ima-evm-utils: rebase of digest algo resolving

PATCH In review Vitaly Chikunov 2 participants 10 messages Mar 23, 2019 – Apr 3, 2019 Keys-trusted

lore

Share & tools

lore

Vitaly Chikunov

author

2019-03-23 01:42 UTC #0 lore raw

cover ima-evm-utils: rebase of digest algo resolving

This is rebase of the ima-evm-utils commits:

0267fa1 ima-evm-utils: Try to load digest by its alias 942d9f9 ima-evm-utils: Extract digest algorithms from hash_info.h

and should be applied over 07d799c ("ima-evm-utils: Preload OpenSSL engine via '--engine' option").

Changes:

* ima-evm-utils: Extract digest algorithms from hash_info.h
- algocmp is removed.
- hash_info.h is parsed better to match algo names in the Kernel, thus simple strcmp could be used.

* ima-evm-utils: try to load digest by its alias
- digest name lookup is simplified by removing get_digestbyname and strmatch helpers.
- Kernel and OpenSSL algo names arrays are introduced to support alternative algo names for older OpenSLL.

*** BLURB HERE ***

Vitaly Chikunov (2):
ima-evm-utils: Extract digest algorithms from hash_info.h
ima-evm-utils: try to load digest by its alias

 configure.ac      |  6 ++++++
 src/Makefile.am   |  6 ++++++
 src/hash_info.gen | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 src/libimaevm.c   | 35 ++++++++++++++++++++++++++++++++++-
 4 files changed, 95 insertions(+), 1 deletion(-)
 create mode 100755 src/hash_info.gen

Signature · 1 line

2.11.0

Vitaly Chikunov

author

2019-03-23 01:42 UTC #1 lore raw

PATCH 1/2 ima-evm-utils: Extract digest algorithms from hash_info.h

If configured with "--with-kernel-headers=PATH" try to extract hash algorithms from "hash_info.h" from the kernel source tree or kernel-headers package located in the specified path. (Otherwise, it will be tried to get from the installed kernel.)

This also introduces two algorithm lists, one is built-in and another is from the kernel source. (They should never contain conflicting algorithm IDs by their append-only nature.) If the digest is not found in the built-in list it will be searched in the list from kernel's "hash_info.h".

This patch will allow evmctl to be just recompiled to work with digest algorithms introduced in the newer kernels.

Signed-off-by Vitaly Chikunov <[email protected]>

---
 configure.ac      |  6 ++++++
 src/Makefile.am   |  6 ++++++
 src/hash_info.gen | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 src/libimaevm.c   | 23 ++++++++++++++++++++++-
 4 files changed, 83 insertions(+), 1 deletion(-)
 create mode 100755 src/hash_info.gen

configure.ac +6 -0

index a5b4288..60f3684 100644
@@ -27,12 +27,18 @@ AC_HEADER_STDC
 PKG_CHECK_MODULES(OPENSSL, [ openssl >= 0.9.8 ])
 AC_SUBST(OPENSSL_CFLAGS)
 AC_SUBST(OPENSSL_LIBS)
+AC_SUBST(KERNEL_HEADERS)
 AC_CHECK_HEADER(unistd.h)
 AC_CHECK_HEADERS(openssl/conf.h)
 
 AC_CHECK_HEADERS(sys/xattr.h, , [AC_MSG_ERROR([sys/xattr.h header not found. You need the c-library development package.])])
 AC_CHECK_HEADERS(keyutils.h, , [AC_MSG_ERROR([keyutils.h header not found. You need the libkeyutils development package.])])
 
+AC_ARG_WITH(kernel_headers, [AS_HELP_STRING([--with-kernel-headers=PATH],
+	    [specifies the Linux kernel-headers package location or kernel root directory you want to use])],
+	    [KERNEL_HEADERS="$withval"],
+	    [KERNEL_HEADERS=/lib/modules/$(uname -r)/source])
+
 #debug support - yes for a while
 PKG_ARG_ENABLE(debug, "yes", DEBUG, [Enable Debug support])
 if test $pkg_cv_enable_debug = yes; then

src/Makefile.am +6 -0

index deb18fb..d74fc6f 100644
@@ -9,6 +9,11 @@ libimaevm_la_LIBADD =  $(OPENSSL_LIBS)
 
