於 四，2013-09-26 於 14:22 +0200，Vojtech Pavlik 提到：
On Thu, Sep 26, 2013 at 02:06:21PM +0200, Pavel Machek wrote:
For the symmetric key solution, I will try HMAC (Hash Message Authentication Code). It's already used in networking, hope the performance is not too bad to a big image.
Kernel already supports crc32 of the hibernation image, you may want to take a look how that is done.
Maybe you want to replace crc32 with cryptographics hash (sha1?) and then use only hash for more crypto? That way speed of whatever crypto you do should not be an issue.
Well, yes, one could skip the CRC when the signing is enabled to gain a little speedup.
In current kernel, CRC is for check the integrity of LZO compressed image, the purpose is different to check the integrity of snapshot image. So, CRC will not in non-compress hibernate or userspace hibernate code path On the other hand, attacker can easily change the CRC code in the header of LZO hibernate image. Thanks a lot! Joey Lee -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-kernel+owner@opensuse.org