RE: [PATCH RESEND 1/1] crypto API: RSA algorithm patch (kernel version 2.6.20.1)

["David Schwartz" <davids@webmaster.com>]

> If you can't read protect your kernel, you can't write protect it
> either.

This is so misleading as to basically be false.

It is true that any security scheme that can prevent people from taking
money out of my account can also prevent people from putting money in.
However, the set of people I allow to put money in my account might include
people I don't want to be able to take money out.

As a more concrete counter-example, consider a signed kernel module that I
wish to publically distribute. I can't stop anyone from reading it. I can
certainly keep people from changing the copy running on my machine.

Your point is not even valid about keys residing in RAM. There are perfectly
sensible scenarios in which the same key needs to be in several different
places, some very secure, some not so. Using a symettric key means that the
securest use can be compromised by a break of the least-secure use. Consider
data that is signed by the kernel and verified by a user-space program.

DS