From: Ken Goldman <kgold@linux.ibm.com>
To: James Prestwood <prestwoj@gmail.com>,
James Bottomley <James.Bottomley@HansenPartnership.com>,
linux-integrity@vger.kernel.org
Cc: Mimi Zohar <zohar@linux.ibm.com>,
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
David Woodhouse <dwmw2@infradead.org>,
keyrings@vger.kernel.org
Subject: Re: [PATCH v5 4/6] security: keys: trusted: use ASN.1 TPM2 key format for the blobs
Date: Sun, 12 Jul 2020 17:38:16 -0400 [thread overview]
Message-ID: <34d5fef9-1baf-83a8-3e54-5065ea96f412@linux.ibm.com> (raw)
In-Reply-To: <3feaa7a3265b472bb3694045448fc44368f1fb99.camel@gmail.com>
On 2/27/2020 3:57 PM, James Prestwood wrote:
> I am learning lots from this discussion, so thank you. I had assumed
> that the parent key crypto had to match the child key, RSA vs EC, but
> sounds like that is not the case. And yes, this sounds like a much
> better way to go now that I have a bit more info on it.
I know this old. Just FYI:
The TPM WG debated this for a while, but decided that the TPM should not
enforce parent / child algorithm matching. It's for the application to
decide.
I also note that parent keys wrap their child keys using a symmetric
key, typically AES, not an RSA or ECC key. The load time would be the
same for an ECC or RSA parent, because it's not using the asymmetric
key.
This different from TPM 1.2, which always uses parent RSA wrapping.
The asymmetric key is used for:
1 - import (key backup, using externally generated keys)
2 - Salted sessions
While both are useful, they're not typically used in a
critical path.
next prev parent reply other threads:[~2020-07-12 21:38 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-30 10:18 [PATCH v5 0/6] TPM 2.0 trusted keys with attached policy James Bottomley
2020-01-30 10:18 ` [PATCH v5 1/6] lib: add ASN.1 encoder James Bottomley
2020-01-30 10:18 ` [PATCH v5 2/6] oid_registry: Add TCG defined OIDS for TPM keys James Bottomley
2020-01-30 10:18 ` [PATCH v5 3/6] security: keys: trusted fix tpm2 authorizations James Bottomley
2020-02-25 16:48 ` Jarkko Sakkinen
2020-02-26 15:15 ` Jarkko Sakkinen
2020-02-27 0:58 ` James Bottomley
2020-02-27 16:19 ` Jarkko Sakkinen
2020-02-27 16:21 ` James Bottomley
2020-02-27 17:49 ` James Bottomley
2020-03-02 11:08 ` Jarkko Sakkinen
2020-01-30 10:18 ` [PATCH v5 4/6] security: keys: trusted: use ASN.1 TPM2 key format for the blobs James Bottomley
2020-02-03 16:54 ` James Prestwood
2020-02-27 0:02 ` James Bottomley
2020-02-27 0:20 ` James Prestwood
2020-02-27 0:54 ` James Bottomley
2020-02-27 17:19 ` James Prestwood
2020-02-27 20:19 ` James Bottomley
2020-02-27 20:26 ` James Bottomley
2020-02-27 20:44 ` James Prestwood
2020-02-27 20:57 ` James Prestwood
2020-07-12 21:38 ` Ken Goldman [this message]
2020-07-12 21:54 ` James Bottomley
2020-03-02 19:00 ` James Prestwood
2020-01-30 10:18 ` [PATCH v5 5/6] security: keys: trusted: add ability to specify arbitrary policy James Bottomley
2020-01-30 10:18 ` [PATCH v5 6/6] security: keys: trusted: implement counter/timer policy James Bottomley
2020-02-20 20:17 ` [PATCH v5 0/6] TPM 2.0 trusted keys with attached policy Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=34d5fef9-1baf-83a8-3e54-5065ea96f412@linux.ibm.com \
--to=kgold@linux.ibm.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=dwmw2@infradead.org \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=prestwoj@gmail.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).