Hi Roberto, On Mon, 2020-01-27 at 18:04 +0100, Roberto Sassu wrote: > IMA extends Platform Configuration Registers (PCRs) of the TPM to give a > proof to a remote verifier that the measurement list contains all > measurements done by the kernel and that the list was not maliciously > modified by an attacker. > > IMA was originally designed to extend PCRs with a SHA1 digest, provided > with the measurement list, and was subsequently updated to extend all PCR > banks in case a TPM 2.0 is used. Non-SHA1 PCR banks are not supposed to be > used for remote attestation, as they are extended with a SHA1 digest padded > with zeros, which does not increase the strength. > > This patch set addresses this issue by extending PCRs with the digest of > the measurement entry calculated with the crypto subsystem. The list of > algorithms used to calculate the digest are taken from > ima_tpm_chip->allocated_banks, returned by the TPM driver. The SHA1 digest > is always calculated, as SHA1 still remains the default algorithm for the > template digest in the measurement list. > > This patch set also makes two additional modifications related to the usage > of hash algorithms. First, since now the template digest for the default > IMA algorithm is always calculated, this is used for hash collision > detection, to check if there are duplicate measurement entries. > > Second, it uses the default IMA hash algorithm to calculate the boot > aggregate, assuming that the corresponding PCR bank is currently allocated. > Otherwise, it finds the first PCR bank for which the crypto ID is known. > IMA initialization fails only if no algorithm known to the crypto subsystem > is found. > > This patch set does not yet modify the format of the measurement list to > provide the digests passed to the TPM. However, reconstructing the value of > the quoted PCR is still possible for the verifier by calculating the digest > on measurement data found in binary_runtime_measurements. Thank you! I'm still reviewing and testing the patches, but it is really nicely written. Mimi
