linux-kernel - Re: [PATCH v4 1/5] crypto: mxs-dcp: Add support for hardware-bound keys

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZVcwPUEbu3Frp61X@gondor.apana.org.au>
Date:   Fri, 17 Nov 2023 17:19:57 +0800
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     David Gstir <david@...ma-star.at>
Cc:     Mimi Zohar <zohar@...ux.ibm.com>,
        James Bottomley <jejb@...ux.ibm.com>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Shawn Guo <shawnguo@...nel.org>,
        Jonathan Corbet <corbet@....net>,
        Sascha Hauer <s.hauer@...gutronix.de>,
        Pengutronix Kernel Team <kernel@...gutronix.de>,
        Fabio Estevam <festevam@...il.com>,
        NXP Linux Team <linux-imx@....com>,
        Ahmad Fatoum <a.fatoum@...gutronix.de>,
        sigma star Kernel Team <upstream+dcp@...ma-star.at>,
        David Howells <dhowells@...hat.com>,
        Li Yang <leoyang.li@....com>, Paul Moore <paul@...l-moore.com>,
        James Morris <jmorris@...ei.org>,
        "Serge E. Hallyn" <serge@...lyn.com>,
        "Paul E. McKenney" <paulmck@...nel.org>,
        Randy Dunlap <rdunlap@...radead.org>,
        Catalin Marinas <catalin.marinas@....com>,
        "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
        Tejun Heo <tj@...nel.org>,
        "Steven Rostedt (Google)" <rostedt@...dmis.org>,
        linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-integrity@...r.kernel.org, keyrings@...r.kernel.org,
        linux-crypto@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linuxppc-dev@...ts.ozlabs.org,
        linux-security-module@...r.kernel.org,
        Richard Weinberger <richard@....at>,
        David Oberhollenzer <david.oberhollenzer@...ma-star.at>
Subject: Re: [PATCH v4 1/5] crypto: mxs-dcp: Add support for hardware-bound
 keys

On Tue, Oct 24, 2023 at 06:20:15PM +0200, David Gstir wrote:
> DCP is capable of performing AES with two hardware-bound keys:
> 
> - The one-time programmable (OTP) key which is burnt via on-chip fuses
> - The unique key (UK) which is derived from the OTP key
> 
> In addition to the two hardware-bound keys, DCP also supports
> storing keys in 4 dedicated key slots within its secure memory area
> (internal SRAM).
> 
> These keys are not stored in main memory and are therefore
> not directly accessible by the operating system. To use them
> for AES operations, a one-byte key reference has to supplied
> with the DCP operation descriptor in the control register.
> 
> This adds support for using any of these 6 keys through the crypto API
> via their key reference after they have been set up. The main purpose
> is to add support for DCP-backed trusted keys. Other use cases are
> possible too (see similar existing paes implementations), but these
> should carefully be evaluated as e.g. enabling AF_ALG will give
> userspace full access to use keys. In scenarios with untrustworthy
> userspace, this will enable en-/decryption oracles.
> 
> Co-developed-by: Richard Weinberger <richard@....at>
> Signed-off-by: Richard Weinberger <richard@....at>
> Co-developed-by: David Oberhollenzer <david.oberhollenzer@...ma-star.at>
> Signed-off-by: David Oberhollenzer <david.oberhollenzer@...ma-star.at>
> Signed-off-by: David Gstir <david@...ma-star.at>
> ---
>  drivers/crypto/mxs-dcp.c | 104 ++++++++++++++++++++++++++++++++++-----
>  include/soc/fsl/dcp.h    |  17 +++++++
>  2 files changed, 110 insertions(+), 11 deletions(-)
>  create mode 100644 include/soc/fsl/dcp.h

Acked-by: Herbert Xu <herbert@...dor.apana.org.au>
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt