mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-23 19:11:51 +00:00
d3cff4a95e
asym_tpm keys are tied to TPM v1.2, which uses outdated crypto and has been deprecated in favor of TPM v2.0 for over 7 years. A very quick look at this code also immediately found some memory safety bugs (https://lore.kernel.org/r/20220113235440.90439-2-ebiggers@kernel.org). Note that this code is reachable by unprivileged users. According to Jarkko (one of the keyrings subsystem maintainers), this code has no practical use cases, and he isn't willing to maintain it (https://lore.kernel.org/r/YfFZPbKkgYJGWu1Q@iki.fi). Therefore, let's remove it. Note that this feature didn't have any documentation or tests, so we don't need to worry about removing those. Cc: David Howells <dhowells@redhat.com> Cc: Denis Kenzior <denkenz@gmail.com> Cc: James Morris <jmorris@namei.org> Cc: Jarkko Sakkinen <jarkko@kernel.org> Cc: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Eric Biggers <ebiggers@google.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
78 lines
2.5 KiB
Text
78 lines
2.5 KiB
Text
# SPDX-License-Identifier: GPL-2.0
|
|
menuconfig ASYMMETRIC_KEY_TYPE
|
|
bool "Asymmetric (public-key cryptographic) key type"
|
|
depends on KEYS
|
|
help
|
|
This option provides support for a key type that holds the data for
|
|
the asymmetric keys used for public key cryptographic operations such
|
|
as encryption, decryption, signature generation and signature
|
|
verification.
|
|
|
|
if ASYMMETRIC_KEY_TYPE
|
|
|
|
config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
|
|
tristate "Asymmetric public-key crypto algorithm subtype"
|
|
select MPILIB
|
|
select CRYPTO_HASH_INFO
|
|
select CRYPTO_AKCIPHER
|
|
select CRYPTO_HASH
|
|
help
|
|
This option provides support for asymmetric public key type handling.
|
|
If signature generation and/or verification are to be used,
|
|
appropriate hash algorithms (such as SHA-1) must be available.
|
|
ENOPKG will be reported if the requisite algorithm is unavailable.
|
|
|
|
config X509_CERTIFICATE_PARSER
|
|
tristate "X.509 certificate parser"
|
|
depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
|
|
select ASN1
|
|
select OID_REGISTRY
|
|
help
|
|
This option provides support for parsing X.509 format blobs for key
|
|
data and provides the ability to instantiate a crypto key from a
|
|
public key packet found inside the certificate.
|
|
|
|
config PKCS8_PRIVATE_KEY_PARSER
|
|
tristate "PKCS#8 private key parser"
|
|
depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
|
|
select ASN1
|
|
select OID_REGISTRY
|
|
help
|
|
This option provides support for parsing PKCS#8 format blobs for
|
|
private key data and provides the ability to instantiate a crypto key
|
|
from that data.
|
|
|
|
config PKCS7_MESSAGE_PARSER
|
|
tristate "PKCS#7 message parser"
|
|
depends on X509_CERTIFICATE_PARSER
|
|
select CRYPTO_HASH
|
|
select ASN1
|
|
select OID_REGISTRY
|
|
help
|
|
This option provides support for parsing PKCS#7 format messages for
|
|
signature data and provides the ability to verify the signature.
|
|
|
|
config PKCS7_TEST_KEY
|
|
tristate "PKCS#7 testing key type"
|
|
depends on SYSTEM_DATA_VERIFICATION
|
|
help
|
|
This option provides a type of key that can be loaded up from a
|
|
PKCS#7 message - provided the message is signed by a trusted key. If
|
|
it is, the PKCS#7 wrapper is discarded and reading the key returns
|
|
just the payload. If it isn't, adding the key will fail with an
|
|
error.
|
|
|
|
This is intended for testing the PKCS#7 parser.
|
|
|
|
config SIGNED_PE_FILE_VERIFICATION
|
|
bool "Support for PE file signature verification"
|
|
depends on PKCS7_MESSAGE_PARSER=y
|
|
depends on SYSTEM_DATA_VERIFICATION
|
|
select CRYPTO_HASH
|
|
select ASN1
|
|
select OID_REGISTRY
|
|
help
|
|
This option provides support for verifying the signature(s) on a
|
|
signed PE binary.
|
|
|
|
endif # ASYMMETRIC_KEY_TYPE
|