From: "Horia Geantă" <horia.geanta@nxp.com>
To: Richard Weinberger <richard.weinberger@gmail.com>,
Iuliana Prodan <iuliana.prodan@nxp.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>,
Aymen Sghaier <aymen.sghaier@nxp.com>,
"David S. Miller" <davem@davemloft.net>,
Silvano Di Ninno <silvano.dininno@nxp.com>,
Franck Lenormand <franck.lenormand@nxp.com>,
Linux Crypto Mailing List <linux-crypto@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
dl-linux-imx <linux-imx@nxp.com>,
David Gstir <david@sigma-star.at>
Subject: Re: [PATCH 2/2] crypto: caam - support tagged keys for skcipher algorithms
Date: Tue, 15 Sep 2020 16:42:48 +0300 [thread overview]
Message-ID: <ffc5254a-cecb-20b8-fca3-d2cd8486362d@nxp.com> (raw)
In-Reply-To: <CAFLxGvw4zvL0N5+wChKq3=_xLuuCYLKDOyKKnKFy3UiWMUwf-g@mail.gmail.com>
On 9/14/2020 9:38 AM, Richard Weinberger wrote:
> On Thu, Jul 16, 2020 at 4:12 PM Richard Weinberger
> <richard.weinberger@gmail.com> wrote:
>>
>> On Mon, Jul 13, 2020 at 12:09 AM Iuliana Prodan <iuliana.prodan@nxp.com> wrote:
>>>
>>> Tagged keys are keys that contain metadata indicating what
>>> they are and how to handle them using tag_object API.
>>>
>>> Add support, for tagged keys, to skcipher algorithms by
>>> adding new transformations, with _tk_ prefix to distinguish
>>> between plaintext and tagged keys.
>>>
>>> For job descriptors a new option (key_cmd_opt) was added for KEY command.
>>> Tagged keys can be loaded using only a KEY command with ENC=1
>>> and the proper setting of the EKT bit. The EKT bit in the
>>> KEY command indicates which encryption algorithm (AES-ECB or
>>> AES-CCM) should be used to decrypt the key. These options will be kept in
>>> key_cmd_opt.
>>>
>>> The tk_ transformations can be used directly by their name:
>>> struct sockaddr_alg sa = {
>>> .salg_family = AF_ALG,
>>> .salg_type = "skcipher", /* this selects the symmetric cipher */
>>> .salg_name = "tk(cbc(aes))" /* this is the cipher name */
>>> };
>>> or for dm-crypt, e.g. using dmsetup:
>>> dmsetup -v create encrypted --table "0 $(blockdev --getsz /dev/mmcblk2p10)
>>> crypt capi:tk(cbc(aes))-plain :32:logon:seckey 0 /dev/mmcblk2p10 0 1
>>> sector_size:512".
>>
>> How to use it with cryptsetup?
>> I'm asking because it is not clear to me why you are not implementing
>> a new kernel key type (KEYS subsystem)
>> to utilize tagged keys.
>> Many tools already support the keyctl userspace interface (cryptsetup,
>> fscrypt, ...).
>
> *friendly ping*
>
We didn't include the key management part in this series,
just the crypto API support for algorithms with protected keys,
to get early feedback.
Wrt. key management:
The NXP vendor / downstream kernel (to be included in i.MX BSP Q3 release)
will have support for protected keys generation.
Besides this, a dedicated ioctl-based interface will allow userspace to
generate and export these keys. After this, user can use standard keyctl
to add a key (as user / logon type) in the keyring, such that it would be
available to dm-crypt.
We know that adding new ioctls is frowned upon, so before trying to upstream
the ioctl-based solution the plan is checking the feasibility of
extending keyctl as David Howells suggested:
https://lore.kernel.org/lkml/8060.1533226481@warthog.procyon.org.uk
(Note the difference b/w adding new key type - which was rejected -
and a key "subtype extension".)
Horia
next prev parent reply other threads:[~2020-09-16 0:32 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-12 22:05 [PATCH 0/2] crypto: caam - add tagged keys functionality and tk transformations for skcipher Iuliana Prodan
2020-07-12 22:05 ` [PATCH 1/2] crypto: caam - add tag object functionality Iuliana Prodan
2020-07-16 10:05 ` Horia Geantă
2020-07-12 22:05 ` [PATCH 2/2] crypto: caam - support tagged keys for skcipher algorithms Iuliana Prodan
2020-07-16 7:36 ` Herbert Xu
2020-07-16 10:35 ` Horia Geantă
2020-07-16 11:52 ` Herbert Xu
2020-07-16 12:07 ` Horia Geantă
2020-07-16 12:19 ` Herbert Xu
2020-07-16 12:24 ` Van Leeuwen, Pascal
2020-07-16 13:05 ` Herbert Xu
2020-07-16 14:12 ` Richard Weinberger
2020-09-14 6:38 ` Richard Weinberger
2020-09-15 13:42 ` Horia Geantă [this message]
2020-09-15 21:50 ` Richard Weinberger
2020-09-21 11:23 ` Horia Geantă
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ffc5254a-cecb-20b8-fca3-d2cd8486362d@nxp.com \
--to=horia.geanta@nxp.com \
--cc=aymen.sghaier@nxp.com \
--cc=davem@davemloft.net \
--cc=david@sigma-star.at \
--cc=franck.lenormand@nxp.com \
--cc=herbert@gondor.apana.org.au \
--cc=iuliana.prodan@nxp.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-imx@nxp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=richard.weinberger@gmail.com \
--cc=silvano.dininno@nxp.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).