diff mbox

[RESEND] X.509: Recognize the legacy OID 1.3.14.3.2.29 (sha1WithRSASignature)

Message ID 20170807080151.5313-1-carlo@caione.org (mailing list archive)
State Not Applicable
Delegated to: Herbert Xu
Headers show

Commit Message

Carlo Caione Aug. 7, 2017, 8:01 a.m. UTC 
From: Carlo Caione <carlo@endlessm.com>

We have found some ACER laptops shipping with certificates signed using
the 1.3.14.3.2.29 OID. This is causing the message

   EFI: Problem loading in-kernel X.509 certificate (-65)

to be printed at boot.

This OID is Rivest, Shamir and Adleman (RSA) algorithm that uses the
Secure Hash Algorithm 1 (SHA1) (obsolete), usually referred to as
sha1WithRSASignature.

sha1WithRSASignature is a deprecated equivalent of
sha1WithRSAEncryption. It originates from the NIST Open Systems
Environment (OSE) Implementor's Workshop (OIW).

It is supported for compatibility with Microsoft's certificate APIs
and tools, particularly makecert.exe, which default(ed/s) to this
OID for SHA-1.

We introduce sha1WithRSASignature as new supported OID making it
equivalent to sha1WithRSAEncryption. This is solving the issue when
loading the in-kernel X.509 certificates that can now be correctly read.

Signed-off-by: Carlo Caione <carlo@endlessm.com>
---
 crypto/asymmetric_keys/x509_cert_parser.c | 1 +
 include/linux/oid_registry.h              | 1 +
 2 files changed, 2 insertions(+)

Comments

Carlo Caione Aug. 21, 2017, 7:27 a.m. UTC | #1 
On Mon, Aug 7, 2017 at 10:01 AM, Carlo Caione <carlo@caione.org> wrote:
> From: Carlo Caione <carlo@endlessm.com>
>
> We have found some ACER laptops shipping with certificates signed using
> the 1.3.14.3.2.29 OID. This is causing the message
/cut

Ping on this (literally) two lines patch.
Carlo Caione Sept. 7, 2017, 8:44 a.m. UTC | #2 
On Mon, Aug 21, 2017 at 9:27 AM, Carlo Caione <carlo@caione.org> wrote:
> On Mon, Aug 7, 2017 at 10:01 AM, Carlo Caione <carlo@caione.org> wrote:
>> From: Carlo Caione <carlo@endlessm.com>
>>
>> We have found some ACER laptops shipping with certificates signed using
>> the 1.3.14.3.2.29 OID. This is causing the message
> /cut
>
> Ping on this (literally) two lines patch.

any feedback on this small patch?
diff mbox

Patch

diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
index dd03fead1ca3..cdbc8c2def79 100644
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -203,6 +203,7 @@  int x509_note_pkey_algo(void *context, size_t hdrlen,
 		break;
 
 	case OID_sha1WithRSAEncryption:
+	case OID_sha1WithRSASignature:
 		ctx->cert->sig->hash_algo = "sha1";
 		ctx->cert->sig->pkey_algo = "rsa";
 		break;
diff --git a/include/linux/oid_registry.h b/include/linux/oid_registry.h
index d2fa9ca42e9a..26faee80357f 100644
--- a/include/linux/oid_registry.h
+++ b/include/linux/oid_registry.h
@@ -62,6 +62,7 @@  enum OID {
 
 	OID_certAuthInfoAccess,		/* 1.3.6.1.5.5.7.1.1 */
 	OID_sha1,			/* 1.3.14.3.2.26 */
+	OID_sha1WithRSASignature,	/* 1.3.14.3.2.29 */
 	OID_sha256,			/* 2.16.840.1.101.3.4.2.1 */
 	OID_sha384,			/* 2.16.840.1.101.3.4.2.2 */
 	OID_sha512,			/* 2.16.840.1.101.3.4.2.3 */