 include_HEADERS = imaevm.h
 
+nodist_libimaevm_la_SOURCES = hash_info.h
+BUILT_SOURCES = hash_info.h
+hash_info.h: Makefile
+	./hash_info.gen $(KERNEL_HEADERS) >$@
+
 bin_PROGRAMS = evmctl
 
 evmctl_SOURCES = evmctl.c

@@ -18,5 +23,6 @@ evmctl_LDADD =  $(OPENSSL_LIBS) -lkeyutils libimaevm.la
 
 INCLUDES = -I$(top_srcdir) -include config.h
 
+CLEANFILES = hash_info.h
 DISTCLEANFILES = @DISTCLEANFILES@

src/hash_info.gen new file +49 -0

49 lines not on this page · raw message

src/libimaevm.c +22 -1

index ca77532..bc7be1e 100644
@@ -50,6 +50,7 @@
 #include <string.h>
 #include <stdio.h>
 #include <assert.h>
+#include <ctype.h>
 
 #include <openssl/crypto.h>
 #include <openssl/pem.h>

@@ -58,6 +59,7 @@
 #include <openssl/err.h>
 
 #include "imaevm.h"
+#include "hash_info.h"
 
 const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_MD4]		= "md4",

@@ -153,6 +155,17 @@ void dump(const void *ptr, int len)
 	do_dump(stdout, ptr, len, true);
 }
 
+const char *get_hash_algo_by_id(int algo)
+{
+	if (algo < PKEY_HASH__LAST)
+		return pkey_hash_algo[algo];
+	if (algo < HASH_ALGO__LAST)
+		return hash_algo_name[algo];
+
+	log_err("digest %d not found\n", algo);
+	return "unknown";
+}
+
 int get_filesize(const char *filename)
 {
 	struct stat stats;

@@ -532,11 +545,19 @@ int get_hash_algo(const char *algo)
 {
 	int i;
 
+	/* first iterate over builtin algorithms */
 	for (i = 0; i < PKEY_HASH__LAST; i++)
 		if (pkey_hash_algo[i] &&
 		    !strcmp(algo, pkey_hash_algo[i]))
 			return i;
 
+	/* iterate over algorithms provided by kernel-headers */
+	for (i = 0; i < HASH_ALGO__LAST; i++)
+		if (hash_algo_name[i] &&
+		    !strcmp(algo, hash_algo_name[i]))
+			return i;
+
+	log_info("digest %s not found, fall back to sha1\n", algo);
 	return PKEY_HASH_SHA1;
 }

@@ -611,7 +632,7 @@ int ima_verify_signature(const char *file, unsigned char *sig, int siglen,
 		return -1;
 	}
 	/* Use hash algorithm as retrieved from signature */
-	params.hash_algo = pkey_hash_algo[sig_hash_algo];
+	params.hash_algo = get_hash_algo_by_id(sig_hash_algo);
 
 	/*
 	 * Validate the signature based on the digest included in the

Signature · 1 line

2.11.0

Vitaly Chikunov

author

2019-03-23 01:42 UTC #2 lore raw

PATCH 2/2 ima-evm-utils: try to load digest by its alias

In reply to Vitaly Chikunov

Primary names of the algorithms are different for OpenSSL and Kernel. Allow to use both of them.

Signed-off-by Vitaly Chikunov <[email protected]>

---
 src/libimaevm.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

src/libimaevm.c +12 -0

index bc7be1e..6783110 100644
@@ -61,6 +61,7 @@
 #include "imaevm.h"
 #include "hash_info.h"
 
+/* Names that are primary for OpenSSL. */
 const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_MD4]		= "md4",
 	[PKEY_HASH_MD5]		= "md5",

@@ -70,6 +71,12 @@ const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_SHA384]	= "sha384",
 	[PKEY_HASH_SHA512]	= "sha512",
 	[PKEY_HASH_SHA224]	= "sha224",
+	[PKEY_HASH_STREEBOG_256] = "md_gost12_256",
+	[PKEY_HASH_STREEBOG_512] = "md_gost12_512",
+};
+
+/* Names that are primary for the kernel. */
+const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = {
 	[PKEY_HASH_STREEBOG_256] = "streebog256",
 	[PKEY_HASH_STREEBOG_512] = "streebog512",
 };

@@ -551,6 +558,11 @@ int get_hash_algo(const char *algo)
 		    !strcmp(algo, pkey_hash_algo[i]))
 			return i;
 
