From owner-freebsd-security@freebsd.org Mon May 22 00:00:12 2017 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 34CC0D78C34; Mon, 22 May 2017 00:00:12 +0000 (UTC) (envelope-from cse.cem@gmail.com) Received: from mail-wm0-f44.google.com (mail-wm0-f44.google.com [74.125.82.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id BF492178B; Mon, 22 May 2017 00:00:11 +0000 (UTC) (envelope-from cse.cem@gmail.com) Received: by mail-wm0-f44.google.com with SMTP id d127so131870311wmf.0; Sun, 21 May 2017 17:00:11 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:in-reply-to:references :from:date:message-id:subject:to:cc; bh=Leu/A6DTSZfKrpzRZ+lcUyrGk3+9X4A94zsjKLxspGs=; b=TVY3gyJj/0xJOnoQG55WSDoyVMsmgFptOQOIXmEarCYSwm7baTjtj73feAn8NhIM3v r64r1nl2M+R0iHQIu3s1Whl6RKhQ1M3rSCPB/ZxEaEDMiVRzF7B1rBFkYFCrxozAMJp/ KSCp7MjMnI9XrDEORi5NJ00FJHr0tmunzykzVZgVgvGaz3rJyj7yc0ESroYMyY4IerVn j2JQybxE9x2CEuyGNrMjjxb5Ol9FT/icGSEZtEhnaY+yxnr/D6G+qTCqrmFa9wQ3hcLn yUqw8WlPkkN4WHjb91+3Tgn4I+f3uIm/PuhtopJxcUf/rPWHoLBypWnr2nD8HBd66Uuo HDKw== X-Gm-Message-State: AODbwcCsIaeXuOyR3dQFCe4nlzyPzSYW6b7L6QR4C5buD6DB1iEMtX6v nAwfGllCcMqzpQ== X-Received: by 10.223.164.81 with SMTP id e17mr8910200wra.133.1495410714666; Sun, 21 May 2017 16:51:54 -0700 (PDT) Received: from mail-wm0-f44.google.com (mail-wm0-f44.google.com. [74.125.82.44]) by smtp.gmail.com with ESMTPSA id j44sm6560273wre.67.2017.05.21.16.51.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 21 May 2017 16:51:54 -0700 (PDT) Received: by mail-wm0-f44.google.com with SMTP id 7so45697444wmo.1; Sun, 21 May 2017 16:51:53 -0700 (PDT) X-Received: by 10.80.184.117 with SMTP id k50mr15386803ede.113.1495410713873; Sun, 21 May 2017 16:51:53 -0700 (PDT) MIME-Version: 1.0 Reply-To: cem@freebsd.org Received: by 10.80.169.4 with HTTP; Sun, 21 May 2017 16:51:53 -0700 (PDT) In-Reply-To: References: <6f6b47ed-84e0-e4c0-9df5-350620cff45b@metricspace.net> <20170327183735.uokjhjaafkawc2id@mutt-hbsd> From: Conrad Meyer Date: Sun, 21 May 2017 16:51:53 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: Proposal for a design for signed kernel/modules/etc To: Eric McCorkle Cc: "freebsd-hackers@freebsd.org" , freebsd-security@freebsd.org Content-Type: text/plain; charset="UTF-8" X-Mailman-Approved-At: Mon, 22 May 2017 02:27:59 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 May 2017 00:00:12 -0000 Hi Eric, On Wed, Mar 29, 2017 at 7:22 PM, Eric McCorkle wrote: >... > == Specifics == > >... > > * A signed ELF will definitely contain a .sign section containing a > single detached signature in PKCS#7 format with DER encoding. I'm concerned about the complexity of parsing PKCS#7 (including ASN.1) in places that need to validate signed objects. In particular, the kernel (for runtime-loaded objects). Complex parsers are a common source of security bugs, so PKCS#7 doesn't seem like a good fit for security-critical code like the kernel syscall interface. Could a more minimal format take the place of PKCS#7 in .sign sections? Thanks, Conrad