Skip to content

Commit 6e007f3

Browse files
dhowellsdhowells
committed
Merge branch 'keys-misc' into keys-next
Miscellaneous keyrings changes. Signed-off-by: David Howells <dhowells@redhat.com>
2 parents 3c9d629 + ddbb411 commit 6e007f3

File tree

11 files changed

+428
-50
lines changed

11 files changed

+428
-50
lines changed

‎Documentation/security/keys.txt

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -823,6 +823,36 @@ The keyctl syscall functions are:
823823
A process must have search permission on the key for this function to be
824824
successful.
825825

826+
(*) Compute a Diffie-Hellman shared secret or public key
827+
828+
long keyctl(KEYCTL_DH_COMPUTE, struct keyctl_dh_params *params,
829+
char *buffer, size_t buflen);
830+
831+
The params struct contains serial numbers for three keys:
832+
833+
- The prime, p, known to both parties
834+
- The local private key
835+
- The base integer, which is either a shared generator or the
836+
remote public key
837+
838+
The value computed is:
839+
840+
result = base ^ private (mod prime)
841+
842+
If the base is the shared generator, the result is the local
843+
public key. If the base is the remote public key, the result is
844+
the shared secret.
845+
846+
The buffer length must be at least the length of the prime, or zero.
847+
848+
If the buffer length is nonzero, the length of the result is
849+
returned when it is successfully calculated and copied in to the
850+
buffer. When the buffer length is zero, the minimum required
851+
buffer length is returned.
852+
853+
This function will return error EOPNOTSUPP if the key type is not
854+
supported, error ENOKEY if the key could not be found, or error
855+
EACCES if the key is not readable by the caller.
826856

827857
===============
828858
KERNEL SERVICES

‎include/uapi/linux/keyctl.h

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
#ifndef _LINUX_KEYCTL_H
1313
#define _LINUX_KEYCTL_H
1414

15+
#include <linux/types.h>
16+
1517
/* special process keyring shortcut IDs */
1618
#define KEY_SPEC_THREAD_KEYRING -1 /* - key ID for thread-specific keyring */
1719
#define KEY_SPEC_PROCESS_KEYRING -2 /* - key ID for process-specific keyring */
@@ -57,5 +59,13 @@
5759
#define KEYCTL_INSTANTIATE_IOV 20 /* instantiate a partially constructed key */
5860
#define KEYCTL_INVALIDATE 21 /* invalidate a key */
5961
#define KEYCTL_GET_PERSISTENT 22 /* get a user's persistent keyring */
62+
#define KEYCTL_DH_COMPUTE 23 /* Compute Diffie-Hellman values */
63+
64+
/* keyctl structures */
65+
struct keyctl_dh_params {
66+
__s32 private;
67+
__s32 prime;
68+
__s32 base;
69+
};
6070

6171
#endif /* _LINUX_KEYCTL_H */

‎security/integrity/Kconfig

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ config INTEGRITY_ASYMMETRIC_KEYS
3535
default n
3636
select ASYMMETRIC_KEY_TYPE
3737
select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
38-
select PUBLIC_KEY_ALGO_RSA
3938
select CRYPTO_RSA
4039
select X509_CERTIFICATE_PARSER
4140
help

‎security/keys/Kconfig

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ config BIG_KEYS
4141
bool "Large payload keys"
4242
depends on KEYS
4343
depends on TMPFS
44+
select CRYPTO
45+
select CRYPTO_AES
46+
select CRYPTO_ECB
47+
select CRYPTO_RNG
4448
help
4549
This option provides support for holding large keys within the kernel
4650
(for example Kerberos ticket caches). The data may be stored out to
@@ -81,3 +85,14 @@ config ENCRYPTED_KEYS
8185
Userspace only ever sees/stores encrypted blobs.
8286

8387
If you are unsure as to whether this is required, answer N.
88+
89+
config KEY_DH_OPERATIONS
90+
bool "Diffie-Hellman operations on retained keys"
91+
depends on KEYS
92+
select MPILIB
93+
help
94+
This option provides support for calculating Diffie-Hellman
95+
public keys and shared secrets using values stored as keys
96+
in the kernel.
97+
98+
If you are unsure as to whether this is required, answer N.

‎security/keys/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ obj-$(CONFIG_KEYS_COMPAT) += compat.o
1919
obj-$(CONFIG_PROC_FS) += proc.o
2020
obj-$(CONFIG_SYSCTL) += sysctl.o
2121
obj-$(CONFIG_PERSISTENT_KEYRINGS) += persistent.o
22+
obj-$(CONFIG_KEY_DH_OPERATIONS) += dh.o
2223

2324
#
2425
# Key types

0 commit comments

Comments
 (0)