+	for (i = 0; i < PKEY_HASH__LAST; i++)
+		if (pkey_hash_algo_kern[i] &&
+		    !strcmp(algo, pkey_hash_algo_kern[i]))
+			return i;
+
 	/* iterate over algorithms provided by kernel-headers */
 	for (i = 0; i < HASH_ALGO__LAST; i++)
 		if (hash_algo_name[i] &&

Signature · 1 line

2.11.0

Mimi Zohar

maintainer Reviewed-by on v1 2/2

2019-04-03 20:41 UTC #3 lore raw

Re: [PATCH 2/2] ima-evm-utils: try to load digest by its alias

Quoted 2 lines · Vitaly Chikunov

Primary names of the algorithms are different for OpenSSL and Kernel. Allow to use both of them.

Can we add a line here explaining the two names? Perhaps something like, "GOST R 34.11-2012 is the Russian national standard based on the Streebog set of hash functions."

Quoted 2 lines

Signed-off-by Vitaly Chikunov <[email protected]>

Reviewed-by Mimi Zohar <[email protected]>

Quoted 41 lines

---
 src/libimaevm.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

src/libimaevm.c +12 -0

index bc7be1e..6783110 100644
@@ -61,6 +61,7 @@
 #include "imaevm.h"
 #include "hash_info.h"
 
+/* Names that are primary for OpenSSL. */
 const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_MD4]		= "md4",
 	[PKEY_HASH_MD5]		= "md5",

@@ -70,6 +71,12 @@ const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_SHA384]	= "sha384",
 	[PKEY_HASH_SHA512]	= "sha512",
 	[PKEY_HASH_SHA224]	= "sha224",
+	[PKEY_HASH_STREEBOG_256] = "md_gost12_256",
+	[PKEY_HASH_STREEBOG_512] = "md_gost12_512",
+};
+
+/* Names that are primary for the kernel. */
+const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = {
 	[PKEY_HASH_STREEBOG_256] = "streebog256",
 	[PKEY_HASH_STREEBOG_512] = "streebog512",
 };

@@ -551,6 +558,11 @@ int get_hash_algo(const char *algo)
 		    !strcmp(algo, pkey_hash_algo[i]))
 			return i;
 
+	for (i = 0; i < PKEY_HASH__LAST; i++)
+		if (pkey_hash_algo_kern[i] &&
+		    !strcmp(algo, pkey_hash_algo_kern[i]))
+			return i;
+
 	/* iterate over algorithms provided by kernel-headers */
 	for (i = 0; i < HASH_ALGO__LAST; i++)
 		if (hash_algo_name[i] &&

Vitaly Chikunov

author

2019-04-03 21:04 UTC #4 lore raw

Re: [PATCH 2/2] ima-evm-utils: try to load digest by its alias

Mimi,

Quoted 7 lines · Mimi Zohar

Quoted 2 lines · Vitaly Chikunov
Primary names of the algorithms are different for OpenSSL and Kernel. Allow to use both of them.
Can we add a line here explaining the two names? Perhaps something like, "GOST R 34.11-2012 is the Russian national standard based on the Streebog set of hash functions."

Ok. But, "GOST R 34.11-2012" is not mentioned, and there is other standards with Streebog, such as RFC 6986, ISO/IEC 10118-3:2018, GOST 34.11-2018.

Point of this patch is that Kernel calls this hash function by it's proper name "StreebogX", but older version of OpenSSL reference it by acronym "md_gost12_X". (While newer should support Streebog name too.) And we try to be user friendly and allow to use both names.

Quoted 47 lines

Quoted 3 lines

Signed-off-by Vitaly Chikunov <[email protected]>

Reviewed-by Mimi Zohar <[email protected]>

Quoted 41 lines

---
 src/libimaevm.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

src/libimaevm.c +12 -0

index bc7be1e..6783110 100644
@@ -61,6 +61,7 @@
 #include "imaevm.h"
 #include "hash_info.h"
 
+/* Names that are primary for OpenSSL. */
 const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_MD4]		= "md4",
 	[PKEY_HASH_MD5]		= "md5",

