aboutsummaryrefslogtreecommitdiffstats
path: root/crypto
diff options
context:
space:
mode:
authorDavid Howells2012-09-21 17:25:04 -0500
committerRusty Russell2012-10-07 22:20:15 -0500
commit4ae71c1dce1e3d2270a0755988033e236b8e45d6 (patch)
treedd48fafaa13f718a7ea0a9e0fa79e8211239fe8e /crypto
parenta9681bf3dd7ccd2b32eba27d327ab76607429f7a (diff)
downloadkernel-omap-4ae71c1dce1e3d2270a0755988033e236b8e45d6.tar.gz
kernel-omap-4ae71c1dce1e3d2270a0755988033e236b8e45d6.tar.xz
kernel-omap-4ae71c1dce1e3d2270a0755988033e236b8e45d6.zip
KEYS: Provide signature verification with an asymmetric key
Provide signature verification using an asymmetric-type key to indicate the public key to be used. The API is a single function that can be found in crypto/public_key.h: int verify_signature(const struct key *key, const struct public_key_signature *sig) The first argument is the appropriate key to be used and the second argument is the parsed signature data: struct public_key_signature { u8 *digest; u16 digest_size; enum pkey_hash_algo pkey_hash_algo : 8; union { MPI mpi[2]; struct { MPI s; /* m^d mod n */ } rsa; struct { MPI r; MPI s; } dsa; }; }; This should be filled in prior to calling the function. The hash algorithm should already have been called and the hash finalised and the output should be in a buffer pointed to by the 'digest' member. Any extra data to be added to the hash by the hash format (eg. PGP) should have been added by the caller prior to finalising the hash. It is assumed that the signature is made up of a number of MPI values. If an algorithm becomes available for which this is not the case, the above structure will have to change. It is also assumed that it will have been checked that the signature algorithm matches the key algorithm. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Diffstat (limited to 'crypto')
-rw-r--r--crypto/asymmetric_keys/Makefile2
-rw-r--r--crypto/asymmetric_keys/signature.c49
2 files changed, 50 insertions, 1 deletions
diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile
index 5ed46eecb299..8dcdf0cdb261 100644
--- a/crypto/asymmetric_keys/Makefile
+++ b/crypto/asymmetric_keys/Makefile
@@ -4,6 +4,6 @@
4 4
5obj-$(CONFIG_ASYMMETRIC_KEY_TYPE) += asymmetric_keys.o 5obj-$(CONFIG_ASYMMETRIC_KEY_TYPE) += asymmetric_keys.o
6 6
7asymmetric_keys-y := asymmetric_type.o 7asymmetric_keys-y := asymmetric_type.o signature.o
8 8
9obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += public_key.o 9obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += public_key.o
diff --git a/crypto/asymmetric_keys/signature.c b/crypto/asymmetric_keys/signature.c
new file mode 100644
index 000000000000..50b3f880b4ff
--- /dev/null
+++ b/crypto/asymmetric_keys/signature.c
@@ -0,0 +1,49 @@
1/* Signature verification with an asymmetric key
2 *
3 * See Documentation/security/asymmetric-keys.txt
4 *
5 * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved.
6 * Written by David Howells (dhowells@redhat.com)
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public Licence
10 * as published by the Free Software Foundation; either version
11 * 2 of the Licence, or (at your option) any later version.
12 */
13
14#include <keys/asymmetric-subtype.h>
15#include <linux/module.h>
16#include <linux/err.h>
17#include <crypto/public_key.h>
18#include "asymmetric_keys.h"
19
20/**
21 * verify_signature - Initiate the use of an asymmetric key to verify a signature
22 * @key: The asymmetric key to verify against
23 * @sig: The signature to check
24 *
25 * Returns 0 if successful or else an error.
26 */
27int verify_signature(const struct key *key,
28 const struct public_key_signature *sig)
29{
30 const struct asymmetric_key_subtype *subtype;
31 int ret;
32
33 pr_devel("==>%s()\n", __func__);
34
35 if (key->type != &key_type_asymmetric)
36 return -EINVAL;
37 subtype = asymmetric_key_subtype(key);
38 if (!subtype ||
39 !key->payload.data)
40 return -EINVAL;
41 if (!subtype->verify_signature)
42 return -ENOTSUPP;
43
44 ret = subtype->verify_signature(key, sig);
45
46 pr_devel("<==%s() = %d\n", __func__, ret);
47 return ret;
48}
49EXPORT_SYMBOL_GPL(verify_signature);