lkml.org 
[lkml]   [2007]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH resend][CRYPTO]: RSA algorithm patch
Andi Kleen wrote:
> Tasos Parisinos <parisino@ceid.upatras.gr> writes:
>
>
>> From: Tasos Parisinos <t.parisinos@sciensis.com>
>>
>> This patch adds module rsa.ko in the kernel (built-in or as a kernel
>> module) and offers an API to do fast modular exponentiation, using the
>> Montgomery algorithm, thus the exponentiation is not generic but can
>> be used only when
>> the modulus is odd, such as RSA public/private key pairs. This module is the
>> computational core (using multiple precision integer arithmetics) and does not
>> provide any means to do key management, implement padding schemas e.t.c. so the
>> calling code should implement all those as needed. Signed-off-by:
>> Tasos Parisinos <t.parisinos@sciensis.com>
>>
>
> You forgot to answer the most important question.
>
> What would want to use RSA in the kernel and why?
>
> -Andi
>
>

The main purpose behind the creation of this module was to create the
cryptographic infrastructure to develop an in-kernel system of signed
modules.

The best environment to deploy such functionality is in updating by remote,
executable code (programs, libs and modules) on embedded devices running
Linux, that have some form of kernel physical security, so one can't
tamper the
kernel, but can read it. In this case only a public key would be
revealed. The
vendor of the devices can sign and distribute/update executable code to
the devices,
and the kernel will not load/run any of them if they don't match with
their signatures.
The signature can be embedded in the elf, so this system is portable and
centralized.
Although this functionality can be achieved using userland helper
programs this may
create the need to physically secure entire filesystems which adds to
the cost of
developing such devices. In such cases one needs to use asymmetric
cryptography
because in the case of symmetric it would be very easy to give away the
key and
end with having all your devices being attacked.

There are already some systems that implement and utilize such
functionality that
use windows platforms, and other Linux distros that use userland
programs to do
so, assuming physical security of the host computer.

Moreover a same system that would use hashes is easier to brake and more
difficult
to update each time new code must be loaded to the host devices.

See also this thread

http://lkml.org/lkml/2007/3/19/447



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2007-04-02 13:53    [W:0.104 / U:1.220 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site