@@ -70,6 +71,12 @@ const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_SHA384]	= "sha384",
 	[PKEY_HASH_SHA512]	= "sha512",
 	[PKEY_HASH_SHA224]	= "sha224",
+	[PKEY_HASH_STREEBOG_256] = "md_gost12_256",
+	[PKEY_HASH_STREEBOG_512] = "md_gost12_512",
+};
+
+/* Names that are primary for the kernel. */
+const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = {
 	[PKEY_HASH_STREEBOG_256] = "streebog256",
 	[PKEY_HASH_STREEBOG_512] = "streebog512",
 };

@@ -551,6 +558,11 @@ int get_hash_algo(const char *algo)
 		    !strcmp(algo, pkey_hash_algo[i]))
 			return i;
 
+	for (i = 0; i < PKEY_HASH__LAST; i++)
+		if (pkey_hash_algo_kern[i] &&
+		    !strcmp(algo, pkey_hash_algo_kern[i]))
+			return i;
+
 	/* iterate over algorithms provided by kernel-headers */
 	for (i = 0; i < HASH_ALGO__LAST; i++)
 		if (hash_algo_name[i] &&

Mimi Zohar

maintainer

2019-04-03 21:10 UTC #5 lore raw

Re: [PATCH 2/2] ima-evm-utils: try to load digest by its alias

Quoted 11 lines · Vitaly Chikunov

Mimi,
Quoted 7 lines · Mimi Zohar
Quoted 2 lines · Vitaly Chikunov
Primary names of the algorithms are different for OpenSSL and Kernel. Allow to use both of them.
Can we add a line here explaining the two names? Perhaps something like, "GOST R 34.11-2012 is the Russian national standard based on the Streebog set of hash functions."

Quoted 8 lines

Ok. But, "GOST R 34.11-2012" is not mentioned, and there is other standards with Streebog, such as RFC 6986, ISO/IEC 10118-3:2018, GOST 34.11-2018.
Point of this patch is that Kernel calls this hash function by it's proper name "StreebogX", but older version of OpenSSL reference it by acronym "md_gost12_X". (While newer should support Streebog name too.) And we try to be user friendly and allow to use both names.

If "Streebog" will be supported by OpenSSL, then why make md_gost12_x the primary name, and the kernel name the alias? Shouldn't it be the reverse (eg. "pkey_hash_algo_alias")?

Quoted 49 lines

Quoted 48 lines

Quoted 4 lines

Signed-off-by Vitaly Chikunov <[email protected]>

Reviewed-by Mimi Zohar <[email protected]>

Quoted 41 lines

---
 src/libimaevm.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

src/libimaevm.c +12 -0

index bc7be1e..6783110 100644
@@ -61,6 +61,7 @@
 #include "imaevm.h"
 #include "hash_info.h"
 
+/* Names that are primary for OpenSSL. */
 const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_MD4]		= "md4",
 	[PKEY_HASH_MD5]		= "md5",

@@ -70,6 +71,12 @@ const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_SHA384]	= "sha384",
 	[PKEY_HASH_SHA512]	= "sha512",
 	[PKEY_HASH_SHA224]	= "sha224",
+	[PKEY_HASH_STREEBOG_256] = "md_gost12_256",
+	[PKEY_HASH_STREEBOG_512] = "md_gost12_512",
+};
+
+/* Names that are primary for the kernel. */
+const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = {
 	[PKEY_HASH_STREEBOG_256] = "streebog256",
 	[PKEY_HASH_STREEBOG_512] = "streebog512",
 };

@@ -551,6 +558,11 @@ int get_hash_algo(const char *algo)
 		    !strcmp(algo, pkey_hash_algo[i]))
 			return i;
 
+	for (i = 0; i < PKEY_HASH__LAST; i++)
+		if (pkey_hash_algo_kern[i] &&
+		    !strcmp(algo, pkey_hash_algo_kern[i]))
+			return i;
+
 	/* iterate over algorithms provided by kernel-headers */
 	for (i = 0; i < HASH_ALGO__LAST; i++)
 		if (hash_algo_name[i] &&

Vitaly Chikunov

author

2019-04-03 21:37 UTC #6 lore raw

Re: [PATCH 2/2] ima-evm-utils: try to load digest by its alias

Quoted 16 lines · Mimi Zohar

Quoted 15 lines · Vitaly Chikunov
Mimi,
Quoted 7 lines · Mimi Zohar
Quoted 2 lines · Vitaly Chikunov
Primary names of the algorithms are different for OpenSSL and Kernel. Allow to use both of them.
Can we add a line here explaining the two names? Perhaps something like, "GOST R 34.11-2012 is the Russian national standard based on the Streebog set of hash functions."
Ok. But, "GOST R 34.11-2012" is not mentioned, and there is other standards with Streebog, such as RFC 6986, ISO/IEC 10118-3:2018, GOST 34.11-2018.

