Re: [PATCH v2 06/19] crypto: rsassa-pkcs1 - Migrate to sig_alg backend

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue Sep 10, 2024 at 5:30 PM EEST, Lukas Wunner wrote:
> A sig_alg backend has just been introduced with the intent of moving all
> asymmetric sign/verify algorithms to it one by one.
>
> Migrate the sign/verify operations from rsa-pkcs1pad.c to a separate
> rsassa-pkcs1.c which uses the new backend.
>
> Consequently there are now two templates which build on the "rsa"
> akcipher_alg:
>
> * The existing "pkcs1pad" template, which is instantiated as an
>   akcipher_instance and retains the encrypt/decrypt operations of
>   RSAES-PKCS1-v1_5 (RFC 8017 sec 7.2).
>
> * The new "pkcs1" template, which is instantiated as a sig_instance
>   and contains the sign/verify operations of RSASSA-PKCS1-v1_5
>   (RFC 8017 sec 8.2).
>
> In a separate step, rsa-pkcs1pad.c could optionally be renamed to
> rsaes-pkcs1.c for clarity.  Additional "oaep" and "pss" templates
> could be added for RSAES-OAEP and RSASSA-PSS.
>
> Note that it's currently allowed to allocate a "pkcs1pad(rsa)" transform
> without specifying a hash algorithm.  That makes sense if the transform
> is only used for encrypt/decrypt and continues to be supported.  But for
> sign/verify, such transforms previously did not insert the Full Hash
> Prefix into the padding.  The resulting message encoding was incompliant
> with EMSA-PKCS1-v1_5 (RFC 8017 sec 9.2) and therefore nonsensical.
>
> From here on in, it is no longer allowed to allocate a transform without
> specifying a hash algorithm if the transform is used for sign/verify
> operations.  This simplifies the code because the insertion of the Full
> Hash Prefix is no longer optional, so various "if (digest_info)" clauses
> can be removed.
>
> There has been a previous attempt to forbid transform allocation without
> specifying a hash algorithm, namely by commit c0d20d22e0ad ("crypto:
> rsa-pkcs1pad - Require hash to be present").  It had to be rolled back
> with commit b3a8c8a5ebb5 ("crypto: rsa-pkcs1pad: Allow hash to be
> optional [ver #2]"), presumably because it broke allocation of a
> transform which was solely used for encrypt/decrypt, not sign/verify.
> Avoid such breakage by allowing transform allocation for encrypt/decrypt
> with and without specifying a hash algorithm (and simply ignoring the
> hash algorithm in the former case).
>
> So again, specifying a hash algorithm is now mandatory for sign/verify,
> but optional and ignored for encrypt/decrypt.
>
> The new sig_alg API uses kernel buffers instead of sglists, which
> avoids the overhead of copying signature and digest from sglists back
> into kernel buffers.  rsassa-pkcs1.c is thus simplified quite a bit.
>
> sig_alg is always synchronous, whereas the underlying "rsa" akcipher_alg
> may be asynchronous.  So await the result of the akcipher_alg, similar
> to crypto_akcipher_sync_{en,de}crypt().
>
> As part of the migration, rename "rsa_digest_info" to "hash_prefix" to
> adhere to the spec language in RFC 9580.  Otherwise keep the code
> unmodified wherever possible to ease reviewing and bisecting.  Leave
> several simplification and hardening opportunities to separate commits.
>
> rsassa-pkcs1.c uses modern __free() syntax for allocation of buffers
> which need to be freed by kfree_sensitive(), hence a DEFINE_FREE()
> clause for kfree_sensitive() is introduced herein as a byproduct.

Just a generic comment without micro managing: I'd put focus on this
commit message and edit it a few rounds to make it easier to follow.
Now it is somewhat convoluted, which is not in balance with +480
SLOC.

>
> Signed-off-by: Lukas Wunner <lukas@xxxxxxxxx>
> ---
>  crypto/Kconfig                      |   1 +
>  crypto/Makefile                     |   1 +
>  crypto/asymmetric_keys/public_key.c |  10 +-
>  crypto/rsa-pkcs1pad.c               | 341 ++--------------------
>  crypto/rsa.c                        |  17 +-
>  crypto/rsassa-pkcs1.c               | 422 ++++++++++++++++++++++++++++
>  crypto/testmgr.c                    |  22 +-
>  crypto/testmgr.h                    |   3 +-
>  include/crypto/internal/rsa.h       |   1 +
>  include/linux/slab.h                |   1 +
>  security/integrity/ima/ima_main.c   |   6 +-
>  11 files changed, 480 insertions(+), 345 deletions(-)
>  create mode 100644 crypto/rsassa-pkcs1.c
>
> diff --git a/crypto/Kconfig b/crypto/Kconfig
> index e8488b8c45e3..94ef57c9e936 100644
> --- a/crypto/Kconfig
> +++ b/crypto/Kconfig
> @@ -250,6 +250,7 @@ config CRYPTO_RSA
>  	tristate "RSA (Rivest-Shamir-Adleman)"
>  	select CRYPTO_AKCIPHER
>  	select CRYPTO_MANAGER
> +	select CRYPTO_SIG
>  	select MPILIB
>  	select ASN1
>  	help
> diff --git a/crypto/Makefile b/crypto/Makefile
> index 4c99e5d376f6..7de29bf843e9 100644
> --- a/crypto/Makefile
> +++ b/crypto/Makefile
> @@ -48,6 +48,7 @@ rsa_generic-y += rsaprivkey.asn1.o
>  rsa_generic-y += rsa.o
>  rsa_generic-y += rsa_helper.o
>  rsa_generic-y += rsa-pkcs1pad.o
> +rsa_generic-y += rsassa-pkcs1.o
>  obj-$(CONFIG_CRYPTO_RSA) += rsa_generic.o
>  
>  $(obj)/ecdsasignature.asn1.o: $(obj)/ecdsasignature.asn1.c $(obj)/ecdsasignature.asn1.h
> diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
> index 422940a6706a..3fb27ecd65f6 100644
> --- a/crypto/asymmetric_keys/public_key.c
> +++ b/crypto/asymmetric_keys/public_key.c
> @@ -83,13 +83,19 @@ software_key_determine_akcipher(const struct public_key *pkey,
>  		if (strcmp(encoding, "pkcs1") == 0) {
>  			*sig = op == kernel_pkey_sign ||
>  			       op == kernel_pkey_verify;
> -			if (!hash_algo) {
> +			if (!*sig) {
> +				/*
> +				 * For encrypt/decrypt, hash_algo is not used
> +				 * but allowed to be set for historic reasons.
