linux-kernel - Re: [PATCH v2 00/10] Encrypted Hibernation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Sep 2022 15:52:30 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Evan Green <evgreen@...omium.org>
Cc:     linux-kernel@...r.kernel.org, gwendal@...omium.org,
        Eric Biggers <ebiggers@...nel.org>,
        Matthew Garrett <mgarrett@...ora.tech>, jarkko@...nel.org,
        zohar@...ux.ibm.com, linux-integrity@...r.kernel.org,
        Pavel Machek <pavel@....cz>, apronin@...omium.org,
        dlunev@...gle.com, rjw@...ysocki.net, linux-pm@...r.kernel.org,
        corbet@....net, jejb@...ux.ibm.com,
        David Howells <dhowells@...hat.com>,
        Hao Wu <hao.wu@...rik.com>, James Morris <jmorris@...ei.org>,
        Jason Gunthorpe <jgg@...pe.ca>,
        Len Brown <len.brown@...el.com>,
        Matthew Garrett <matthewgarrett@...gle.com>,
        Paul Moore <paul@...l-moore.com>,
        Peter Huewe <peterhuewe@....de>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        "Serge E. Hallyn" <serge@...lyn.com>, axelj <axelj@...s.com>,
        keyrings@...r.kernel.org, linux-doc@...r.kernel.org,
        linux-security-module@...r.kernel.org
Subject: Re: [PATCH v2 00/10] Encrypted Hibernation

On Tue, Aug 23, 2022 at 03:25:16PM -0700, Evan Green wrote:
> This series adopts that primitive as a foundation, tweaking and building
> on it a bit. Where Matthew's series used the TPM-backed key to encrypt a
> hash of the image, this series uses the key directly as a gcm(aes)
> encryption key, which the kernel uses to encrypt and decrypt the
> hibernate image in chunks of 16 pages. This provides both encryption and
> integrity, which turns out to be a noticeable performance improvement over
> separate passes for encryption and hashing.

I like this series! I would ask that someone more familiar with the
cryptographic constraints here confirm that the primitives you're using
are going to actually provide you the constraints you want (i.e.
encryption, integrity, etc). My understanding is that gcm(aes) is
exactly right, but I Am Not A Cryptographer. ;)

I'll reply more to individual patches ...

-- 
Kees Cook