All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
To: Mimi Zohar <zohar@linux.ibm.com>, "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: "James Bottomley" <jejb@linux.ibm.com>,
	"Jarkko Sakkinen" <jarkko@kernel.org>,
	"David Howells" <dhowells@redhat.com>,
	kernel@pengutronix.de, "Sumit Garg" <sumit.garg@linaro.org>,
	"Pankaj Gupta" <pankaj.gupta@nxp.com>,
	"David Gstir" <david@sigma-star.at>,
	"Michael Walle" <michael@walle.cc>,
	"John Ernberg" <john.ernberg@actia.se>,
	"James Morris" <jmorris@namei.org>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	"Horia Geantă" <horia.geanta@nxp.com>,
	"Herbert Xu" <herbert@gondor.apana.org.au>,
	"David S. Miller" <davem@davemloft.net>,
	"Jan Luebbe" <j.luebbe@pengutronix.de>,
	"Eric Biggers" <ebiggers@kernel.org>,
	"Richard Weinberger" <richard@nod.at>,
	"Franck LENORMAND" <franck.lenormand@nxp.com>,
	"Matthias Schiffer" <matthias.schiffer@ew.tq-group.com>,
	keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
	linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	"Pascal Van Leeuwen" <pvanleeuwen@verimatrix.com>
Subject: Re: [PATCH v10 2/7] KEYS: trusted: allow use of kernel RNG for key material
Date: Wed, 18 May 2022 06:31:33 +0200	[thread overview]
Message-ID: <4e0e8f5b-f5c9-003b-6aac-cea7c49b3f96@pengutronix.de> (raw)
In-Reply-To: <dd488736ab86c0e0b2809b4ce30f1827563b52b2.camel@linux.ibm.com>

Hello Mimi,

On 17.05.22 21:49, Mimi Zohar wrote:
> On Tue, 2022-05-17 at 20:30 +0200, Jason A. Donenfeld wrote:
>> Hi Mimi,
>>
>> On Tue, May 17, 2022 at 02:21:08PM -0400, Mimi Zohar wrote:
>>> On Tue, 2022-05-17 at 19:38 +0200, Jason A. Donenfeld wrote:
>> Apologies in advance if I've missed the mark here; I'm not very familiar
>> with this thread or what it's driving at. If the simple question was
>> just "is get_random_bytes_wait() good to use?" the answer is just "yes"
>> and I can disappear and stop confusing things. :)
> 
> My apologies for your having been brought into this discussion without
> having properly reviewed and summarized the previous thread.   As you
> saw there is a long history.
> 
> Jarrko, Ahmad,  "Trusted" keys, by definition, are based on the TPM
> RNG.  If CAAM trusted key support wants to use kernel RNG by default,
> that's fine.  However defining and allowing a boot command line option
> to use kernel RNG instead of the TPM RNG, needs to be configurable.

The use of kernel RNG for TPM Trusted Keys is already opt-in. The default
is trusted.rng=default, which maintains existing behavior. Users who want
to use kernel RNG instead need to explicitly specify trusted.rng=kernel.

What more is needed?

Cheers,
Ahmad



> 
> thanks,
> 
> Mimi
> 
> 


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

  reply	other threads:[~2022-05-18  4:32 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-13 14:56 [PATCH v10 0/7] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys Ahmad Fatoum
2022-05-13 14:56 ` [PATCH v10 1/7] KEYS: trusted: allow use of TEE as backend without TCG_TPM support Ahmad Fatoum
2022-05-13 14:57 ` [PATCH v10 2/7] KEYS: trusted: allow use of kernel RNG for key material Ahmad Fatoum
2022-05-17 15:52   ` Mimi Zohar
2022-05-17 16:25     ` Ahmad Fatoum
2022-05-17 17:40       ` Jason A. Donenfeld
2022-05-17 17:38     ` Jason A. Donenfeld
2022-05-17 18:21       ` Mimi Zohar
2022-05-17 18:30         ` Jason A. Donenfeld
2022-05-17 19:49           ` Mimi Zohar
2022-05-18  4:31             ` Ahmad Fatoum [this message]
2022-05-17 17:27   ` Jason A. Donenfeld
2022-05-17 17:52     ` Ahmad Fatoum
2022-05-17 18:00       ` Jason A. Donenfeld
2022-05-17 18:27         ` Ahmad Fatoum
2022-05-17 18:10     ` Jarkko Sakkinen
2022-05-17 18:20       ` Ahmad Fatoum
2022-05-17 18:20       ` Jason A. Donenfeld
2022-05-13 14:57 ` [PATCH v10 3/7] crypto: caam - determine whether CAAM supports blob encap/decap Ahmad Fatoum
2022-05-17 10:03   ` [EXT] " Pankaj Gupta
2022-05-13 14:57 ` [PATCH v10 4/7] crypto: caam - add in-kernel interface for blob generator Ahmad Fatoum
2022-05-13 14:57 ` [PATCH v10 5/7] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys Ahmad Fatoum
2022-05-13 14:57 ` [PATCH v10 6/7] doc: trusted-encrypted: describe new CAAM trust source Ahmad Fatoum
2022-05-13 14:57 ` [PATCH v10 7/7] MAINTAINERS: add KEYS-TRUSTED-CAAM Ahmad Fatoum
2022-05-16 18:36 ` [PATCH v10 0/7] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys Jarkko Sakkinen
2022-05-17 12:44   ` Ahmad Fatoum
2022-05-18  1:08     ` Jarkko Sakkinen
2022-05-18  4:36       ` Ahmad Fatoum
2022-05-18 14:58         ` Jarkko Sakkinen
2022-05-19 23:41           ` Jarkko Sakkinen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4e0e8f5b-f5c9-003b-6aac-cea7c49b3f96@pengutronix.de \
    --to=a.fatoum@pengutronix.de \
    --cc=Jason@zx2c4.com \
    --cc=davem@davemloft.net \
    --cc=david@sigma-star.at \
    --cc=dhowells@redhat.com \
    --cc=ebiggers@kernel.org \
    --cc=franck.lenormand@nxp.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=horia.geanta@nxp.com \
    --cc=j.luebbe@pengutronix.de \
    --cc=jarkko@kernel.org \
    --cc=jejb@linux.ibm.com \
    --cc=jmorris@namei.org \
    --cc=john.ernberg@actia.se \
    --cc=kernel@pengutronix.de \
    --cc=keyrings@vger.kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=matthias.schiffer@ew.tq-group.com \
    --cc=michael@walle.cc \
    --cc=pankaj.gupta@nxp.com \
    --cc=pvanleeuwen@verimatrix.com \
    --cc=richard@nod.at \
    --cc=serge@hallyn.com \
    --cc=sumit.garg@linaro.org \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.