Messages in this thread | | | From | Andy Lutomirski <> | Date | Fri, 22 May 2015 15:19:01 -0700 | Subject | Re: Should we automatically generate a module signing key at all? |
| |
On Fri, May 22, 2015 at 3:15 PM, David Howells <dhowells@redhat.com> wrote: > Linus Torvalds <torvalds@linux-foundation.org> wrote: > >> I forget the exact details of the signature ..., but for the modules >> themselves, it's just appended to the module contents. > > Yes. > >> And because the size of the certificate list is variable, you can't just >> zero it out or anything like that to make things compare equal. > > Since it's discarded at the end of boot, it could be padded significantly.
If you use the hash tree approach, the size of the thing in bzImage is constant.
--Andy
| |