Quoted 8 lines

Quoted 4 lines
Point of this patch is that Kernel calls this hash function by it's proper name "StreebogX", but older version of OpenSSL reference it by acronym "md_gost12_X". (While newer should support Streebog name too.) And we try to be user friendly and allow to use both names.
If "Streebog" will be supported by OpenSSL, then why make md_gost12_x the primary name, and the kernel name the alias? Shouldn't it be the reverse (eg. "pkey_hash_algo_alias")?

Because ima-evm-utils is using OpenSSL and not Kernel's Crypto API, OpenSSL names are "primary" for ima-evm-utils. It's happened that most names are the same for both APIs.

"md_gost12_X" is supported for years by more versions of OpenSSL. While "StreebogX" name is just committed a few months ago to gost-engine. Thus,

1) "md_gost12_x" name could be used on conservative distros. Users will not need to wait [possible] a few years when new name reach their distro.

2) PKEY_HASH_STREEBOG_X is resolved to "md_gost12_X" names (to the names that are present in OpenSSL with much more probability).

pkey_hash_algo_kern only contains names that are different between the Kernel and OpenSSL.

I used "primary" for the both arrays so that no names are offended by being not-primary.

Quoted 46 lines

Quoted 45 lines

Quoted 1 line

Signed-off-by Vitaly Chikunov <[email protected]>

Reviewed-by Mimi Zohar <[email protected]>

Quoted 41 lines

---
 src/libimaevm.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

src/libimaevm.c +12 -0

index bc7be1e..6783110 100644
@@ -61,6 +61,7 @@
 #include "imaevm.h"
 #include "hash_info.h"
 
+/* Names that are primary for OpenSSL. */
 const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_MD4]		= "md4",
 	[PKEY_HASH_MD5]		= "md5",

@@ -70,6 +71,12 @@ const char *const pkey_hash_algo[PKEY_HASH__LAST] = {
 	[PKEY_HASH_SHA384]	= "sha384",
 	[PKEY_HASH_SHA512]	= "sha512",
 	[PKEY_HASH_SHA224]	= "sha224",
+	[PKEY_HASH_STREEBOG_256] = "md_gost12_256",
+	[PKEY_HASH_STREEBOG_512] = "md_gost12_512",
+};
+
+/* Names that are primary for the kernel. */
+const char *const pkey_hash_algo_kern[PKEY_HASH__LAST] = {
 	[PKEY_HASH_STREEBOG_256] = "streebog256",
 	[PKEY_HASH_STREEBOG_512] = "streebog512",
 };

@@ -551,6 +558,11 @@ int get_hash_algo(const char *algo)
 		    !strcmp(algo, pkey_hash_algo[i]))
 			return i;
 
+	for (i = 0; i < PKEY_HASH__LAST; i++)
+		if (pkey_hash_algo_kern[i] &&
+		    !strcmp(algo, pkey_hash_algo_kern[i]))
+			return i;
+
 	/* iterate over algorithms provided by kernel-headers */
 	for (i = 0; i < HASH_ALGO__LAST; i++)
 		if (hash_algo_name[i] &&

