mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
d14e7593cc
New IBM signing certificates will have 'Armonk' as locality in the subject. Make sure that certificate revocations lists (CRL) with 'Poughkeepsie' as issuer locality are still considered as valid as long as they are signed with the IBM signing keys private key. In addition, drop the check for 'issuer(HKD) == subject(HKSK)' as it doesn't improve security. While at it, remove now unused functions and fix a memory leak of @akid in `check_crl_issuer`. Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
42 lines
1.2 KiB
C
42 lines
1.2 KiB
C
/*
|
|
* PV cryptography related definitions
|
|
*
|
|
* Copyright IBM Corp. 2020
|
|
*
|
|
* s390-tools is free software; you can redistribute it and/or modify
|
|
* it under the terms of the MIT license. See LICENSE for details.
|
|
*/
|
|
|
|
#ifndef PV_CRYPTO_DEF_H
|
|
#define PV_CRYPTO_DEF_H
|
|
|
|
#include <stdint.h>
|
|
|
|
#include "lib/zt_common.h"
|
|
|
|
/* IBM signing key subject */
|
|
#define PV_IBM_Z_SUBJECT_COMMON_NAME "International Business Machines Corporation"
|
|
#define PV_IBM_Z_SUBJECT_COUNTRY_NAME "US"
|
|
#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_POUGHKEEPSIE "Poughkeepsie"
|
|
#define PV_IBM_Z_SUBJECT_LOCALITY_NAME_ARMONK "Armonk"
|
|
#define PV_IBM_Z_SUBJECT_ORGANIZATIONONAL_UNIT_NAME_SUFFIX "Key Signing Service"
|
|
#define PV_IBM_Z_SUBJECT_ORGANIZATION_NAME "International Business Machines Corporation"
|
|
#define PV_IBM_Z_SUBJECT_STATE "New York"
|
|
#define PV_IMB_Z_SUBJECT_ENTRY_COUNT 6
|
|
|
|
/* Minimum security level for the keys/certificates used to establish a chain of
|
|
* trust (see https://www.openssl.org/docs/man1.1.1/man3/X509_VERIFY_PARAM_set_auth_level.html
|
|
* for details).
|
|
*/
|
|
#define PV_CERTS_SECURITY_LEVEL 2
|
|
|
|
union ecdh_pub_key {
|
|
struct {
|
|
uint8_t x[80];
|
|
uint8_t y[80];
|
|
};
|
|
uint8_t data[160];
|
|
} __packed;
|
|
|
|
#endif
|