Re: [PATCH v5 1/4] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-28 Thread Eric Snowberg
> On Jan 28, 2021, at 8:58 AM, David Howells wrote: > > Nayna wrote: > >> Thanks Eric for clarifying. I was confusing it with with the broader meaning >> of revocation i.e. certificate revocation list. To avoid similar confusion in >> the future, I wonder if we should call it as 'blocklist' o

Re: [PATCH v5 1/4] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-28 Thread David Howells
Nayna wrote: > Thanks Eric for clarifying. I was confusing it with with the broader meaning > of revocation i.e. certificate revocation list. To avoid similar confusion in > the future, I wonder if we should call it as 'blocklist' or 'denylist' as > suggested in the document. This is to avoid con

Re: [PATCH v5 1/4] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-28 Thread Nayna
On 1/27/21 11:11 PM, Eric Snowberg wrote: On Jan 27, 2021, at 8:54 PM, Nayna wrote: On 1/22/21 1:10 PM, Eric Snowberg wrote: This fixes CVE-2020-26541. The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEF

Re: [PATCH v5 1/4] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-27 Thread Nayna
On 1/22/21 1:10 PM, Eric Snowberg wrote: This fixes CVE-2020-26541. The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEFI Secure Boot enabled. The dbx is capable of containing any number of EFI_CERT_X509_SHA

Re: [PATCH v5 1/4] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-27 Thread Eric Snowberg
> On Jan 27, 2021, at 8:54 PM, Nayna wrote: > > > On 1/22/21 1:10 PM, Eric Snowberg wrote: >> This fixes CVE-2020-26541. >> >> The Secure Boot Forbidden Signature Database, dbx, contains a list of now >> revoked signatures and keys previously approved to boot with UEFI Secure >> Boot enabled.

[PATCH v5 1/4] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-22 Thread Eric Snowberg
This fixes CVE-2020-26541. The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEFI Secure Boot enabled. The dbx is capable of containing any number of EFI_CERT_X509_SHA256_GUID, EFI_CERT_SHA256_GUID, and EFI_CERT_