lkml.org 
[lkml]   [2009]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 2/6] integrity: IMA as an integrity service provider
From
Date
On Fri, 2009-01-30 at 11:07 +1100, James Morris wrote:
> On Thu, 29 Jan 2009, Mimi Zohar wrote:
>
> > +++ b/security/integrity/ima/Kconfig
> > @@ -0,0 +1,49 @@
> > +# IBM Integrity Measurement Architecture
> > +#
> > +config IMA
> > + bool "Integrity Measurement Architecture(IMA)"
> > + depends on ACPI
> > + select SECURITYFS
> > + select CRYPTO
> > + select CRYPTO_HMAC
> > + select CRYPTO_MD5
> > + select CRYPTO_SHA1
> > + select TCG_TPM
> > + select TCG_TIS
> > + help
> > + The Trusted Computing Group(TCG) runtime Integrity
> > + Measurement Architecture(IMA) maintains a list of hash
> > + values of executables and other sensitive system files,
> > + as they are read or executed. If an attacker manages
> > + to change the contents of an important system file
> > + being measured, we can tell.
>
> Out of interest, do you know if the TCG has analyzed their use of SHA-1
> in light of various attacks on the algorithm over the last few years?
>
> The IETF has published analysis and recommendations relating to the use of
> SHA-1 (and other cryptographic hashes) with IP protocols:
>
> http://www.ietf.org/rfc/rfc4894.txt
> http://www.ietf.org/rfc/rfc4270.txt
>
> It would be useful to know if similar analysis has been performed for TPM.
>
>
> - James

Sorry, the TCG does not have a postion paper on this. We do not see
the current SHA-1 collision weakness being applicable to how the TPM
is currently being used by IMA. If, however, it does becomes an issue,
we could replace the SHA-1 template measurement with SHA-256.

Mimi



\
 
 \ /
  Last update: 2009-01-30 20:31    [W:1.444 / U:24.468 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site