> +				 */
>  				n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
>  					     "pkcs1pad(%s)",
>  					     pkey->pkey_algo);
>  			} else {
> +				if (!hash_algo)
> +					return -EINVAL;
>  				n = snprintf(alg_name, CRYPTO_MAX_ALG_NAME,
> -					     "pkcs1pad(%s,%s)",
> +					     "pkcs1(%s,%s)",
>  					     pkey->pkey_algo, hash_algo);
>  			}
>  			return n >= CRYPTO_MAX_ALG_NAME ? -EINVAL : 0;
> diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
> index 3c5fe8c93938..50bdb18e7b48 100644
> --- a/crypto/rsa-pkcs1pad.c
> +++ b/crypto/rsa-pkcs1pad.c
> @@ -16,101 +16,6 @@
>  #include <linux/random.h>
>  #include <linux/scatterlist.h>
>  
> -/*
> - * Hash algorithm OIDs plus ASN.1 DER wrappings [RFC4880 sec 5.2.2].
> - */
> -static const u8 rsa_digest_info_md5[] = {
> -	0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,
> -	0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, /* OID */
> -	0x05, 0x00, 0x04, 0x10
> -};
> -
> -static const u8 rsa_digest_info_sha1[] = {
> -	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
> -	0x2b, 0x0e, 0x03, 0x02, 0x1a,
> -	0x05, 0x00, 0x04, 0x14
> -};
> -
> -static const u8 rsa_digest_info_rmd160[] = {
> -	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
> -	0x2b, 0x24, 0x03, 0x02, 0x01,
> -	0x05, 0x00, 0x04, 0x14
> -};
> -
> -static const u8 rsa_digest_info_sha224[] = {
> -	0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
> -	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
> -	0x05, 0x00, 0x04, 0x1c
> -};
> -
> -static const u8 rsa_digest_info_sha256[] = {
> -	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
> -	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
> -	0x05, 0x00, 0x04, 0x20
> -};
> -
> -static const u8 rsa_digest_info_sha384[] = {
> -	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
> -	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
> -	0x05, 0x00, 0x04, 0x30
> -};
> -
> -static const u8 rsa_digest_info_sha512[] = {
> -	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
> -	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
> -	0x05, 0x00, 0x04, 0x40
> -};
> -
> -static const u8 rsa_digest_info_sha3_256[] = {
> -	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
> -	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x08,
> -	0x05, 0x00, 0x04, 0x20
> -};
> -
> -static const u8 rsa_digest_info_sha3_384[] = {
> -	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
> -	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x09,
> -	0x05, 0x00, 0x04, 0x30
> -};
> -
> -static const u8 rsa_digest_info_sha3_512[] = {
> -	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
> -	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0A,
> -	0x05, 0x00, 0x04, 0x40
> -};
> -
> -static const struct rsa_asn1_template {
> -	const char	*name;
> -	const u8	*data;
> -	size_t		size;
> -} rsa_asn1_templates[] = {
> -#define _(X) { #X, rsa_digest_info_##X, sizeof(rsa_digest_info_##X) }
> -	_(md5),
> -	_(sha1),
> -	_(rmd160),
> -	_(sha256),
> -	_(sha384),
> -	_(sha512),
> -	_(sha224),
> -#undef _
> -#define _(X) { "sha3-" #X, rsa_digest_info_sha3_##X, sizeof(rsa_digest_info_sha3_##X) }
> -	_(256),
> -	_(384),
> -	_(512),
> -#undef _
> -	{ NULL }
> -};
> -
> -static const struct rsa_asn1_template *rsa_lookup_asn1(const char *name)
> -{
> -	const struct rsa_asn1_template *p;
> -
> -	for (p = rsa_asn1_templates; p->name; p++)
> -		if (strcmp(name, p->name) == 0)
> -			return p;
> -	return NULL;
> -}
> -
>  struct pkcs1pad_ctx {
>  	struct crypto_akcipher *child;
>  	unsigned int key_size;
> @@ -118,7 +23,6 @@ struct pkcs1pad_ctx {
>  
>  struct pkcs1pad_inst_ctx {
>  	struct crypto_akcipher_spawn spawn;
> -	const struct rsa_asn1_template *digest_info;
>  };
>  
>  struct pkcs1pad_request {
> @@ -148,9 +52,9 @@ static unsigned int pkcs1pad_get_max_size(struct crypto_akcipher *tfm)
>  	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
>  
>  	/*
> -	 * The maximum destination buffer size for the encrypt/sign operations
> +	 * The maximum destination buffer size for the encrypt operation
>  	 * will be the same as for RSA, even though it's smaller for
> -	 * decrypt/verify.
> +	 * decrypt.
>  	 */
>  
>  	return ctx->key_size;
> @@ -168,7 +72,7 @@ static void pkcs1pad_sg_set_buf(struct scatterlist *sg, void *buf, size_t len,
>  		sg_chain(sg, nsegs, next);
>  }
>  
> -static int pkcs1pad_encrypt_sign_complete(struct akcipher_request *req, int err)
> +static int pkcs1pad_encrypt_complete(struct akcipher_request *req, int err)
>  {
>  	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
>  	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
> @@ -207,14 +111,14 @@ static int pkcs1pad_encrypt_sign_complete(struct akcipher_request *req, int err)
>  	return err;
>  }
>  
> -static void pkcs1pad_encrypt_sign_complete_cb(void *data, int err)
> +static void pkcs1pad_encrypt_complete_cb(void *data, int err)
>  {
>  	struct akcipher_request *req = data;
>  
>  	if (err == -EINPROGRESS)
>  		goto out;
>  
> -	err = pkcs1pad_encrypt_sign_complete(req, err);
> +	err = pkcs1pad_encrypt_complete(req, err);
>  
>  out:
>  	akcipher_request_complete(req, err);
> @@ -255,7 +159,7 @@ static int pkcs1pad_encrypt(struct akcipher_request *req)
>  
>  	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
>  	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
> -			pkcs1pad_encrypt_sign_complete_cb, req);
> +			pkcs1pad_encrypt_complete_cb, req);
>  
>  	/* Reuse output buffer */
>  	akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
> @@ -263,7 +167,7 @@ static int pkcs1pad_encrypt(struct akcipher_request *req)
>  
>  	err = crypto_akcipher_encrypt(&req_ctx->child_req);
>  	if (err != -EINPROGRESS && err != -EBUSY)
> -		return pkcs1pad_encrypt_sign_complete(req, err);
> +		return pkcs1pad_encrypt_complete(req, err);
>  
>  	return err;
>  }
> @@ -368,195 +272,6 @@ static int pkcs1pad_decrypt(struct akcipher_request *req)
>  	return err;
>  }
>  
> -static int pkcs1pad_sign(struct akcipher_request *req)
> -{
> -	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
> -	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
> -	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
> -	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
> -	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
> -	const struct rsa_asn1_template *digest_info = ictx->digest_info;
> -	int err;
> -	unsigned int ps_end, digest_info_size = 0;
> -
> -	if (!ctx->key_size)
> -		return -EINVAL;
> -
> -	if (digest_info)
> -		digest_info_size = digest_info->size;
> -
> -	if (req->src_len + digest_info_size > ctx->key_size - 11)
> -		return -EOVERFLOW;
> -
> -	if (req->dst_len < ctx->key_size) {
> -		req->dst_len = ctx->key_size;
> -		return -EOVERFLOW;
> -	}
> -
> -	req_ctx->in_buf = kmalloc(ctx->key_size - 1 - req->src_len,
> -				  GFP_KERNEL);
> -	if (!req_ctx->in_buf)
> -		return -ENOMEM;
> -
> -	ps_end = ctx->key_size - digest_info_size - req->src_len - 2;
> -	req_ctx->in_buf[0] = 0x01;
> -	memset(req_ctx->in_buf + 1, 0xff, ps_end - 1);
> -	req_ctx->in_buf[ps_end] = 0x00;
> -
> -	if (digest_info)
> -		memcpy(req_ctx->in_buf + ps_end + 1, digest_info->data,
> -		       digest_info->size);
> -
> -	pkcs1pad_sg_set_buf(req_ctx->in_sg, req_ctx->in_buf,
> -			ctx->key_size - 1 - req->src_len, req->src);
> -
> -	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
> -	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
> -			pkcs1pad_encrypt_sign_complete_cb, req);
> -
> -	/* Reuse output buffer */
> -	akcipher_request_set_crypt(&req_ctx->child_req, req_ctx->in_sg,
> -				   req->dst, ctx->key_size - 1, req->dst_len);
> -
> -	err = crypto_akcipher_decrypt(&req_ctx->child_req);
> -	if (err != -EINPROGRESS && err != -EBUSY)
> -		return pkcs1pad_encrypt_sign_complete(req, err);
> -
> -	return err;
> -}
> -
> -static int pkcs1pad_verify_complete(struct akcipher_request *req, int err)
> -{
> -	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
> -	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
> -	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
> -	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
> -	struct pkcs1pad_inst_ctx *ictx = akcipher_instance_ctx(inst);
> -	const struct rsa_asn1_template *digest_info = ictx->digest_info;
> -	const unsigned int sig_size = req->src_len;
> -	const unsigned int digest_size = req->dst_len;
> -	unsigned int dst_len;
> -	unsigned int pos;
> -	u8 *out_buf;
> -
> -	if (err)
> -		goto done;
> -
> -	err = -EINVAL;
> -	dst_len = req_ctx->child_req.dst_len;
> -	if (dst_len < ctx->key_size - 1)
> -		goto done;
> -
> -	out_buf = req_ctx->out_buf;
> -	if (dst_len == ctx->key_size) {
> -		if (out_buf[0] != 0x00)
> -			/* Decrypted value had no leading 0 byte */
> -			goto done;
> -
> -		dst_len--;
> -		out_buf++;
> -	}
> -
> -	err = -EBADMSG;
> -	if (out_buf[0] != 0x01)
> -		goto done;
> -
> -	for (pos = 1; pos < dst_len; pos++)
> -		if (out_buf[pos] != 0xff)
> -			break;
> -
> -	if (pos < 9 || pos == dst_len || out_buf[pos] != 0x00)
> -		goto done;
> -	pos++;
> -
> -	if (digest_info) {
> -		if (digest_info->size > dst_len - pos)
> -			goto done;
> -		if (crypto_memneq(out_buf + pos, digest_info->data,
> -				  digest_info->size))
> -			goto done;
> -
> -		pos += digest_info->size;
> -	}
> -
> -	err = 0;
> -
> -	if (digest_size != dst_len - pos) {
> -		err = -EKEYREJECTED;
> -		req->dst_len = dst_len - pos;
> -		goto done;
> -	}
> -	/* Extract appended digest. */
> -	sg_pcopy_to_buffer(req->src,
> -			   sg_nents_for_len(req->src, sig_size + digest_size),
> -			   req_ctx->out_buf + ctx->key_size,
> -			   digest_size, sig_size);
> -	/* Do the actual verification step. */
> -	if (memcmp(req_ctx->out_buf + ctx->key_size, out_buf + pos,
> -		   digest_size) != 0)
> -		err = -EKEYREJECTED;
> -done:
> -	kfree_sensitive(req_ctx->out_buf);
> -
> -	return err;
> -}
> -
> -static void pkcs1pad_verify_complete_cb(void *data, int err)
> -{
> -	struct akcipher_request *req = data;
> -
> -	if (err == -EINPROGRESS)
> -		goto out;
> -
> -	err = pkcs1pad_verify_complete(req, err);
> -
> -out:
> -	akcipher_request_complete(req, err);
> -}
> -
> -/*
> - * The verify operation is here for completeness similar to the verification
> - * defined in RFC2313 section 10.2 except that block type 0 is not accepted,
> - * as in RFC2437.  RFC2437 section 9.2 doesn't define any operation to
> - * retrieve the DigestInfo from a signature, instead the user is expected
> - * to call the sign operation to generate the expected signature and compare
> - * signatures instead of the message-digests.
> - */
> -static int pkcs1pad_verify(struct akcipher_request *req)
> -{
> -	struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
> -	struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
> -	struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
> -	const unsigned int sig_size = req->src_len;
> -	const unsigned int digest_size = req->dst_len;
> -	int err;
> -
> -	if (WARN_ON(req->dst) || WARN_ON(!digest_size) ||
> -	    !ctx->key_size || sig_size != ctx->key_size)
> -		return -EINVAL;
> -
> -	req_ctx->out_buf = kmalloc(ctx->key_size + digest_size, GFP_KERNEL);
> -	if (!req_ctx->out_buf)
> -		return -ENOMEM;
> -
> -	pkcs1pad_sg_set_buf(req_ctx->out_sg, req_ctx->out_buf,
> -			    ctx->key_size, NULL);
> -
> -	akcipher_request_set_tfm(&req_ctx->child_req, ctx->child);
> -	akcipher_request_set_callback(&req_ctx->child_req, req->base.flags,
> -			pkcs1pad_verify_complete_cb, req);
> -
> -	/* Reuse input buffer, output to a new buffer */
> -	akcipher_request_set_crypt(&req_ctx->child_req, req->src,
> -				   req_ctx->out_sg, sig_size, ctx->key_size);
> -
> -	err = crypto_akcipher_encrypt(&req_ctx->child_req);
> -	if (err != -EINPROGRESS && err != -EBUSY)
> -		return pkcs1pad_verify_complete(req, err);
> -
> -	return err;
> -}
> -
>  static int pkcs1pad_init_tfm(struct crypto_akcipher *tfm)
>  {
>  	struct akcipher_instance *inst = akcipher_alg_instance(tfm);
> @@ -598,7 +313,6 @@ static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb)
>  	struct akcipher_instance *inst;
>  	struct pkcs1pad_inst_ctx *ctx;
>  	struct akcipher_alg *rsa_alg;
> -	const char *hash_name;
>  	int err;
>  
>  	err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_AKCIPHER, &mask);
> @@ -624,36 +338,15 @@ static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb)
>  	}
>  
>  	err = -ENAMETOOLONG;
> -	hash_name = crypto_attr_alg_name(tb[2]);
> -	if (IS_ERR(hash_name)) {
> -		if (snprintf(inst->alg.base.cra_name,
> -			     CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s)",
> -			     rsa_alg->base.cra_name) >= CRYPTO_MAX_ALG_NAME)
> -			goto err_free_inst;
> -
> -		if (snprintf(inst->alg.base.cra_driver_name,
> -			     CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s)",
> -			     rsa_alg->base.cra_driver_name) >=
> -			     CRYPTO_MAX_ALG_NAME)
> -			goto err_free_inst;
> -	} else {
> -		ctx->digest_info = rsa_lookup_asn1(hash_name);
> -		if (!ctx->digest_info) {
> -			err = -EINVAL;
> -			goto err_free_inst;
> -		}
> -
> -		if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
> -			     "pkcs1pad(%s,%s)", rsa_alg->base.cra_name,
> -			     hash_name) >= CRYPTO_MAX_ALG_NAME)
> -			goto err_free_inst;
> -
> -		if (snprintf(inst->alg.base.cra_driver_name,
> -			     CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s,%s)",
> -			     rsa_alg->base.cra_driver_name,
> -			     hash_name) >= CRYPTO_MAX_ALG_NAME)
> -			goto err_free_inst;
> -	}
> +	if (snprintf(inst->alg.base.cra_name,
> +		     CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s)",
> +		     rsa_alg->base.cra_name) >= CRYPTO_MAX_ALG_NAME)
> +		goto err_free_inst;
> +
> +	if (snprintf(inst->alg.base.cra_driver_name,
> +		     CRYPTO_MAX_ALG_NAME, "pkcs1pad(%s)",
> +		     rsa_alg->base.cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
> +		goto err_free_inst;
>  
>  	inst->alg.base.cra_priority = rsa_alg->base.cra_priority;
>  	inst->alg.base.cra_ctxsize = sizeof(struct pkcs1pad_ctx);
> @@ -663,8 +356,6 @@ static int pkcs1pad_create(struct crypto_template *tmpl, struct rtattr **tb)
>  
>  	inst->alg.encrypt = pkcs1pad_encrypt;
>  	inst->alg.decrypt = pkcs1pad_decrypt;
> -	inst->alg.sign = pkcs1pad_sign;
> -	inst->alg.verify = pkcs1pad_verify;
>  	inst->alg.set_pub_key = pkcs1pad_set_pub_key;
>  	inst->alg.set_priv_key = pkcs1pad_set_priv_key;
>  	inst->alg.max_size = pkcs1pad_get_max_size;
> diff --git a/crypto/rsa.c b/crypto/rsa.c
> index d9be9e86097e..89e9fd9f6d7f 100644
> --- a/crypto/rsa.c
> +++ b/crypto/rsa.c
> @@ -402,16 +402,25 @@ static int __init rsa_init(void)
>  		return err;
>  
>  	err = crypto_register_template(&rsa_pkcs1pad_tmpl);
> -	if (err) {
> -		crypto_unregister_akcipher(&rsa);
> -		return err;
> -	}
> +	if (err)
> +		goto err_unregister_rsa;
> +
> +	err = crypto_register_template(&rsassa_pkcs1_tmpl);
> +	if (err)
> +		goto err_unregister_rsa_pkcs1pad;
>  
>  	return 0;
> +
> +err_unregister_rsa_pkcs1pad:
> +	crypto_unregister_template(&rsa_pkcs1pad_tmpl);
> +err_unregister_rsa:
> +	crypto_unregister_akcipher(&rsa);
> +	return err;
>  }
>  
>  static void __exit rsa_exit(void)
>  {
> +	crypto_unregister_template(&rsassa_pkcs1_tmpl);
>  	crypto_unregister_template(&rsa_pkcs1pad_tmpl);
>  	crypto_unregister_akcipher(&rsa);
>  }
> diff --git a/crypto/rsassa-pkcs1.c b/crypto/rsassa-pkcs1.c
> new file mode 100644
> index 000000000000..779c080fc013
> --- /dev/null
> +++ b/crypto/rsassa-pkcs1.c
> @@ -0,0 +1,422 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + * RSA Signature Scheme with Appendix - PKCS #1 v1.5 (RFC 8017 sec 8.2)
> + *
> + * https://www.rfc-editor.org/rfc/rfc8017#section-8.2
> + *
> + * Copyright (c) 2015 - 2024 Intel Corporation
> + */
> +
> +#include <linux/module.h>
> +#include <linux/scatterlist.h>
> +#include <crypto/akcipher.h>
> +#include <crypto/algapi.h>
> +#include <crypto/sig.h>
> +#include <crypto/internal/akcipher.h>
> +#include <crypto/internal/rsa.h>
> +#include <crypto/internal/sig.h>
> +
> +/*
> + * Full Hash Prefix for EMSA-PKCS1-v1_5 encoding method (RFC 9580 table 24)
> + *
> + * RSA keys are usually much larger than the hash of the message to be signed.
> + * The hash is therefore prepended by the Full Hash Prefix and a 0xff padding.
> + * The Full Hash Prefix is an ASN.1 SEQUENCE containing the hash algorithm OID.
> + *
> + * https://www.rfc-editor.org/rfc/rfc9580#table-24
> + */
> +
> +static const u8 hash_prefix_md5[] = {
> +	0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,	  /* SEQUENCE (SEQUENCE (OID */
> +	0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05,	/*	<algorithm>, */
> +	0x05, 0x00, 0x04, 0x10		      /* NULL), OCTET STRING <hash>) */
> +};
> +
> +static const u8 hash_prefix_sha1[] = {
> +	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
> +	0x2b, 0x0e, 0x03, 0x02, 0x1a,
> +	0x05, 0x00, 0x04, 0x14
> +};
> +
> +static const u8 hash_prefix_rmd160[] = {
> +	0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
> +	0x2b, 0x24, 0x03, 0x02, 0x01,
> +	0x05, 0x00, 0x04, 0x14
> +};
> +
> +static const u8 hash_prefix_sha224[] = {
> +	0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
> +	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
> +	0x05, 0x00, 0x04, 0x1c
> +};
> +
> +static const u8 hash_prefix_sha256[] = {
> +	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
> +	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
> +	0x05, 0x00, 0x04, 0x20
> +};
> +
> +static const u8 hash_prefix_sha384[] = {
> +	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
> +	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
> +	0x05, 0x00, 0x04, 0x30
> +};
> +
> +static const u8 hash_prefix_sha512[] = {
> +	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
> +	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
> +	0x05, 0x00, 0x04, 0x40
> +};
> +
> +static const u8 hash_prefix_sha3_256[] = {
> +	0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
> +	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x08,
> +	0x05, 0x00, 0x04, 0x20
> +};
> +
> +static const u8 hash_prefix_sha3_384[] = {
> +	0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
> +	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x09,
> +	0x05, 0x00, 0x04, 0x30
> +};
> +
> +static const u8 hash_prefix_sha3_512[] = {
> +	0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
> +	0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x0a,
> +	0x05, 0x00, 0x04, 0x40
> +};
> +
> +static const struct hash_prefix {
> +	const char	*name;
> +	const u8	*data;
> +	size_t		size;
> +} hash_prefixes[] = {
> +#define _(X) { #X, hash_prefix_##X, sizeof(hash_prefix_##X) }
> +	_(md5),
> +	_(sha1),
> +	_(rmd160),
> +	_(sha256),
> +	_(sha384),
> +	_(sha512),
> +	_(sha224),
> +#undef _
> +#define _(X) { "sha3-" #X, hash_prefix_sha3_##X, sizeof(hash_prefix_sha3_##X) }
> +	_(256),
> +	_(384),
> +	_(512),
> +#undef _
> +	{ NULL }
> +};
> +
> +static const struct hash_prefix *rsassa_pkcs1_find_hash_prefix(const char *name)
> +{
> +	const struct hash_prefix *p;
> +
> +	for (p = hash_prefixes; p->name; p++)
> +		if (strcmp(name, p->name) == 0)
> +			return p;
> +	return NULL;
> +}
> +
> +struct rsassa_pkcs1_ctx {
> +	struct crypto_akcipher *child;
> +	unsigned int key_size;
> +};
> +
> +struct rsassa_pkcs1_inst_ctx {
> +	struct crypto_akcipher_spawn spawn;
> +	const struct hash_prefix *hash_prefix;
> +};
> +
> +static int rsassa_pkcs1_sign(struct crypto_sig *tfm,
> +			     const void *src, unsigned int slen,
> +			     void *dst, unsigned int dlen)
> +{
> +	struct sig_instance *inst = sig_alg_instance(tfm);
> +	struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst);
> +	const struct hash_prefix *hash_prefix = ictx->hash_prefix;
> +	struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
> +	unsigned int child_reqsize = crypto_akcipher_reqsize(ctx->child);
> +	struct akcipher_request *child_req __free(kfree_sensitive) = NULL;
> +	struct scatterlist in_sg[2], out_sg;
> +	struct crypto_wait cwait;
> +	unsigned int pad_len;
> +	unsigned int ps_end;
> +	unsigned int len;
> +	u8 *in_buf;
> +	int err;
> +
> +	if (!ctx->key_size)
> +		return -EINVAL;
> +
> +	if (dlen < ctx->key_size)
> +		return -EOVERFLOW;
> +
> +	if (slen + hash_prefix->size > ctx->key_size - 11)
> +		return -EOVERFLOW;
> +
> +	child_req = kmalloc(sizeof(*child_req) + child_reqsize +
> +			    ctx->key_size - 1 - slen, GFP_KERNEL);
> +	if (!child_req)
> +		return -ENOMEM;
> +
> +	/* RFC 8017 sec 8.2.1 step 1 - EMSA-PKCS1-v1_5 encoding generation */
> +	in_buf = (u8 *)(child_req + 1) + child_reqsize;
> +	ps_end = ctx->key_size - hash_prefix->size - slen - 2;
> +	in_buf[0] = 0x01;
> +	memset(in_buf + 1, 0xff, ps_end - 1);
> +	in_buf[ps_end] = 0x00;
> +	memcpy(in_buf + ps_end + 1, hash_prefix->data, hash_prefix->size);
> +
> +	/* RFC 8017 sec 8.2.1 step 2 - RSA signature */
> +	crypto_init_wait(&cwait);
> +	sg_init_table(in_sg, 2);
> +	sg_set_buf(&in_sg[0], in_buf, ctx->key_size - 1 - slen);
> +	sg_set_buf(&in_sg[1], src, slen);
> +	sg_init_one(&out_sg, dst, dlen);
> +	akcipher_request_set_tfm(child_req, ctx->child);
> +	akcipher_request_set_crypt(child_req, in_sg, &out_sg,
> +				   ctx->key_size - 1, dlen);
> +	akcipher_request_set_callback(child_req, CRYPTO_TFM_REQ_MAY_SLEEP,
> +				      crypto_req_done, &cwait);
> +
> +	err = crypto_akcipher_decrypt(child_req);
> +	err = crypto_wait_req(err, &cwait);
> +	if (err)
> +		return err;
> +
> +	len = child_req->dst_len;
> +	pad_len = ctx->key_size - len;
> +
> +	/* Four billion to one */
> +	if (unlikely(pad_len)) {
> +		memmove(dst + pad_len, dst, len);
> +		memset(dst, 0, pad_len);
> +	}
> +
> +	return 0;
> +}
> +
> +static int rsassa_pkcs1_verify(struct crypto_sig *tfm,
> +			       const void *src, unsigned int slen,
> +			       const void *digest, unsigned int dlen)
> +{
> +	struct sig_instance *inst = sig_alg_instance(tfm);
> +	struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst);
> +	const struct hash_prefix *hash_prefix = ictx->hash_prefix;
> +	struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
> +	unsigned int child_reqsize = crypto_akcipher_reqsize(ctx->child);
> +	struct akcipher_request *child_req __free(kfree_sensitive) = NULL;
> +	struct scatterlist in_sg, out_sg;
> +	struct crypto_wait cwait;
> +	unsigned int dst_len;
> +	unsigned int pos;
> +	u8 *out_buf;
> +	int err;
> +
> +	/* RFC 8017 sec 8.2.2 step 1 - length checking */
> +	if (!ctx->key_size ||
> +	    slen != ctx->key_size ||
> +	    !dlen)
> +		return -EINVAL;
> +
> +	/* RFC 8017 sec 8.2.2 step 2 - RSA verification */
> +	child_req = kmalloc(sizeof(*child_req) + child_reqsize + ctx->key_size,
> +			    GFP_KERNEL);
> +	if (!child_req)
> +		return -ENOMEM;
> +
> +	out_buf = (u8 *)(child_req + 1) + child_reqsize;
> +
> +	crypto_init_wait(&cwait);
> +	sg_init_one(&in_sg, src, slen);
> +	sg_init_one(&out_sg, out_buf, ctx->key_size);
> +	akcipher_request_set_tfm(child_req, ctx->child);
> +	akcipher_request_set_crypt(child_req, &in_sg, &out_sg,
> +				   slen, ctx->key_size);
> +	akcipher_request_set_callback(child_req, CRYPTO_TFM_REQ_MAY_SLEEP,
> +				      crypto_req_done, &cwait);
> +
> +	err = crypto_akcipher_encrypt(child_req);
> +	err = crypto_wait_req(err, &cwait);
> +	if (err)
> +		return err;
> +
> +	/* RFC 8017 sec 8.2.2 step 3 - EMSA-PKCS1-v1_5 encoding verification */
> +	dst_len = child_req->dst_len;
> +	if (dst_len < ctx->key_size - 1)
> +		return -EINVAL;
> +
> +	if (dst_len == ctx->key_size) {
> +		if (out_buf[0] != 0x00)
> +			/* Encrypted value had no leading 0 byte */
> +			return -EINVAL;
> +
> +		dst_len--;
> +		out_buf++;
> +	}
> +
> +	if (out_buf[0] != 0x01)
> +		return -EBADMSG;
> +
> +	for (pos = 1; pos < dst_len; pos++)
> +		if (out_buf[pos] != 0xff)
> +			break;
> +
> +	if (pos < 9 || pos == dst_len || out_buf[pos] != 0x00)
> +		return -EBADMSG;
> +	pos++;
> +
> +	if (hash_prefix->size > dst_len - pos)
> +		return -EBADMSG;
> +	if (crypto_memneq(out_buf + pos, hash_prefix->data, hash_prefix->size))
> +		return -EBADMSG;
> +	pos += hash_prefix->size;
> +
> +	/* RFC 8017 sec 8.2.2 step 4 - comparison of digest with out_buf */
> +	if (dlen != dst_len - pos)
> +		return -EKEYREJECTED;
> +	if (memcmp(digest, out_buf + pos, dlen) != 0)
> +		return -EKEYREJECTED;
> +
> +	return 0;
> +}
> +
> +static unsigned int rsassa_pkcs1_max_size(struct crypto_sig *tfm)
> +{
> +	struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
> +
> +	return ctx->key_size;
> +}
> +
> +static int rsassa_pkcs1_set_pub_key(struct crypto_sig *tfm,
> +				    const void *key, unsigned int keylen)
> +{
> +	struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
> +
> +	return rsa_set_key(ctx->child, &ctx->key_size, RSA_PUB, key, keylen);
> +}
> +
> +static int rsassa_pkcs1_set_priv_key(struct crypto_sig *tfm,
> +				     const void *key, unsigned int keylen)
> +{
> +	struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
> +
> +	return rsa_set_key(ctx->child, &ctx->key_size, RSA_PRIV, key, keylen);
> +}
> +
> +static int rsassa_pkcs1_init_tfm(struct crypto_sig *tfm)
> +{
> +	struct sig_instance *inst = sig_alg_instance(tfm);
> +	struct rsassa_pkcs1_inst_ctx *ictx = sig_instance_ctx(inst);
> +	struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
> +	struct crypto_akcipher *child_tfm;
> +
> +	child_tfm = crypto_spawn_akcipher(&ictx->spawn);
> +	if (IS_ERR(child_tfm))
> +		return PTR_ERR(child_tfm);
> +
> +	ctx->child = child_tfm;
> +
> +	return 0;
> +}
> +
> +static void rsassa_pkcs1_exit_tfm(struct crypto_sig *tfm)
> +{
> +	struct rsassa_pkcs1_ctx *ctx = crypto_sig_ctx(tfm);
> +
> +	crypto_free_akcipher(ctx->child);
> +}
> +
> +static void rsassa_pkcs1_free(struct sig_instance *inst)
> +{
> +	struct rsassa_pkcs1_inst_ctx *ctx = sig_instance_ctx(inst);
> +	struct crypto_akcipher_spawn *spawn = &ctx->spawn;
> +
> +	crypto_drop_akcipher(spawn);
> +	kfree(inst);
> +}
> +
> +static int rsassa_pkcs1_create(struct crypto_template *tmpl, struct rtattr **tb)
> +{
> +	struct rsassa_pkcs1_inst_ctx *ctx;
> +	struct akcipher_alg *rsa_alg;
> +	struct sig_instance *inst;
> +	const char *hash_name;
> +	u32 mask;
> +	int err;
> +
> +	err = crypto_check_attr_type(tb, CRYPTO_ALG_TYPE_SIG, &mask);
> +	if (err)
> +		return err;
> +
> +	inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
> +	if (!inst)
> +		return -ENOMEM;
> +
> +	ctx = sig_instance_ctx(inst);
> +
> +	err = crypto_grab_akcipher(&ctx->spawn, sig_crypto_instance(inst),
> +				   crypto_attr_alg_name(tb[1]), 0, mask);
> +	if (err)
> +		goto err_free_inst;
> +
> +	rsa_alg = crypto_spawn_akcipher_alg(&ctx->spawn);
> +
> +	if (strcmp(rsa_alg->base.cra_name, "rsa") != 0) {
> +		err = -EINVAL;
> +		goto err_free_inst;
> +	}
> +
> +	hash_name = crypto_attr_alg_name(tb[2]);
> +	if (IS_ERR(hash_name)) {
> +		err = PTR_ERR(hash_name);
> +		goto err_free_inst;
> +	}
> +
> +	ctx->hash_prefix = rsassa_pkcs1_find_hash_prefix(hash_name);
> +	if (!ctx->hash_prefix) {
> +		err = -EINVAL;
> +		goto err_free_inst;
> +	}
> +
> +	err = -ENAMETOOLONG;
> +	if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
> +		     "pkcs1(%s,%s)", rsa_alg->base.cra_name,
> +		     hash_name) >= CRYPTO_MAX_ALG_NAME)
> +		goto err_free_inst;
> +
> +	if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
> +		     "pkcs1(%s,%s)", rsa_alg->base.cra_driver_name,
> +		     hash_name) >= CRYPTO_MAX_ALG_NAME)
> +		goto err_free_inst;
> +
> +	inst->alg.base.cra_priority = rsa_alg->base.cra_priority;
> +	inst->alg.base.cra_ctxsize = sizeof(struct rsassa_pkcs1_ctx);
> +
> +	inst->alg.init = rsassa_pkcs1_init_tfm;
> +	inst->alg.exit = rsassa_pkcs1_exit_tfm;
> +
> +	inst->alg.sign = rsassa_pkcs1_sign;
> +	inst->alg.verify = rsassa_pkcs1_verify;
> +	inst->alg.max_size = rsassa_pkcs1_max_size;
> +	inst->alg.set_pub_key = rsassa_pkcs1_set_pub_key;
> +	inst->alg.set_priv_key = rsassa_pkcs1_set_priv_key;
> +
> +	inst->free = rsassa_pkcs1_free;
> +
> +	err = sig_register_instance(tmpl, inst);
> +	if (err) {
> +err_free_inst:
> +		rsassa_pkcs1_free(inst);
> +	}
> +	return err;
> +}
> +
> +struct crypto_template rsassa_pkcs1_tmpl = {
> +	.name = "pkcs1",
> +	.create = rsassa_pkcs1_create,
> +	.module = THIS_MODULE,
> +};
> +
> +MODULE_ALIAS_CRYPTO("pkcs1");
> diff --git a/crypto/testmgr.c b/crypto/testmgr.c
> index 0542817a9456..91dc29e79dd6 100644
> --- a/crypto/testmgr.c
> +++ b/crypto/testmgr.c
> @@ -5548,34 +5548,38 @@ static const struct alg_test_desc alg_test_descs[] = {
>  			.cipher = __VECS(fcrypt_pcbc_tv_template)
>  		}
>  	}, {
> -		.alg = "pkcs1pad(rsa,sha224)",
> +		.alg = "pkcs1(rsa,sha224)",
>  		.test = alg_test_null,
>  		.fips_allowed = 1,
>  	}, {
> -		.alg = "pkcs1pad(rsa,sha256)",
> -		.test = alg_test_akcipher,
> +		.alg = "pkcs1(rsa,sha256)",
> +		.test = alg_test_sig,
>  		.fips_allowed = 1,
>  		.suite = {
> -			.akcipher = __VECS(pkcs1pad_rsa_tv_template)
> +			.sig = __VECS(pkcs1_rsa_tv_template)
>  		}
>  	}, {
> -		.alg = "pkcs1pad(rsa,sha3-256)",
> +		.alg = "pkcs1(rsa,sha3-256)",
> +		.test = alg_test_null,
> +		.fips_allowed = 1,
> +	}, {
> +		.alg = "pkcs1(rsa,sha3-384)",
>  		.test = alg_test_null,
>  		.fips_allowed = 1,
>  	}, {
> -		.alg = "pkcs1pad(rsa,sha3-384)",
> +		.alg = "pkcs1(rsa,sha3-512)",
>  		.test = alg_test_null,
>  		.fips_allowed = 1,
>  	}, {
> -		.alg = "pkcs1pad(rsa,sha3-512)",
> +		.alg = "pkcs1(rsa,sha384)",
>  		.test = alg_test_null,
>  		.fips_allowed = 1,
>  	}, {
> -		.alg = "pkcs1pad(rsa,sha384)",
> +		.alg = "pkcs1(rsa,sha512)",
>  		.test = alg_test_null,
>  		.fips_allowed = 1,
>  	}, {
> -		.alg = "pkcs1pad(rsa,sha512)",
> +		.alg = "pkcs1pad(rsa)",
>  		.test = alg_test_null,
>  		.fips_allowed = 1,
>  	}, {
> diff --git a/crypto/testmgr.h b/crypto/testmgr.h
> index fd4823c26d93..d29d03fec852 100644
> --- a/crypto/testmgr.h
> +++ b/crypto/testmgr.h
> @@ -1268,7 +1268,7 @@ static const struct sig_testvec ecrdsa_tv_template[] = {
>  /*
>   * PKCS#1 RSA test vectors. Obtained from CAVS testing.
>   */
> -static const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = {
> +static const struct sig_testvec pkcs1_rsa_tv_template[] = {
>  	{
>  	.key =
>  	"\x30\x82\x04\xa5\x02\x01\x00\x02\x82\x01\x01\x00\xd7\x1e\x77\x82"
> @@ -1380,7 +1380,6 @@ static const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = {
>  	"\xda\x62\x8d\xe1\x2a\x71\x91\x43\x40\x61\x3c\x5a\xbe\x86\xfc\x5b"
>  	"\xe6\xf9\xa9\x16\x31\x1f\xaf\x25\x6d\xc2\x4a\x23\x6e\x63\x02\xa2",
>  	.c_size = 256,
> -	.siggen_sigver_test = true,
>  	}
>  };
>  
> diff --git a/include/crypto/internal/rsa.h b/include/crypto/internal/rsa.h
> index 754f687134df..071a1951b992 100644
> --- a/include/crypto/internal/rsa.h
> +++ b/include/crypto/internal/rsa.h
> @@ -82,4 +82,5 @@ static inline int rsa_set_key(struct crypto_akcipher *child,
>  }
>  
>  extern struct crypto_template rsa_pkcs1pad_tmpl;
> +extern struct crypto_template rsassa_pkcs1_tmpl;
>  #endif
> diff --git a/include/linux/slab.h b/include/linux/slab.h
> index eb2bf4629157..11b620b0ba1d 100644
> --- a/include/linux/slab.h
> +++ b/include/linux/slab.h
> @@ -280,6 +280,7 @@ void kfree_sensitive(const void *objp);
>  size_t __ksize(const void *objp);
>  
>  DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))
> +DEFINE_FREE(kfree_sensitive, void *, if (_T) kfree_sensitive(_T))
>  
>  /**
>   * ksize - Report actual allocation size of associated object
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index f04f43af651c..280a3feeba45 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -1114,7 +1114,7 @@ EXPORT_SYMBOL_GPL(ima_measure_critical_data);
>  #ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
>  
>  /**
> - * ima_kernel_module_request - Prevent crypto-pkcs1pad(rsa,*) requests
> + * ima_kernel_module_request - Prevent crypto-pkcs1(rsa,*) requests
>   * @kmod_name: kernel module name
>   *
>   * Avoid a verification loop where verifying the signature of the modprobe
> @@ -1128,7 +1128,7 @@ EXPORT_SYMBOL_GPL(ima_measure_critical_data);
>   * algorithm on the fly, but crypto_larval_lookup() will try to use alg_name
>   * in order to load a kernel module with same name.
>   *
> - * Since we don't have any real "crypto-pkcs1pad(rsa,*)" kernel modules,
> + * Since we don't have any real "crypto-pkcs1(rsa,*)" kernel modules,
>   * we are safe to fail such module request from crypto_larval_lookup(), and
>   * avoid the verification loop.
>   *
> @@ -1136,7 +1136,7 @@ EXPORT_SYMBOL_GPL(ima_measure_critical_data);
>   */
>  static int ima_kernel_module_request(char *kmod_name)
>  {
> -	if (strncmp(kmod_name, "crypto-pkcs1pad(rsa,", 20) == 0)
> +	if (strncmp(kmod_name, "crypto-pkcs1(rsa,", 17) == 0)
>  		return -EINVAL;
>  
>  	return 0;






[Index of Archives]     [Kernel]     [Gnu Classpath]     [Gnu Crypto]     [DM Crypt]     [Netfilter]     [Bugtraq]
  Powered by Linux