The main purpose behind the creation of this module was to create the
cryptographic infrastructure to develop an in-kernel system of signed
modules.
The best environment to deploy such functionality is in updating by remote,
executable code (programs, libs and modules) on embedded devices running
Linux, that have some form of kernel physical security, so one can't
tamper the
kernel, but can read it. In this case only a public key would be
revealed. The
vendor of the devices can sign and distribute/update executable code to
the devices,
and the kernel will not load/run any of them if they don't match with
their signatures.
The signature can be embedded in the elf, so this system is portable and
centralized.
Although this functionality can be achieved using userland helper
programs this may
create the need to physically secure entire filesystems which adds to
the cost of
developing such devices. In such cases one needs to use asymmetric
cryptography
because in the case of symmetric it would be very easy to give away the
key and
end with having all your devices being attacked.
There are already some systems that implement and utilize such
functionality that
use windows platforms, and other Linux distros that use userland
programs to do
so, assuming physical security of the host computer.
Moreover a same system that would use hashes is easier to brake and more
difficult
to update each time new code must be loaded to the host devices.
See also this thread
http://lkml.org/lkml/2007/3/19/447
-
