From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web12.97.1634921439990389835 for ; Fri, 22 Oct 2021 09:50:40 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ibm.com header.s=pp1 header.b=aGFNe52H; spf=pass (domain: linux.ibm.com, ip: 148.163.158.5, mailfrom: jejb@linux.ibm.com) Received: from pps.filterd (m0098416.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 19MFmTjT005696; Fri, 22 Oct 2021 12:50:38 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=message-id : subject : from : reply-to : to : cc : date : in-reply-to : references : content-type : mime-version : content-transfer-encoding; s=pp1; bh=Gvay82HE8X7gq0a7fyQPqEHVvf4PxwkUR4lSadvSYyU=; b=aGFNe52HXBq37JVpnNjlSUTPEUZOQIGVVX5ooQS0Bpr2fnuMaj58O0EK1HmPcnVOFWg8 4M3nsorQpTtuXz4WPQlWgyvWksgSe+lQsgso3+7SN5pOPxRf87tPAG5/z5D2N9ZZ2crw B5TuzO0PDpDdDrbZ/qyNBNX4Htby631x3jq6qPUJgIq5S5dFQsanvEn6hZRuzeZsD5RY OlLojjqYj9q99x0AIpkiFzj/VSGxuPokllFmf4GfyTqfqs5YyoYwDwiIxoabqHmB3G4g OBBrz57fYhVJ4iOzI/ydQTG/EdUisl9wco+sidNX71k2hUxQB3XCHmlODesOt1+N30YF 0Q== Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-001b2d01.pphosted.com with ESMTP id 3bv090s5y0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 22 Oct 2021 12:50:37 -0400 Received: from m0098416.ppops.net (m0098416.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 19MGEOT2020029; Fri, 22 Oct 2021 12:50:37 -0400 Received: from ppma02dal.us.ibm.com (a.bd.3ea9.ip4.static.sl-reverse.com [169.62.189.10]) by mx0b-001b2d01.pphosted.com with ESMTP id 3bv090s5xs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 22 Oct 2021 12:50:37 -0400 Received: from pps.filterd (ppma02dal.us.ibm.com [127.0.0.1]) by ppma02dal.us.ibm.com (8.16.1.2/8.16.1.2) with SMTP id 19MGjOQl006576; Fri, 22 Oct 2021 16:50:36 GMT Received: from b03cxnp08025.gho.boulder.ibm.com (b03cxnp08025.gho.boulder.ibm.com [9.17.130.17]) by ppma02dal.us.ibm.com with ESMTP id 3bqpce5wbg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 22 Oct 2021 16:50:36 +0000 Received: from b03ledav004.gho.boulder.ibm.com (b03ledav004.gho.boulder.ibm.com [9.17.130.235]) by b03cxnp08025.gho.boulder.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 19MGoZJ536372748 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 22 Oct 2021 16:50:35 GMT Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 2FD437806A; Fri, 22 Oct 2021 16:50:35 +0000 (GMT) Received: from b03ledav004.gho.boulder.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CFF527805E; Fri, 22 Oct 2021 16:50:33 +0000 (GMT) Received: from jarvis.int.hansenpartnership.com (unknown [9.211.92.132]) by b03ledav004.gho.boulder.ibm.com (Postfix) with ESMTP; Fri, 22 Oct 2021 16:50:33 +0000 (GMT) Message-ID: Subject: Re: [edk2-devel] [PATCH 4/4] OvmfPkg: add TPM2_SHA1_ENABLE build option From: "James Bottomley" Reply-To: jejb@linux.ibm.com To: Stefan Berger , devel@edk2.groups.io, Gerd Hoffmann Cc: Min Xu , Jordan Justen , Erdem Aktas , Ard Biesheuvel , =?ISO-8859-1?Q?Marc-Andr=E9?= Lureau , Jiewen Yao , Tom Lendacky , Brijesh Singh Date: Fri, 22 Oct 2021 12:50:32 -0400 In-Reply-To: <4e216f5f-edd8-61c3-529b-54eab3abf00a@linux.ibm.com> References: <20211021122003.2008499-1-kraxel@redhat.com> <20211021122003.2008499-5-kraxel@redhat.com> <03a75199-000f-5575-8898-6d9b113f2bee@linux.ibm.com> <20211022063948.mratwrzgponwiulg@sirius.home.kraxel.org> <46963c6b6e0eea2bf0b3629031f6f04232ea7528.camel@linux.ibm.com> <84d94886-bc85-9b98-6c7e-59207e6ea741@linux.ibm.com> <5fa198e0c4df2436ebbbe01cc8ebad4062e679b5.camel@linux.ibm.com> <4e216f5f-edd8-61c3-529b-54eab3abf00a@linux.ibm.com> User-Agent: Evolution 3.34.4 MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 8E8-MjTM25Ts_q9ET9DLcIcG3DeLpZ8Z X-Proofpoint-GUID: 9M7u__3PB5rpYiPonl4gmo8JEbJ0pVq9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.182.1,Aquarius:18.0.790,Hydra:6.0.425,FMLib:17.0.607.475 definitions=2021-10-22_04,2021-10-22_01,2020-04-07_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 mlxscore=0 lowpriorityscore=0 phishscore=0 priorityscore=1501 malwarescore=0 mlxlogscore=928 adultscore=0 bulkscore=0 clxscore=1015 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109230001 definitions=main-2110220095 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit On Fri, 2021-10-22 at 11:48 -0400, Stefan Berger wrote: > On 10/22/21 11:01 AM, James Bottomley wrote: > > On Fri, 2021-10-22 at 10:52 -0400, Stefan Berger wrote: > > > > > along with the quote on the sha1 bank. > > The validator shouldn't accept that quote ... it should require a > > quote covering all banks. This is the point: you can't fake the > > quote and the quote should cover all banks to assure you that > > unextended banks really are. > > Unfortunately this seems to be flawed on the TPM2_Quote level... In what way? James