Messages in this thread | | | Subject | Re: [PATCH 2/6] integrity: IMA as an integrity service provider | From | Mimi Zohar <> | Date | Fri, 30 Jan 2009 14:29:28 -0500 |
| |
On Fri, 2009-01-30 at 11:07 +1100, James Morris wrote: > On Thu, 29 Jan 2009, Mimi Zohar wrote: > > > +++ b/security/integrity/ima/Kconfig > > @@ -0,0 +1,49 @@ > > +# IBM Integrity Measurement Architecture > > +# > > +config IMA > > + bool "Integrity Measurement Architecture(IMA)" > > + depends on ACPI > > + select SECURITYFS > > + select CRYPTO > > + select CRYPTO_HMAC > > + select CRYPTO_MD5 > > + select CRYPTO_SHA1 > > + select TCG_TPM > > + select TCG_TIS > > + help > > + The Trusted Computing Group(TCG) runtime Integrity > > + Measurement Architecture(IMA) maintains a list of hash > > + values of executables and other sensitive system files, > > + as they are read or executed. If an attacker manages > > + to change the contents of an important system file > > + being measured, we can tell. > > Out of interest, do you know if the TCG has analyzed their use of SHA-1 > in light of various attacks on the algorithm over the last few years? > > The IETF has published analysis and recommendations relating to the use of > SHA-1 (and other cryptographic hashes) with IP protocols: > > http://www.ietf.org/rfc/rfc4894.txt > http://www.ietf.org/rfc/rfc4270.txt > > It would be useful to know if similar analysis has been performed for TPM. > > > - James
Sorry, the TCG does not have a postion paper on this. We do not see the current SHA-1 collision weakness being applicable to how the TPM is currently being used by IMA. If, however, it does becomes an issue, we could replace the SHA-1 template measurement with SHA-256.
Mimi
| |