Bug 347361 - Port kexec-tools to use NSS library for cryptography
Summary: Port kexec-tools to use NSS library for cryptography
Alias: None
Product: Fedora
Classification: Fedora
Component: kexec-tools
Version: rawhide
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Neil Horman
QA Contact: Fedora Extras Quality Assurance
Depends On:
Blocks: CryptoConsolidation
TreeView+ depends on / blocked
Reported: 2007-10-23 10:19 UTC by Peter Vrabec
Modified: 2008-03-14 16:41 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Clone Of:
Last Closed: 2008-03-14 16:41:04 UTC
Type: ---

Attachments (Terms of Use)

Description Peter Vrabec 2007-10-23 10:19:44 UTC
kexec-tools should be ported to use NSS library for cryptography.
See the tracking bug for details and links on how it could be done.

Comment 1 Neil Horman 2008-03-14 13:28:32 UTC
Not sure why this is open.  The only aspect of kdump that uses cryptographic
libraries is ssh/scp.  Since we just use those binaries directly, shouldn't this
be assigned over to that component?  We'll just pick up that change
automatically then.

Comment 2 Tomas Mraz 2008-03-14 13:37:19 UTC
No, the bug is open because kexec-tools contains/contained implementation of
SHA-256 hash. What is this hash function used for?

Comment 3 Neil Horman 2008-03-14 16:41:04 UTC
ah, Ok.  Its used by the purgatory code in kexec.  Purgatory is a section of the
kexec infrastructure that gets run after the initial kernel is shutdown and
before the secondary kernel is booted.  It is statically linked into this very
small piece of code to verify the integrity of the secondary kernel before we
boot it.  Since we have it around to link with the purgatory code, we also use
it during runtime to generate the sha1 sum for the kernel to be booted on kexec.
 We could remove it for that purpose and link against NSS instead, but we'd
still need to keep it around for use by purgatory, since we can't load dso's
there.  Unless theres a disposition you would rather see for this bug, I'll call

Note You need to log in before you can comment on or make changes to this bug.