Red Hat Bugzilla – Bug 347361
Port kexec-tools to use NSS library for cryptography
Last modified: 2008-03-14 12:41:04 EDT
kexec-tools should be ported to use NSS library for cryptography.
See the tracking bug for details and links on how it could be done.
Not sure why this is open. The only aspect of kdump that uses cryptographic
libraries is ssh/scp. Since we just use those binaries directly, shouldn't this
be assigned over to that component? We'll just pick up that change
No, the bug is open because kexec-tools contains/contained implementation of
SHA-256 hash. What is this hash function used for?
ah, Ok. Its used by the purgatory code in kexec. Purgatory is a section of the
kexec infrastructure that gets run after the initial kernel is shutdown and
before the secondary kernel is booted. It is statically linked into this very
small piece of code to verify the integrity of the secondary kernel before we
boot it. Since we have it around to link with the purgatory code, we also use
it during runtime to generate the sha1 sum for the kernel to be booted on kexec.
We could remove it for that purpose and link against NSS instead, but we'd
still need to keep it around for use by purgatory, since we can't load dso's
there. Unless theres a disposition you would rather see for this bug, I'll call