linux-kernel - Re: [PATCH 0/3] trusted-keys: Add support for protected keys using CAAM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5fa818597020992de54f7911533fcabfc4844629.camel@nxp.com>
Date: Tue, 14 Oct 2025 08:56:35 +0000
From: Horia Geanta <horia.geanta@....com>
To: Gaurav Jain <gaurav.jain@....com>, Meenakshi Aggarwal
	<meenakshi.aggarwal@....com>, Varun Sethi <V.Sethi@....com>, Pankaj Gupta
	<pankaj.gupta@....com>, "herbert@...dor.apana.org.au"
	<herbert@...dor.apana.org.au>
CC: "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 0/3] trusted-keys: Add support for protected keys using
 CAAM

On Mon, 2025-10-06 at 09:17 +0200, meenakshi.aggarwal@....com wrote:
> From: Meenakshi Aggarwal <meenakshi.aggarwal@....com>
> 
> Overview:
> This patch set adds:
> - Support for creating and loading protected keys via `keyctl`
> interface.
> - Documentation updates to describe protected key usage and options.
> - CAAM-specific implementation for protected key encryption
> algorithms.
> 
> User can create protected/encrypted key using keyctl interface:
> 
> KEYNAME=dm_trust_key_hw
> KEY="$(keyctl add trusted $KEYNAME 'new 32 pk key_enc_algo=1' @s)"
> keyctl pipe $KEY >~/$KEYNAME.blob
> keyctl list @s
> 
> dm-crypt can load the protected key buffer from the keyring and use
> it to
> initialize encrypted volumes, ensuring that key material is never
> exposed in plaintext.
> 
> The Protected key buffer is passed to the CAAM driver via the kernel
> crypto API.
> CAAM driver will decapsulate the protected key buffer and perform
> cipher operation.
> 
AFAICS, the algorithms implemented in caam driver are still marked with
CRYPTO_ALG_ALLOCATES_MEMORY.

Thus, I am wondering if currently dm-crypt is really a use case for
"protected keys" having CAAM as backend.

Thanks,
Horia