Re: [PATCH 02/11] libnvdimm/security: change clear text nvdimm keys to encrypted keys

From: Dan Williams <dan.j.williams@intel.com>
To: Dave Jiang <dave.jiang@intel.com>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
	linux-nvdimm <linux-nvdimm@lists.01.org>
Subject: Re: [PATCH 02/11] libnvdimm/security: change clear text nvdimm keys to encrypted keys
Date: Fri, 9 Nov 2018 17:45:36 -0800	[thread overview]
Message-ID: <CAPcyv4ioJ_dznpb2kMAVk+KDq00ng4WMni8dWVYPnSFn84CnJg@mail.gmail.com> (raw)
In-Reply-To: <154180163666.70506.8805433934495072699.stgit@djiang5-desk3.ch.intel.com>

On Fri, Nov 9, 2018 at 2:13 PM Dave Jiang <dave.jiang@intel.com> wrote:
>
> In order to make nvdimm more secure, encrypted keys will be used instead of
> clear text keys. A master key will be created to seal encrypted nvdimm
> keys. The master key can be a trusted key generated from TPM 2.0 or a less
> secure user key.
>
> In the process of this conversion, the kernel cached key will be removed
> in order to simplify the verification process. The hardware will be used to
> verify the decrypted user payload directly.
>
> Signed-off-by: Dave Jiang <dave.jiang@intel.com>
> ---
>  Documentation/nvdimm/security.txt |   29 ++-
>  drivers/nvdimm/dimm.c             |    3
>  drivers/nvdimm/dimm_devs.c        |    2
>  drivers/nvdimm/nd-core.h          |    3
>  drivers/nvdimm/nd.h               |    5 -
>  drivers/nvdimm/security.c         |  316 ++++++++++---------------------------
>  6 files changed, 108 insertions(+), 250 deletions(-)

Remove twice the amount of code that it adds and gains features /
security, nice!
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm