Convert lib/digsig.c to SHA-1 library

Select CRYPTO from INTEGRITY_ASYMMETRIC_KEYS, since INTEGRITY_ASYMMETRIC_KEYS selects several options that depend on CRYPTO.

This unblocks the removal of the CRYPTO selection from SIGNATURE. SIGNATURE (lib/digsig.c) itself will no longer need CRYPTO, but INTEGRITY_ASYMMETRIC_KEYS was depending on it indirectly via the chain SIGNATURE => INTEGRITY_SIGNATURE => INTEGRITY_ASYMMETRIC_KEYS.

Signed-off-by Eric Biggers <[email protected]>

---
  security/integrity/Kconfig | 1 +
  1 file changed, 1 insertion(+)

security/integrity/Kconfig +0 -0

index 3c45f4f3455fb..916d4f2bfc441 100644
@@ -34,10 +34,11 @@ config INTEGRITY_ASYMMETRIC_KEYS
  	bool "Enable asymmetric keys support"

Now that a SHA-1 library API is available, use it instead of crypto_shash. This is simpler and faster.

Signed-off-by Eric Biggers <[email protected]>

---
  lib/Kconfig  |  3 +--
  lib/digsig.c | 46 ++++++----------------------------------------
  2 files changed, 7 insertions(+), 42 deletions(-)

lib/Kconfig +1 -2

index c483951b624ff..e629449dd2a36 100644
@@ -475,12 +475,11 @@ config MPILIB
  	  which is used by IMA/EVM digital signature extension.
 
  config SIGNATURE
  	tristate
  	depends on KEYS
-	select CRYPTO
-	select CRYPTO_SHA1
+	select CRYPTO_LIB_SHA1
  	select MPILIB
  	help
  	  Digital signature verification. Currently only RSA is supported.
  	  Implementation is done using GnuPG MPI library
 

lib/digsig.c +6 -31

index 04b5e55ed95f5..5ddcc52f76863 100644
@@ -16,19 +16,15 @@
 
  #include <linux/err.h>
  #include <linux/module.h>
  #include <linux/slab.h>
  #include <linux/key.h>
-#include <linux/crypto.h>
-#include <crypto/hash.h>
  #include <crypto/sha1.h>
  #include <keys/user-type.h>
  #include <linux/mpi.h>
  #include <linux/digsig.h>
 
-static struct crypto_shash *shash;
-
  static const char *pkcs_1_v1_5_decode_emsa(const unsigned char *msg,
  						unsigned long  msglen,
  						unsigned long  modulus_bitlen,
  						unsigned long *outlen)
  {

@@ -197,16 +193,16 @@ static int digsig_verify_rsa(struct key *key,
   *
   */
  int digsig_verify(struct key *keyring, const char *sig, int siglen,
  						const char *data, int datalen)
  {
-	int err = -ENOMEM;
  	struct signature_hdr *sh = (struct signature_hdr *)sig;
-	struct shash_desc *desc = NULL;
+	struct sha1_ctx ctx;
  	unsigned char hash[SHA1_DIGEST_SIZE];
  	struct key *key;
  	char name[20];
+	int err;
 
  	if (siglen < sizeof(*sh) + 2)
  		return -EINVAL;
 
  	if (sh->algo != PUBKEY_ALGO_RSA)

@@ -229,51 +225,21 @@ int digsig_verify(struct key *keyring, const char *sig, int siglen,
  	if (IS_ERR(key)) {
  		pr_err("key not found, id: %s\n", name);
  		return PTR_ERR(key);
  	}
 
-	desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash),
-		       GFP_KERNEL);
-	if (!desc)
-		goto err;
-
-	desc->tfm = shash;
-
-	crypto_shash_init(desc);
-	crypto_shash_update(desc, data, datalen);
-	crypto_shash_update(desc, sig, sizeof(*sh));
-	crypto_shash_final(desc, hash);
-
-	kfree(desc);
+	sha1_init(&ctx);
+	sha1_update(&ctx, data, datalen);
+	sha1_update(&ctx, sig, sizeof(*sh));
+	sha1_final(&ctx, hash);
 
  	/* pass signature mpis address */
  	err = digsig_verify_rsa(key, sig + sizeof(*sh), siglen - sizeof(*sh),
  			     hash, sizeof(hash));
 
-err:
  	key_put(key);
 
  	return err ? -EINVAL : 0;
  }
  EXPORT_SYMBOL_GPL(digsig_verify);
 
-static int __init digsig_init(void)
-{
-	shash = crypto_alloc_shash("sha1", 0, 0);
-	if (IS_ERR(shash)) {
-		pr_err("shash allocation failed\n");
-		return  PTR_ERR(shash);
-	}
-
-	return 0;
-
-}

This series converts lib/digsig.c to use the SHA-1 library API.

Please consider taking this series through the integrity tree.

Eric Biggers (2):