From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Pascal Van Leeuwen <pvanleeuwen@verimatrix.com>
Cc: Ken Goldman <kgold@linux.ibm.com>,
"Safford, David (GE Global Research, US)" <david.safford@ge.com>,
Mimi Zohar <zohar@linux.ibm.com>,
"linux-integrity@vger.kernel.org"
<linux-integrity@vger.kernel.org>,
"stable@vger.kernel.org" <stable@vger.kernel.org>,
"open list:ASYMMETRIC KEYS" <keyrings@vger.kernel.org>,
"open list:CRYPTO API" <linux-crypto@vger.kernel.org>,
open list <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] KEYS: asym_tpm: Switch to get_random_bytes()
Date: Mon, 14 Oct 2019 22:11:50 +0300 [thread overview]
Message-ID: <20191014191150.GB15552@linux.intel.com> (raw)
In-Reply-To: <MN2PR20MB2973CDE87E4EC25CA21DD2C8CA950@MN2PR20MB2973.namprd20.prod.outlook.com>
On Wed, Oct 09, 2019 at 08:09:29AM +0000, Pascal Van Leeuwen wrote:
> There's certification and certification. Not all certificates are
> created equally. But if it matches your specific requirements, why not.
> There's a _lot_ of HW out there that's not x86 though ...
>
> And: is RDRAND certified for _all_ x86 processors? Or just Intel?
> Or perhaps even only _specific (server) models_ of CPU's?
> I also know for a fact that some older AMD processors had a broken
> RDRAND implementation ...
>
> So the choice really should be up to the application or user.
I'm not seriously suggesting to move rdrand here. I'm trying find the
logic how to move forward with trusted keys with multiple backends (not
only TPM).
AKA we have a kernel rng in existence but no clear policy when it should
be used and when not. This leads to throwing a dice with the design
choices. Even it TPM RNG is the right choice in tpm_asym.c, the choice
was not based on anything (otherwise it would have been documented).
/Jarkko
next prev parent reply other threads:[~2019-10-14 19:11 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-26 17:16 [PATCH] KEYS: asym_tpm: Switch to get_random_bytes() Jarkko Sakkinen
2019-09-28 18:05 ` Jerry Snitselaar
2019-10-01 20:54 ` Jarkko Sakkinen
2019-10-02 14:00 ` Mimi Zohar
2019-10-03 11:41 ` Jarkko Sakkinen
2019-10-03 11:43 ` Jarkko Sakkinen
2019-10-03 13:02 ` Mimi Zohar
2019-10-03 17:58 ` Jarkko Sakkinen
2019-10-03 18:53 ` Mimi Zohar
2019-10-03 21:51 ` Jarkko Sakkinen
2019-10-03 21:57 ` Jarkko Sakkinen
2019-10-03 22:08 ` Mimi Zohar
2019-10-03 23:59 ` James Bottomley
2019-10-04 18:22 ` Jarkko Sakkinen
2019-10-04 18:24 ` James Bottomley
2019-10-04 18:33 ` Jerry Snitselaar
2019-10-04 18:42 ` James Bottomley
2019-10-04 20:07 ` Jerry Snitselaar
2019-10-04 20:11 ` Jerry Snitselaar
2019-10-04 22:11 ` James Bottomley
2019-10-06 0:38 ` Mimi Zohar
2019-10-06 23:52 ` Jarkko Sakkinen
2019-10-07 18:08 ` Mimi Zohar
2019-10-04 18:20 ` Jarkko Sakkinen
2019-10-03 22:10 ` Jarkko Sakkinen
2019-10-04 13:26 ` Safford, David (GE Global Research, US)
2019-10-04 18:27 ` Jarkko Sakkinen
2019-10-04 18:30 ` Jarkko Sakkinen
2019-10-04 19:56 ` Safford, David (GE Global Research, US)
2019-10-07 0:05 ` Jarkko Sakkinen
2019-10-07 22:13 ` Ken Goldman
2019-10-08 23:49 ` Jarkko Sakkinen
2019-10-08 23:53 ` Jarkko Sakkinen
2019-10-09 7:10 ` Pascal Van Leeuwen
2019-10-09 7:33 ` Jarkko Sakkinen
2019-10-09 7:41 ` Jarkko Sakkinen
2019-10-09 8:09 ` Pascal Van Leeuwen
2019-10-14 19:11 ` Jarkko Sakkinen [this message]
2019-10-09 8:02 ` Pascal Van Leeuwen
2019-10-09 12:11 ` Safford, David (GE Global Research, US)
2019-10-14 19:00 ` Jarkko Sakkinen
2019-10-14 19:29 ` Jarkko Sakkinen
2019-10-14 19:29 ` James Bottomley
2019-10-16 11:00 ` Jarkko Sakkinen
2019-10-16 12:34 ` James Bottomley
2019-10-16 16:25 ` Jarkko Sakkinen
2019-10-16 19:10 ` James Bottomley
2019-10-17 12:52 ` Sumit Garg
2019-10-17 12:58 ` James Bottomley
2019-10-17 18:04 ` Jarkko Sakkinen
2019-10-21 11:39 ` Jarkko Sakkinen
2019-10-29 8:42 ` Jarkko Sakkinen
2019-10-29 14:58 ` James Bottomley
2019-10-31 21:03 ` Jarkko Sakkinen
2019-10-18 7:32 ` Janne Karhunen
2019-10-03 18:02 ` Jarkko Sakkinen
2019-10-03 18:15 ` Jarkko Sakkinen
2019-10-07 10:33 ` Janne Karhunen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191014191150.GB15552@linux.intel.com \
--to=jarkko.sakkinen@linux.intel.com \
--cc=david.safford@ge.com \
--cc=keyrings@vger.kernel.org \
--cc=kgold@linux.ibm.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pvanleeuwen@verimatrix.com \
--cc=stable@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).