mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
selftests/sgx: Use a statically generated 3072-bit RSA key
Use a statically generated key for signing the enclave, because generating keys on the fly can eat the kernel entropy pool. Another good reason for doing this is predictable builds. The RSA has been arbitrarily selected. It's contents do not matter. This also makes the selftest execute a lot quicker instead of the delay that it had before (because of slow key generation). [ bp: Disambiguate "static key" which means something else in the kernel, fix typos. ] Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Borislav Petkov <bp@suse.de> Cc: linux-kselftest@vger.kernel.org Link: https://lkml.kernel.org/r/20201118170640.39629-1-jarkko@kernel.org
This commit is contained in:
parent
67655b57f8
commit
0eaa8d153a
|
@ -25,7 +25,8 @@ endif
|
|||
$(OUTPUT)/test_sgx: $(OUTPUT)/main.o \
|
||||
$(OUTPUT)/load.o \
|
||||
$(OUTPUT)/sigstruct.o \
|
||||
$(OUTPUT)/call.o
|
||||
$(OUTPUT)/call.o \
|
||||
$(OUTPUT)/sign_key.o
|
||||
$(CC) $(HOST_CFLAGS) -o $@ $^ -lcrypto
|
||||
|
||||
$(OUTPUT)/main.o: main.c
|
||||
|
@ -40,6 +41,9 @@ $(OUTPUT)/sigstruct.o: sigstruct.c
|
|||
$(OUTPUT)/call.o: call.S
|
||||
$(CC) $(HOST_CFLAGS) -c $< -o $@
|
||||
|
||||
$(OUTPUT)/sign_key.o: sign_key.S
|
||||
$(CC) $(HOST_CFLAGS) -c $< -o $@
|
||||
|
||||
$(OUTPUT)/test_encl.elf: test_encl.lds test_encl.c test_encl_bootstrap.S
|
||||
$(CC) $(ENCL_CFLAGS) -T $^ -o $@
|
||||
|
||||
|
|
|
@ -27,6 +27,9 @@ struct encl {
|
|||
struct sgx_sigstruct sigstruct;
|
||||
};
|
||||
|
||||
extern unsigned char sign_key[];
|
||||
extern unsigned char sign_key_end[];
|
||||
|
||||
void encl_delete(struct encl *ctx);
|
||||
bool encl_load(const char *path, struct encl *encl);
|
||||
bool encl_measure(struct encl *encl);
|
||||
|
|
12
tools/testing/selftests/sgx/sign_key.S
Normal file
12
tools/testing/selftests/sgx/sign_key.S
Normal file
|
@ -0,0 +1,12 @@
|
|||
/* SPDX-License-Identifier: GPL-2.0 */
|
||||
/**
|
||||
* Copyright(c) 2016-20 Intel Corporation.
|
||||
*/
|
||||
|
||||
.section ".rodata", "a"
|
||||
|
||||
sign_key:
|
||||
.globl sign_key
|
||||
.incbin "sign_key.pem"
|
||||
sign_key_end:
|
||||
.globl sign_key_end
|
39
tools/testing/selftests/sgx/sign_key.pem
Normal file
39
tools/testing/selftests/sgx/sign_key.pem
Normal file
|
@ -0,0 +1,39 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIG4wIBAAKCAYEApalGbq7Q+usM91CPtksu3D+b0Prc8gAFL6grM3mg85A5Bx8V
|
||||
cfMXPgtrw8EYFwQxDAvzZWwl+9VfOX0ECrFRBkOHcOiG0SnADN8+FLj1UiNUQwbp
|
||||
S6OzhNWuRcSbGraSOyUlVlV0yMQSvewyzGklOaXBe30AJqzIBc8QfdSxKuP8rs0Z
|
||||
ga6k/Bl73osrYKByILJTUUeZqjLERsE6GebsdzbWgKn8qVqng4ZS4yMNg6LeRlH3
|
||||
+9CIPgg4jwpSLHcp7dq2qTIB9a0tGe9ayp+5FbucpB6U7ePold0EeRN6RlJGDF9k
|
||||
L93v8P5ykz5G5gYZ2g0K1X2sHIWV4huxPgv5PXgdyQYbK+6olqj0d5rjYuwX57Ul
|
||||
k6SroPS1U6UbdCjG5txM+BNGU0VpD0ZhrIRw0leQdnNcCO9sTJuInZrgYacSVJ7u
|
||||
mtB+uCt+uzUesc+l+xPRYA+9e14lLkZp7AAmo9FvL816XDI09deehJ3i/LmHKCRN
|
||||
tuqC5TprRjFwUr6dAgEDAoIBgG5w2Z8fNfycs0+LCnmHdJLVEotR6KFVWMpwHMz7
|
||||
wKJgJgS/Y6FMuilc8oKAuroCy11dTO5IGVKOP3uorVx2NgQtBPXwWeDGgAiU1A3Q
|
||||
o4wXjYIEm4fCd63jyYPYZ2ckYXzDbjmOTdstYdPyzIhGGNEZK6eoqsRzMAPfYFPj
|
||||
IMdCqHSIu6vJw1K7p+myHOsVoWshjODaZnF3LYSA0WaZ8vokjwBxUxuRxQJZjJds
|
||||
s60XPtmL+qfgWtQFewoG4XL6GuD8FcXccynRRtzrLtFNPIl9BQfWfjBBhTC1/Te1
|
||||
0Z6XbZvpdUTD9OfLB7SbR2OUFNpKQgriO0iYVdbW3cr7uu38Zwp4W1TX73DPjoi6
|
||||
KNooP6SGWd4mRJW2+dUmSYS4QNG8eVVZswKcploEIXlAKRsOe4kzJJ1iETugIe85
|
||||
uX8nd1WYEp65xwoRUg8hqng0MeyveVbXqNKuJG6tzNDt9kgFYo+hmC/oouAW2Dtc
|
||||
T9jdRAwKJXqA2Eg6OkgXCEv+kwKBwQDYaQiFMlFhsmLlqI+EzCUh7c941/cL7m6U
|
||||
7j98+8ngl0HgCEcrc10iJVCKakQW3YbPzAx3XkKTaGjWazvvrFarXIGlOud64B8a
|
||||
iWyQ7VdlnmZnNEdk+C83tI91OQeaTKqRLDGzKh29Ry/jL8Pcbazt+kDgxa0H7qJp
|
||||
roADUanLQuNkYubpbhFBh3xpa2EExaVq6rF7nIVsD8W9TrbmPKA4LgH7z0iy544D
|
||||
kVCNYsTjYDdUWP+WiSor8kCnnpjnN9sCgcEAw/eNezUD1UDf6OYFC9+5JZJFn4Tg
|
||||
mZMyN93JKIb199ffwnjtHUSjcyiWeesXucpzwtGbTcwQnDisSW4oneYKLSEBlBaq
|
||||
scqiUugyGZZOthFSCbdXYXMViK2vHrKlkse7GxVlROKcEhM/pRBrmjaGO8eWR+D4
|
||||
FO2wCXzVs3KgV6j779frw0vC54oHOxc9+Lu1rSHp4i+600koyvL/zF6U/5tZXIvN
|
||||
YW2yoiQJnjCmVA1pwbwV6KAUTPDTMnBK+YjnAoHBAJBGBa4hi5Z27JkbCliIGMFJ
|
||||
NPs6pLKe9GNJf6in2+sPgUAFhMeiPhbDiwbxgrnpBIqICE+ULGJFmzmc0p/IOceT
|
||||
ARjR76dAFLxbnbXzj5kURETNhO36yiUjCk4mBRGIcbYddndxaSjaH+zKgpLzyJ6m
|
||||
1esuc1qfFvEfAAI2cTIsl5hB70ZJYNZaUvDyQK3ZGPHxy6e9rkgKg9OJz0QoatAe
|
||||
q/002yHvtAJg4F5B2JeVejg7VQ8GHB1MKxppu0TP5wKBwQCCpQj8zgKOKz/wmViy
|
||||
lSYZDC5qWJW7t3bP6TDFr06lOpUsUJ4TgxeiGw778g/RMaKB4RIz3WBoJcgw9BsT
|
||||
7rFza1ZiucchMcGMmswRDt8kC4wGejpA92Owc8oUdxkMhSdnY5jYlxK2t3/DYEe8
|
||||
JFl9L7mFQKVjSSAGUzkiTGrlG1Kf5UfXh9dFBq98uilQfSPIwUaWynyM23CHTKqI
|
||||
Pw3/vOY9sojrnncWwrEUIG7is5vWfWPwargzSzd29YdRBe8CgcEAuRVewK/YeNOX
|
||||
B7ZG6gKKsfsvrGtY7FPETzLZAHjoVXYNea4LVZ2kn4hBXXlvw/4HD+YqcTt4wmif
|
||||
5JQlDvjNobUiKJZpzy7hklVhF7wZFl4pCF7Yh43q9iQ7gKTaeUG7MiaK+G8Zz8aY
|
||||
HW9rsiihbdZkccMvnPfO9334XMxl3HtBRzLstjUlbLB7Sdh+7tZ3JQidCOFNs5pE
|
||||
XyWwnASPu4tKfDahH1UUTp1uJcq/6716CSWg080avYxFcn75qqsb
|
||||
-----END RSA PRIVATE KEY-----
|
|
@ -135,33 +135,21 @@ static inline const BIGNUM *get_modulus(RSA *key)
|
|||
|
||||
static RSA *gen_sign_key(void)
|
||||
{
|
||||
BIGNUM *e;
|
||||
unsigned long sign_key_length;
|
||||
BIO *bio;
|
||||
RSA *key;
|
||||
int ret;
|
||||
|
||||
e = BN_new();
|
||||
key = RSA_new();
|
||||
sign_key_length = (unsigned long)&sign_key_end -
|
||||
(unsigned long)&sign_key;
|
||||
|
||||
if (!e || !key)
|
||||
goto err;
|
||||
bio = BIO_new_mem_buf(&sign_key, sign_key_length);
|
||||
if (!bio)
|
||||
return NULL;
|
||||
|
||||
ret = BN_set_word(e, RSA_3);
|
||||
if (ret != 1)
|
||||
goto err;
|
||||
|
||||
ret = RSA_generate_key_ex(key, 3072, e, NULL);
|
||||
if (ret != 1)
|
||||
goto err;
|
||||
|
||||
BN_free(e);
|
||||
key = PEM_read_bio_RSAPrivateKey(bio, NULL, NULL, NULL);
|
||||
BIO_free(bio);
|
||||
|
||||
return key;
|
||||
|
||||
err:
|
||||
RSA_free(key);
|
||||
BN_free(e);
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
static void reverse_bytes(void *data, int length)
|
||||
|
@ -339,8 +327,10 @@ bool encl_measure(struct encl *encl)
|
|||
goto err;
|
||||
|
||||
key = gen_sign_key();
|
||||
if (!key)
|
||||
if (!key) {
|
||||
ERR_print_errors_fp(stdout);
|
||||
goto err;
|
||||
}
|
||||
|
||||
BN_bn2bin(get_modulus(key), sigstruct->modulus);
|
||||
|
||||
|
|
Loading…
Reference in a new issue