linux-kernel - Re: [RFC PATCH 1/1] crypto: af_alg - Support symmetric encryption via keyring keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 11 Oct 2022 16:07:27 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     Frederick Lawler <fred@...udflare.com>
Cc:     herbert@...dor.apana.org.au, davem@...emloft.net, hch@....de,
        smueller@...onox.de, linux-kernel@...r.kernel.org,
        linux-crypto@...r.kernel.org, kernel-team@...udflare.com,
        Ondrej Mosnacek <omosnace@...hat.com>
Subject: Re: [RFC PATCH 1/1] crypto: af_alg - Support symmetric encryption
 via keyring keys

Hi Frederick,

On Tue, Oct 04, 2022 at 04:29:27PM -0500, Frederick Lawler wrote:
> We want to leverage keyring to store sensitive keys, and then use those
> keys for symmetric encryption via the crypto API. Among the key types we
> wish to support are: user, logon, encrypted, and trusted.
> 
> User key types are already able to have their data copied to user space,
> but logon does not support this. Further, trusted and encrypted keys will
> return their encrypted data back to user space on read, which make them not
> ideal for symmetric encryption.
> 
> To support symmetric encryption for these key types, add a new
> ALG_SET_KEY_BY_KEY_SERIAL setsockopt() option to the crypto API. This
> allows users to pass a key_serial_t to the crypto API to perform
> symmetric encryption. The behavior is the same as ALG_SET_KEY, but
> the crypto key data is copied in kernel space from a keyring key,
> which allows for the support of logon, encrypted, and trusted key types.
> 
> Keyring keys must have the KEY_(POS|USR|GRP|OTH)_SEARCH permission set
> to leverage this feature. This follows the asymmetric_key type where key
> lookup calls eventually lead to keyring_search_rcu() without the
> KEYRING_SEARCH_NO_CHECK_PERM flag set.
> 
> Signed-off-by: Frederick Lawler <fred@...udflare.com>

There was a similar patch several years ago by Ondrej Mosnacek:
https://lore.kernel.org/linux-crypto/20190521100034.9651-1-omosnace@redhat.com/T/#u

Have you addressed all the feedback that was raised on that one?

Two random nits below:

> +	*dest_len = key->datalen;
> +	*dest = kmalloc(*dest_len, GFP_KERNEL);
> +	if (!*dest)
> +		return -ENOMEM;
> +
> +	memcpy(*dest, ukp->data, *dest_len);

This should use kmemdup().

> +	} else if (IS_ENABLED(CONFIG_ENCRYPTED_KEYS) &&
> +			   !strcmp(key->type->name, "encrypted")) {
> +		read_key = &read_key_type_encrypted;
> +	} else if (IS_ENABLED(CONFIG_TRUSTED_KEYS) &&
> +			   !strcmp(key->type->name, "trusted")) {
> +		read_key = &read_key_type_trusted;

These need to use IS_REACHABLE(), not IS_ENABLED().

- Eric