Messages in this thread | | | Date | Mon, 12 Dec 2011 09:12:55 -0500 | From | Nick Bowler <> | Subject | Re: [GIT PULL] Crypto keys and module signing |
| |
On 2011-12-10 12:50 +0000, David Howells wrote: > Arkadiusz Miśkiewicz <a.miskiewicz@gmail.com> wrote: > > and prehaps kernel could load keys from initramfs? > > How do you trust the keys? If you have a TPM, then yes you can do that.
Exactly the same way you trust the kernel image itself. If you can't trust the integrity of your initramfs (and thus the keys stored within it), then you also cannot trust the integrity of the kernel image and thus this whole signing exercise is moot.
Cheers, -- Nick Bowler, Elliptic Technologies (http://www.elliptictech.com/) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |