On 1/31/22 15:24, Eric Biggers wrote:
On Mon, Jan 31, 2022 at 02:29:19PM -0500, Stefan Berger wrote:don't think I realized there was a more direct, PKCS#7-less way to do it and that IMA used that way.) However, it would be better to use this as an opportunity to move people off of the built-in signatures entirely, either by switching to a full userspace solution or by switching to IMA.If what we sign remains the same, then we could support multiple methods and use a selector to let fsverity_verify_signature() know how it should verify the signature. I don't know what would be a proper place for the selector. PKCS#7 seems ok, as it is used for kernel modules. IMA would be also ok, as it can verify the signature more directly. I would also be interested in supporting PGP, to avoid the requirement for Linux distributions to manage a secondary key. I have a small extension for rpmsign, that I would like to test in the Fedora infrastructure. Both the PKCS#7 and the PGP methods don't require additional support from outside, the functions verify_pkcs7_signature() and verify_pgp_signature() (proposed, not yet in the upstream kernel) would be sufficient.FYI: An empty file signed with pkcs7 and an ecc key for NIST p256 generates a signature of size 817 bytes. If an RPM needs to carry such signatures on a per-file basis we are back to the size increase of nearly an RSA signature. I would say for packages this is probably too much size increase.. and this is what drove the implementation of ECC support.I am getting 256 bytes for an ECC signature in PKCS#7 format: cd src/fsverity-utils make openssl ecparam -name prime256v1 -genkey -noout -out key.pem openssl req -new -x509 -key key.pem -out cert.pem -days 360 touch file ./fsverity sign file file.sig --key=key.pem --cert=cert.pem stat -c %s file.sig Probably you accidentally included the whole certificate in the PKCS#7 message. That's not required here. There are definitely problems with PKCS#7, and it does have space overhead. But the space overhead is not as bad as you state.
You are right. I used openssl cms without -nocerts and -noattr (unintentionately). Though 256 bytes is RSA 2048 signature size again. ECDSA with NIST p256 key is around 70 bytes.
- Eric
|