Mimi Zohar

maintainer

2019-04-03 21:40 UTC #7 lore raw

Re: [PATCH 2/2] ima-evm-utils: try to load digest by its alias

Quoted 37 lines · Vitaly Chikunov

Quoted 16 lines · Mimi Zohar
Quoted 15 lines · Vitaly Chikunov
Mimi,
Quoted 7 lines · Mimi Zohar
Quoted 2 lines · Vitaly Chikunov
Primary names of the algorithms are different for OpenSSL and Kernel. Allow to use both of them.
Can we add a line here explaining the two names? Perhaps something like, "GOST R 34.11-2012 is the Russian national standard based on the Streebog set of hash functions."
Ok. But, "GOST R 34.11-2012" is not mentioned, and there is other standards with Streebog, such as RFC 6986, ISO/IEC 10118-3:2018, GOST 34.11-2018.
Quoted 8 lines
Quoted 4 lines
Point of this patch is that Kernel calls this hash function by it's proper name "StreebogX", but older version of OpenSSL reference it by acronym "md_gost12_X". (While newer should support Streebog name too.) And we try to be user friendly and allow to use both names.
If "Streebog" will be supported by OpenSSL, then why make md_gost12_x the primary name, and the kernel name the alias? Shouldn't it be the reverse (eg. "pkey_hash_algo_alias")?
Because ima-evm-utils is using OpenSSL and not Kernel's Crypto API, OpenSSL names are "primary" for ima-evm-utils. It's happened that most names are the same for both APIs.
"md_gost12_X" is supported for years by more versions of OpenSSL. While "StreebogX" name is just committed a few months ago to gost-engine. Thus,
1) "md_gost12_x" name could be used on conservative distros. Users will not need to wait [possible] a few years when new name reach their distro.

Quoted 8 lines

2) PKEY_HASH_STREEBOG_X is resolved to "md_gost12_X" names (to the names that are present in OpenSSL with much more probability).
pkey_hash_algo_kern only contains names that are different between the Kernel and OpenSSL.
I used "primary" for the both arrays so that no names are offended by being not-primary.

Could you provide me with a single line or two, with an explanation for the two names. I'll add it to the commit patch description, before pushing out these patches.

Thanks!

Mimi

Vitaly Chikunov

author

2019-04-03 21:57 UTC #8 lore raw

Re: [PATCH 2/2] ima-evm-utils: try to load digest by its alias

Quoted 44 lines · Mimi Zohar

Quoted 43 lines · Vitaly Chikunov
Quoted 16 lines · Mimi Zohar
Quoted 15 lines · Vitaly Chikunov
Mimi,
Quoted 7 lines · Mimi Zohar
Quoted 2 lines · Vitaly Chikunov
Primary names of the algorithms are different for OpenSSL and Kernel. Allow to use both of them.
Can we add a line here explaining the two names? Perhaps something like, "GOST R 34.11-2012 is the Russian national standard based on the Streebog set of hash functions."
Ok. But, "GOST R 34.11-2012" is not mentioned, and there is other standards with Streebog, such as RFC 6986, ISO/IEC 10118-3:2018, GOST 34.11-2018.
Quoted 8 lines
Quoted 4 lines
Point of this patch is that Kernel calls this hash function by it's proper name "StreebogX", but older version of OpenSSL reference it by acronym "md_gost12_X". (While newer should support Streebog name too.) And we try to be user friendly and allow to use both names.
If "Streebog" will be supported by OpenSSL, then why make md_gost12_x the primary name, and the kernel name the alias? Shouldn't it be the reverse (eg. "pkey_hash_algo_alias")?
Because ima-evm-utils is using OpenSSL and not Kernel's Crypto API, OpenSSL names are "primary" for ima-evm-utils. It's happened that most names are the same for both APIs.
"md_gost12_X" is supported for years by more versions of OpenSSL. While "StreebogX" name is just committed a few months ago to gost-engine. Thus,
1) "md_gost12_x" name could be used on conservative distros. Users will not need to wait [possible] a few years when new name reach their distro.
2) PKEY_HASH_STREEBOG_X is resolved to "md_gost12_X" names (to the names that are present in OpenSSL with much more probability).
pkey_hash_algo_kern only contains names that are different between the Kernel and OpenSSL.

Quoted 6 lines

Quoted 2 lines
I used "primary" for the both arrays so that no names are offended by being not-primary.
Could you provide me with a single line or two, with an explanation for the two names. I'll add it to the commit patch description, before pushing out these patches.

Maybe this:

"Streebog" is a name of the hash algorithm in the Kernel Crypto API. "md_gost12_X" is the name used by the most versions of OpenSSL, it's placed in pkey_hash_algo[] so that algo IDs are resolved to them.

Quoted 4 lines

Thanks!
Mimi

Mimi Zohar

maintainer

2019-04-03 21:59 UTC #9 lore raw

Re: [PATCH 2/2] ima-evm-utils: try to load digest by its alias

Quoted 5 lines · Vitaly Chikunov

Maybe this:
"Streebog" is a name of the hash algorithm in the Kernel Crypto API. "md_gost12_X" is the name used by the most versions of OpenSSL, it's placed in pkey_hash_algo[] so that algo IDs are resolved to them.

Thank you!