mirror of
https://github.com/torvalds/linux.git
synced 2026-03-08 01:24:47 +01:00
746b9ef5d5
The x509 public key code gained a dependency on the sha256 hash
implementation, causing a rare link time failure in randconfig
builds:
arm-linux-gnueabi-ld: crypto/asymmetric_keys/x509_public_key.o: in function `x509_get_sig_params':
x509_public_key.c:(.text.x509_get_sig_params+0x12): undefined reference to `sha256'
arm-linux-gnueabi-ld: (sha256): Unknown destination type (ARM/Thumb) in crypto/asymmetric_keys/x509_public_key.o
x509_public_key.c:(.text.x509_get_sig_params+0x12): dangerous relocation: unsupported relocation
Select the necessary library code from Kconfig.
Fixes: 2c62068ac8 ("x509: Separately calculate sha256 for blacklist")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
118 lines
3.9 KiB
Text
118 lines
3.9 KiB
Text
# SPDX-License-Identifier: GPL-2.0
|
|
menuconfig ASYMMETRIC_KEY_TYPE
|
|
bool "Asymmetric (public-key cryptographic) key type"
|
|
depends on KEYS
|
|
help
|
|
This option provides support for a key type that holds the data for
|
|
the asymmetric keys used for public key cryptographic operations such
|
|
as encryption, decryption, signature generation and signature
|
|
verification.
|
|
|
|
if ASYMMETRIC_KEY_TYPE
|
|
|
|
config ASYMMETRIC_PUBLIC_KEY_SUBTYPE
|
|
tristate "Asymmetric public-key crypto algorithm subtype"
|
|
select MPILIB
|
|
select CRYPTO_HASH_INFO
|
|
select CRYPTO_AKCIPHER
|
|
select CRYPTO_SIG
|
|
select CRYPTO_HASH
|
|
help
|
|
This option provides support for asymmetric public key type handling.
|
|
If signature generation and/or verification are to be used,
|
|
appropriate hash algorithms (such as SHA-1) must be available.
|
|
ENOPKG will be reported if the requisite algorithm is unavailable.
|
|
|
|
config X509_CERTIFICATE_PARSER
|
|
tristate "X.509 certificate parser"
|
|
depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
|
|
select ASN1
|
|
select CRYPTO_LIB_SHA256
|
|
select OID_REGISTRY
|
|
help
|
|
This option provides support for parsing X.509 format blobs for key
|
|
data and provides the ability to instantiate a crypto key from a
|
|
public key packet found inside the certificate.
|
|
|
|
config PKCS8_PRIVATE_KEY_PARSER
|
|
tristate "PKCS#8 private key parser"
|
|
depends on ASYMMETRIC_PUBLIC_KEY_SUBTYPE
|
|
select ASN1
|
|
select OID_REGISTRY
|
|
help
|
|
This option provides support for parsing PKCS#8 format blobs for
|
|
private key data and provides the ability to instantiate a crypto key
|
|
from that data.
|
|
|
|
config PKCS7_MESSAGE_PARSER
|
|
tristate "PKCS#7 message parser"
|
|
depends on X509_CERTIFICATE_PARSER
|
|
select CRYPTO_HASH
|
|
select ASN1
|
|
select OID_REGISTRY
|
|
help
|
|
This option provides support for parsing PKCS#7 format messages for
|
|
signature data and provides the ability to verify the signature.
|
|
|
|
config PKCS7_WAIVE_AUTHATTRS_REJECTION_FOR_MLDSA
|
|
bool "Waive rejection of authenticatedAttributes for ML-DSA"
|
|
depends on PKCS7_MESSAGE_PARSER
|
|
depends on CRYPTO_MLDSA
|
|
help
|
|
Due to use of CMS_NOATTR with ML-DSA not being supported in
|
|
OpenSSL < 4.0 (and thus any released version), enabling this
|
|
allows authenticatedAttributes to be used with ML-DSA for
|
|
module signing. Use of authenticatedAttributes in this
|
|
context is normally rejected.
|
|
|
|
config PKCS7_TEST_KEY
|
|
tristate "PKCS#7 testing key type"
|
|
depends on SYSTEM_DATA_VERIFICATION
|
|
help
|
|
This option provides a type of key that can be loaded up from a
|
|
PKCS#7 message - provided the message is signed by a trusted key. If
|
|
it is, the PKCS#7 wrapper is discarded and reading the key returns
|
|
just the payload. If it isn't, adding the key will fail with an
|
|
error.
|
|
|
|
This is intended for testing the PKCS#7 parser.
|
|
|
|
config SIGNED_PE_FILE_VERIFICATION
|
|
bool "Support for PE file signature verification"
|
|
depends on PKCS7_MESSAGE_PARSER=y
|
|
depends on SYSTEM_DATA_VERIFICATION
|
|
select CRYPTO_HASH
|
|
select ASN1
|
|
select OID_REGISTRY
|
|
help
|
|
This option provides support for verifying the signature(s) on a
|
|
signed PE binary.
|
|
|
|
config FIPS_SIGNATURE_SELFTEST
|
|
tristate "Run FIPS selftests on the X.509+PKCS7 signature verification"
|
|
help
|
|
This option causes some selftests to be run on the signature
|
|
verification code, using some built in data. This is required
|
|
for FIPS.
|
|
depends on KEYS
|
|
depends on ASYMMETRIC_KEY_TYPE
|
|
depends on PKCS7_MESSAGE_PARSER=X509_CERTIFICATE_PARSER
|
|
depends on X509_CERTIFICATE_PARSER
|
|
depends on CRYPTO_RSA
|
|
depends on CRYPTO_SHA256
|
|
|
|
config FIPS_SIGNATURE_SELFTEST_RSA
|
|
bool
|
|
default y
|
|
depends on FIPS_SIGNATURE_SELFTEST
|
|
depends on CRYPTO_SHA256=y || CRYPTO_SHA256=FIPS_SIGNATURE_SELFTEST
|
|
depends on CRYPTO_RSA=y || CRYPTO_RSA=FIPS_SIGNATURE_SELFTEST
|
|
|
|
config FIPS_SIGNATURE_SELFTEST_ECDSA
|
|
bool
|
|
default y
|
|
depends on FIPS_SIGNATURE_SELFTEST
|
|
depends on CRYPTO_SHA256=y || CRYPTO_SHA256=FIPS_SIGNATURE_SELFTEST
|
|
depends on CRYPTO_ECDSA=y || CRYPTO_ECDSA=FIPS_SIGNATURE_SELFTEST
|
|
|
|
endif # ASYMMETRIC_KEY_TYPE
|