From: James Bottomley <jejb@linux.ibm.com>
To: Evan Green <evgreen@chromium.org>
Cc: Eric Biggers <ebiggers@kernel.org>,
linux-kernel@vger.kernel.org, corbet@lwn.net,
linux-integrity@vger.kernel.org, gwendal@chromium.org,
dianders@chromium.org, apronin@chromium.org,
Pavel Machek <pavel@ucw.cz>, Ben Boeckel <me@benboeckel.net>,
rjw@rjwysocki.net, Kees Cook <keescook@chromium.org>,
dlunev@google.com, zohar@linux.ibm.com,
Matthew Garrett <mgarrett@aurora.tech>,
jarkko@kernel.org, linux-pm@vger.kernel.org,
David Howells <dhowells@redhat.com>,
James Morris <jmorris@namei.org>,
Paul Moore <paul@paul-moore.com>,
"Serge E. Hallyn" <serge@hallyn.com>,
keyrings@vger.kernel.org, linux-security-module@vger.kernel.org
Subject: Re: [PATCH v5 04/11] security: keys: trusted: Include TPM2 creation data
Date: Fri, 02 Dec 2022 16:03:09 -0500 [thread overview]
Message-ID: <6f66f174af92a9b23bddd72945e94e888b0c9420.camel@linux.ibm.com> (raw)
In-Reply-To: <95ffac38780bf0ec6084cb354bfcb3b7bee686b9.camel@linux.ibm.com>
On Mon, 2022-11-14 at 13:00 -0500, James Bottomley wrote:
> On Mon, 2022-11-14 at 09:43 -0800, Evan Green wrote:
> > On Mon, Nov 14, 2022 at 8:56 AM James Bottomley
> > <jejb@linux.ibm.com>
> > wrote:
> [...]
> > > Of course, since openssl_tpm2_engine is the complete reference
> > > implementation that means I'll have to add the creation PCRs
> > > implementation to it ... unless you'd like to do it?
> >
> > I am willing to help as I'm the one making the mess. How does it
> > sequence along with your draft submission (before, after,
> > simultaneous)?
>
> At the moment, just send patches. The openssl_tpm2_engine is
> developed on a groups.io mailing list:
>
> https://groups.io/g/openssl-tpm2-engine/
>
> You need an IETF specific tool (xml2rfc) to build the rfc from the
> xml, but it's available in most distros as python3-xml2rfc. If you
> don't want to learn the IETF XML I can help you code up the patch to
> add that to the draft spec.
Just as a heads up, the patch series implementing signed policy (and
thus taking option [3]) is on the mailing list for review:
https://groups.io/g/openssl-tpm2-engine/message/296
With apologies for the awful lack of threading in the groups.io
interface.
So you don't have to build the RFC yourself, I published the proposed
update on my website:
https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html
https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.txt
If you want to use option [4] for the creation data, it's available.
Regards,
James
next prev parent reply other threads:[~2022-12-02 21:03 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-11 23:16 [PATCH v5 00/11] Encrypted Hibernation Evan Green
2022-11-11 23:16 ` [PATCH v5 01/11] tpm: Add support for in-kernel resetting of PCRs Evan Green
2022-11-13 20:31 ` Eric Biggers
2022-11-27 16:06 ` Jarkko Sakkinen
2022-11-27 16:07 ` Jarkko Sakkinen
2022-11-11 23:16 ` [PATCH v5 02/11] tpm: Export and rename tpm2_find_and_validate_cc() Evan Green
2022-11-11 23:16 ` [PATCH v5 03/11] tpm: Allow PCR 23 to be restricted to kernel-only use Evan Green
2022-11-13 20:46 ` Eric Biggers
2022-11-14 17:11 ` James Bottomley
2022-11-27 16:33 ` Jarkko Sakkinen
2022-11-27 16:41 ` James Bottomley
2022-11-30 20:22 ` Dr. Greg
2022-11-30 21:34 ` Casey Schaufler
2022-12-02 1:10 ` Dr. Greg
2023-01-03 20:42 ` Matthew Garrett
2023-01-03 21:04 ` William Roberts
2023-01-03 21:10 ` Matthew Garrett
2023-01-14 14:55 ` James Bottomley
2023-01-14 15:11 ` William Roberts
2023-01-15 3:05 ` Matthew Garrett
2023-01-15 14:41 ` William Roberts
2023-01-17 21:26 ` James Bottomley
2023-01-21 3:29 ` Jarkko Sakkinen
2023-01-23 17:48 ` William Roberts
2023-01-24 11:51 ` Dr. Greg
2023-01-24 12:38 ` James Bottomley
2023-01-24 15:05 ` William Roberts
2023-01-26 17:21 ` Jarkko Sakkinen
2023-01-26 17:32 ` William Roberts
2023-01-26 21:30 ` Jarkko Sakkinen
2023-01-26 22:01 ` William Roberts
2023-02-07 23:20 ` Jarkko Sakkinen
2023-01-26 17:07 ` Jarkko Sakkinen
2023-01-26 17:12 ` Jarkko Sakkinen
2023-01-26 17:20 ` William Roberts
2023-01-10 16:07 ` William Roberts
2022-11-27 16:29 ` Jarkko Sakkinen
2022-11-11 23:16 ` [PATCH v5 04/11] security: keys: trusted: Include TPM2 creation data Evan Green
2022-11-13 21:20 ` Eric Biggers
2022-11-14 3:32 ` James Bottomley
2022-11-14 16:32 ` Evan Green
2022-11-14 16:56 ` James Bottomley
2022-11-14 17:43 ` Evan Green
2022-11-14 18:00 ` James Bottomley
2022-12-02 21:03 ` James Bottomley [this message]
2022-12-05 18:43 ` Evan Green
2022-11-11 23:16 ` [PATCH v5 05/11] security: keys: trusted: Allow storage of PCR values in " Evan Green
2022-11-13 22:01 ` Eric Biggers
2022-11-11 23:16 ` [PATCH v5 06/11] security: keys: trusted: Verify " Evan Green
2022-11-13 22:13 ` Eric Biggers
2022-11-11 23:16 ` [PATCH v5 07/11] PM: hibernate: Add kernel-based encryption Evan Green
2022-11-13 22:55 ` Eric Biggers
2022-11-11 23:16 ` [PATCH v5 08/11] PM: hibernate: Use TPM-backed keys to encrypt image Evan Green
2022-11-13 23:33 ` Eric Biggers
2022-11-11 23:16 ` [PATCH v5 09/11] PM: hibernate: Mix user key in encrypted hibernate Evan Green
2022-11-13 23:44 ` Eric Biggers
2022-11-11 23:16 ` [PATCH v5 10/11] PM: hibernate: Verify the digest encryption key Evan Green
2022-11-13 23:47 ` Eric Biggers
2022-11-11 23:16 ` [PATCH v5 11/11] PM: hibernate: seal the encryption key with a PCR policy Evan Green
2022-11-13 23:51 ` Eric Biggers
2022-12-07 23:54 ` [PATCH v5 00/11] Encrypted Hibernation Evan Green
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6f66f174af92a9b23bddd72945e94e888b0c9420.camel@linux.ibm.com \
--to=jejb@linux.ibm.com \
--cc=apronin@chromium.org \
--cc=corbet@lwn.net \
--cc=dhowells@redhat.com \
--cc=dianders@chromium.org \
--cc=dlunev@google.com \
--cc=ebiggers@kernel.org \
--cc=evgreen@chromium.org \
--cc=gwendal@chromium.org \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=me@benboeckel.net \
--cc=mgarrett@aurora.tech \
--cc=paul@paul-moore.com \
--cc=pavel@ucw.cz \
--cc=rjw@rjwysocki.net \
--cc=serge@hallyn.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.