that is less of a worry if >you use a time-limited proxy in the daemon.
I seem to remember a feature in the kernel that allows each uid to mlock a small number of memory pages specifically intended to be used by daemons that cache keys. It is possible this was a Fedora kernel patch and not in the mainline kernel.
>> >> Further, the mpi and dsa code can also be used for supporting signed >> >> modules and binaries...the "store dsa-keys in kernel" part adds 376 >> >> lines of code (counted with wc so comments and includes etc are also >> >> counted)... >> > >> >Signed modules sounds like a better motivation, but is a full dsa >> >implementation in the kernel really necessary to achieve this? >> >> How would you do it otherwise? > >Has anyone tried to look for simpler signing mechanisms that make use of >the crypto algorithms that are already in the kernel?
Maybe you meant something else, but history has shown that 'rolling your own' mechanism is a bad idea.
Are there even any suitable algorithms in the kernel??
___ Dax Kelson Sent with my Treo - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |