mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
78b053326c
Remove the DigiCert root CA pinning. The root CA used for the chain of trust can change in the future therefore let's remove this check. If someone wants to enforce the usage of a specific root CA it can be selected by the genprotimg command line option `--root-ca $CA`. Make it transparent to the user which root CA is actually being used by printing the subject name of the root CA to stdout in verbose mode. Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com> Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com> Reviewed-and-tested-by: Nico Boehr <nrb@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
41 lines
1.1 KiB
C
41 lines
1.1 KiB
C
/*
|
|
* PV cryptography related definitions
|
|
*
|
|
* Copyright IBM Corp. 2020
|
|
*
|
|
* s390-tools is free software; you can redistribute it and/or modify
|
|
* it under the terms of the MIT license. See LICENSE for details.
|
|
*/
|
|
|
|
#ifndef PV_CRYPTO_DEF_H
|
|
#define PV_CRYPTO_DEF_H
|
|
|
|
#include <stdint.h>
|
|
|
|
#include "lib/zt_common.h"
|
|
|
|
/* IBM signing key subject */
|
|
#define PV_IBM_Z_SUBJECT_COMMON_NAME "International Business Machines Corporation"
|
|
#define PV_IBM_Z_SUBJECT_COUNTRY_NAME "US"
|
|
#define PV_IBM_Z_SUBJECT_LOCALITY_NAME "Poughkeepsie"
|
|
#define PV_IBM_Z_SUBJECT_ORGANIZATIONONAL_UNIT_NAME_SUFFIX "Key Signing Service"
|
|
#define PV_IBM_Z_SUBJECT_ORGANIZATION_NAME "International Business Machines Corporation"
|
|
#define PV_IBM_Z_SUBJECT_STATE "New York"
|
|
#define PV_IMB_Z_SUBJECT_ENTRY_COUNT 6
|
|
|
|
/* Minimum security level for the keys/certificates used to establish a chain of
|
|
* trust (see https://www.openssl.org/docs/man1.1.1/man3/X509_VERIFY_PARAM_set_auth_level.html
|
|
* for details).
|
|
*/
|
|
#define PV_CERTS_SECURITY_LEVEL 2
|
|
|
|
union ecdh_pub_key {
|
|
struct {
|
|
uint8_t x[80];
|
|
uint8_t y[80];
|
|
};
|
|
uint8_t data[160];
|
|
} __packed;
|
|
|
|
#endif
|