Re: [PATCH v5 10/11] PM: hibernate: Verify the digest encryption key

From: Eric Biggers <ebiggers@kernel.org>
To: Evan Green <evgreen@chromium.org>
Cc: linux-kernel@vger.kernel.org, corbet@lwn.net,
	linux-integrity@vger.kernel.org, gwendal@chromium.org,
	dianders@chromium.org, apronin@chromium.org,
	Pavel Machek <pavel@ucw.cz>, Ben Boeckel <me@benboeckel.net>,
	rjw@rjwysocki.net, jejb@linux.ibm.com,
	Kees Cook <keescook@chromium.org>,
	dlunev@google.com, zohar@linux.ibm.com,
	Matthew Garrett <mgarrett@aurora.tech>,
	jarkko@kernel.org, linux-pm@vger.kernel.org,
	Matthew Garrett <mjg59@google.com>,
	Len Brown <len.brown@intel.com>,
	"Rafael J. Wysocki" <rafael@kernel.org>
Subject: Re: [PATCH v5 10/11] PM: hibernate: Verify the digest encryption key
Date: Sun, 13 Nov 2022 15:47:04 -0800	[thread overview]
Message-ID: <Y3GB+CXfAWnV/3qH@sol.localdomain> (raw)
In-Reply-To: <20221111151451.v5.10.I504d456c7a94ef1aaa7a2c63775ce9690c3ad7ab@changeid>

On Fri, Nov 11, 2022 at 03:16:35PM -0800, Evan Green wrote:
> We want to ensure that the key used to encrypt the digest

What is meant by "the key used to encrypt the digest"?

> was created by
> the kernel during hibernation. To do this we request that the TPM
> include information about the value of PCR 23 at the time of key
> creation in the sealed blob. On resume, we can make sure that the PCR
> information in the creation data blob (already certified by the TPM to
> be accurate) corresponds to the expected value. Since only
> the kernel can touch PCR 23, if an attacker generates a key themselves
> the value of PCR 23 will have been different, allowing us to reject the
> key and boot normally instead of resuming.

It seems that PCR 23 is already included in the authorization policy for the
key, so why is this extra part needed?

- Eric