dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-28 06:33:36 +02:00
Code Releases Activity

Update default key sizes and hash to up-to-date values

Browse Source 
Update the documentation and example scripts to use 2048 bit RSA keys
and sha256.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Stefan Berger 2023-04-26 18:35:56 -04:00 committed by Mimi Zohar
parent 31f4a22b57
commit 6e1b9b1521
4 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
README
View File

@ -200,11 +200,11 @@ Generate signing and verification keys
Generate private key in plain text format: Generate private key in plain text format:
openssl genrsa -out privkey_evm.pem 1024 openssl genrsa -out privkey_evm.pem 2048
Generate encrypted private key: Generate encrypted private key:
openssl genrsa -des3 -out privkey_evm.pem 1024 openssl genrsa -des3 -out privkey_evm.pem 2048
Make encrypted private key from unencrypted: Make encrypted private key from unencrypted:
@ -213,7 +213,7 @@ Make encrypted private key from unencrypted:
Generate self-signed X509 public key certificate and private key for using kernel Generate self-signed X509 public key certificate and private key for using kernel
asymmetric keys support: asymmetric keys support:
openssl req -new -nodes -utf8 -sha1 -days 36500 -batch \ openssl req -new -nodes -utf8 -sha256 -days 36500 -batch \
-x509 -config x509_evm.genkey \ -x509 -config x509_evm.genkey \
-outform DER -out x509_evm.der -keyout privkey_evm.pem -outform DER -out x509_evm.der -keyout privkey_evm.pem
@ -221,7 +221,7 @@ Configuration file x509_evm.genkey:
# Beginning of the file # Beginning of the file
[ req ] [ req ]
default_bits = 1024 default_bits = 2048
distinguished_name = req_distinguished_name distinguished_name = req_distinguished_name
prompt = no prompt = no
string_mask = utf8only string_mask = utf8only
@ -292,7 +292,7 @@ Configuration file ima-local-ca.genkey:
Generate private key and X509 public key certificate: Generate private key and X509 public key certificate:
openssl req -new -x509 -utf8 -sha1 -days 3650 -batch -config $GENKEY \ openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \
-outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv -outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv
Produce X509 in DER format for using while building the kernel: Produce X509 in DER format for using while building the kernel:
@ -303,7 +303,7 @@ Configuration file ima.genkey:
# Beginning of the file # Beginning of the file
[ req ] [ req ]
default_bits = 1024 default_bits = 2048
distinguished_name = req_distinguished_name distinguished_name = req_distinguished_name
prompt = no prompt = no
string_mask = utf8only string_mask = utf8only
@ -327,7 +327,7 @@ Configuration file ima.genkey:
Generate private key and X509 public key certificate signing request: Generate private key and X509 public key certificate signing request:
openssl req -new -nodes -utf8 -sha1 -days 365 -batch -config $GENKEY \ openssl req -new -nodes -utf8 -sha256 -days 365 -batch -config $GENKEY \
-out csr_ima.pem -keyout privkey_ima.pem -out csr_ima.pem -keyout privkey_ima.pem
Sign X509 public key certificate signing request with local IMA CA private key: Sign X509 public key certificate signing request with local IMA CA private key:

2
examples/ima-gen-local-ca.sh
View File

@ -22,7 +22,7 @@ authorityKeyIdentifier=keyid:always,issuer
# keyUsage = cRLSign, keyCertSign # keyUsage = cRLSign, keyCertSign
__EOF__ __EOF__
openssl req -new -x509 -utf8 -sha1 -days 3650 -batch -config $GENKEY \ openssl req -new -x509 -utf8 -sha256 -days 3650 -batch -config $GENKEY \
-outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv -outform DER -out ima-local-ca.x509 -keyout ima-local-ca.priv
openssl x509 -inform DER -in ima-local-ca.x509 -out ima-local-ca.pem openssl x509 -inform DER -in ima-local-ca.x509 -out ima-local-ca.pem

4
examples/ima-genkey-self.sh
View File

@ -4,7 +4,7 @@ GENKEY=x509_evm.genkey
cat << __EOF__ >$GENKEY cat << __EOF__ >$GENKEY
[ req ] [ req ]
default_bits = 1024 default_bits = 2048
distinguished_name = req_distinguished_name distinguished_name = req_distinguished_name
prompt = no prompt = no
string_mask = utf8only string_mask = utf8only
@ -22,7 +22,7 @@ subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid authorityKeyIdentifier=keyid
__EOF__ __EOF__
openssl req -x509 -new -nodes -utf8 -sha1 -days 3650 -batch -config $GENKEY \ openssl req -x509 -new -nodes -utf8 -sha256 -days 3650 -batch -config $GENKEY \
-outform DER -out x509_evm.der -keyout privkey_evm.pem -outform DER -out x509_evm.der -keyout privkey_evm.pem
openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem openssl rsa -pubout -in privkey_evm.pem -out pubkey_evm.pem

4
examples/ima-genkey.sh
View File

@ -4,7 +4,7 @@ GENKEY=ima.genkey
cat << __EOF__ >$GENKEY cat << __EOF__ >$GENKEY
[ req ] [ req ]
default_bits = 1024 default_bits = 2048
distinguished_name = req_distinguished_name distinguished_name = req_distinguished_name
prompt = no prompt = no
string_mask = utf8only string_mask = utf8only
@ -25,7 +25,7 @@ authorityKeyIdentifier=keyid
#authorityKeyIdentifier=keyid,issuer #authorityKeyIdentifier=keyid,issuer
__EOF__ __EOF__
openssl req -new -nodes -utf8 -sha1 -days 365 -batch -config $GENKEY \ openssl req -new -nodes -utf8 -sha256 -days 365 -batch -config $GENKEY \
-out csr_ima.pem -keyout privkey_ima.pem -out csr_ima.pem -keyout privkey_ima.pem
openssl x509 -req -in csr_ima.pem -days 365 -extfile $GENKEY -extensions v3_usr \ openssl x509 -req -in csr_ima.pem -days 365 -extfile $GENKEY -extensions v3_usr \
-CA ima-local-ca.pem -CAkey ima-local-ca.priv -CAcreateserial \ -CA ima-local-ca.pem -CAkey ima-local-ca.priv -CAcreateserial \