[lkml]   [2012]   [Jan]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH 08/21] KEYS: Add signature verification facility [ver #3]
    On Wed, Jan 18, 2012 at 2:26 PM, David Howells <> wrote:
    > Kasatkin, Dmitry <> wrote:
    >> It would also nice to have an API to supply pre-computed data hash.  For
    >> example IMA uses the same functionality to compute the hash of the file
    >> content, and then, based on security.ima type decided either verify it using
    >> just hash, or use digital signature.  We could pass a hash as data. But may
    >> be we do not want to have extra operation and compute hash over hash.
    > If I understand you correctly, you'd like to have the option to do the hashing
    > externally to this API?  Would you supply the completed hash or just a hash
    > with the data in it, and require this API to complete it (ie. chuck metadata
    > into it)?

    I meant just a hash of data..
    Right, I remember, PGP finalizes hash with some additional metadata
    pgp_pkey_digest_signature() seems does it...

    > I don't think it should be hard.  I could add an alternative to
    > verify_sig_add_data() perhaps.  Either that or one function that does the lot
    > and takes the precomputed hash as input.  There would be no need for the split
    > into four functions (begin, add_data, end, cancel) in such a case.  The reason
    > for the split is so that the caller can invoke add_data several times with
    > non-contiguous bits of data.

    Yes. it is clear...
    Would it be possible to have pass data (uncompleted) hash?

    > It might even make sense to expose the crypto hash object for direct access
    > rather than use add_data - but that then makes it hard to use crypto hardware
    > where you would just shovel the raw data into it and it does all the hashing
    > and cryptography in a black box.
    > David
    > --
    > To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
    > the body of a message to
    > More majordomo info at
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2012-01-18 14:29    [W:0.021 / U:54.348 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site