Hi Mimi,
IMA currently extends the different TPM banks by padding/truncating the SHA1 template digest. Although the IMA measurement list only includes the SHA1 template digest, the template digest could be re-calculated properly for each bank. Roberto Sassu's proposed "ima: support stronger algorithms for attestation" kernel patch set makes this change. In order to test the proposed kernel change, this patch set walks the IMA measurement list, re-calculating the per TPM bank template digest and extending the TPM bank PCR with the bank specific digest. The last step, after walking the measurement list, is comparing the the resulting TPM per bank PCR values with the actual TPM per bank PCR values.
I have built the kernel with Roberto's patch set and also built evmctl with your patch set.
Could you please include an example for how evmctl can be used to test Roberto's change?
thanks, -lakshmi
