linux-kernel - Re: [PATCH v0 6/8] KEYS: trusted: caam based black key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 6 Oct 2022 08:42:32 -0400
From:   Ben Boeckel <me@...boeckel.net>
To:     Pankaj Gupta <pankaj.gupta@....com>
Cc:     jarkko@...nel.org, a.fatoum@...gutronix.de, gilad@...yossef.com,
        Jason@...c4.com, jejb@...ux.ibm.com, zohar@...ux.ibm.com,
        dhowells@...hat.com, sumit.garg@...aro.org, david@...ma-star.at,
        michael@...le.cc, john.ernberg@...ia.se, jmorris@...ei.org,
        serge@...lyn.com, herbert@...dor.apana.org.au, davem@...emloft.net,
        j.luebbe@...gutronix.de, ebiggers@...nel.org, richard@....at,
        keyrings@...r.kernel.org, linux-crypto@...r.kernel.org,
        linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org, sahil.malhotra@....com,
        kshitiz.varshney@....com, horia.geanta@....com, V.Sethi@....com
Subject: Re: [PATCH v0 6/8] KEYS: trusted: caam based black key

On Thu, Oct 06, 2022 at 18:38:35 +0530, Pankaj Gupta wrote:
> - CAAM supports two types of black keys:
>   -- Plain key encrypted with ECB
>   -- Plain key encrypted with CCM

What is a "black key"? Is this described in the documentation or local
comments at all? (I know I'm unfamiliar with CAAM, but maybe this should
be mentioned somewhere?).

>   Note: Due to robustness, default encytption used for black key is CCM.
                                     ^^^^^^^^^^ encryption

What "robustness"? Surely there's some more technical details involved
here?

> - A black key blob is generated, and added to trusted key payload.
>   This is done as part of sealing operation, that was triggered as a result of:
>   -- new key generation
>   -- load key,

It seems that "black keys" are what the uapi calls "hw". I think this
should be mentioned in the commit message (and CAAM docs).

What do other keytypes do if `hw` is requested and it's not possible
(say, `big_key`)?

Thanks,

--Ben