From: David Howells <dhowells@redhat.com>
To: jmorris@namei.org
Cc: Marcel Holtmann <marcel@holtmann.org>,
Denis Kenzior <denkenz@gmail.com>,
James Morris <james.morris@microsoft.com>,
dhowells@redhat.com, denkenz@gmail.com, keyrings@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 00/22] KEYS: Support TPM-wrapped key and crypto ops [ver #2]
Date: Tue, 09 Oct 2018 17:46:42 +0100 [thread overview]
Message-ID: <153910360263.12141.6032694262361399627.stgit@warthog.procyon.org.uk> (raw)
Hi James,
Here's a set of patches that does the following, if you could pull it please:
(1) Adds keyctl() functions that permit an asymmetric-type key to be used
to encrypt, decrypt, sign and verify a small piece of data (typically
a session key or a hash) using the public and/or private key held in
the kernel. A query function is also provided.
(2) Adds an asymmetric-key parser for PKCS#8 to allow RSA private keys to
be passed to the kernel. Currently only DER-encoded and unencrypted
PKCS#8 is supported.
(3) Adds an asymmetric-key parser for TPM-wrapped key blobs. The parser
gets the TPM to unpack the blob and then attaches it to a key from
which it can be used. Currently only TPM-1.2 is supported.
Example usage for a PKCS#8 blob:
openssl genrsa -out /tmp/privkey.foo.pem 2048
j=`openssl pkcs8 -in /tmp/privkey.foo.pem -topk8 -nocrypt -outform DER |
keyctl padd asymmetric foo @s`
Example usage for a TPM wrapped blob:
openssl genrsa -out /tmp/privkey.foo.pem 2048
create_tpm_key -s 2048 -w /tmp/privkey.foo.pem /tmp/privkey.foo.tpm
j=`openssl asn1parse -inform pem -in /tmp/privkey.foo.tpm -noout -out - |
keyctl padd asymmetric foo @s`
See http://david.woodhou.se/draft-woodhouse-cert-best-practice.html#rfc.section.4.4
These keys can then be used thusly:
echo -n abcdefghijklmnopqrst >/tmp/data
keyctl pkey_encrypt $j /tmp/data enc=pkcs1 >/tmp/enc
keyctl pkey_decrypt $j /tmp/enc enc=pkcs1 >/tmp/dec
cmp /tmp/data /tmp/dec
keyctl pkey_sign $j /tmp/data enc=pkcs1 hash=sha1 >/tmp/sig
keyctl pkey_verify $j /tmp/data /tmp/sig enc=pkcs1 hash=sha1
The kernel patches can be found tagged here:
https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/tag/?h=keys-asym-keyctl-20181009
and also on a branch here:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-asym-keyctl
The keyutils changes needed can be found here:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/keyutils.git/log/?h=next
Changes
-------
v2: Updated the docs and a comment to indicate that the encoding should be a
pointer to a string "raw" to denote no encoding and not NULL.
David
---
David Howells (8):
KEYS: Provide key type operations for asymmetric key ops
KEYS: Provide keyctls to drive the new key type ops for asymmetric keys
KEYS: Provide missing asymmetric key subops for new key type ops
KEYS: Make the X.509 and PKCS7 parsers supply the sig encoding type
KEYS: Provide software public key query function
KEYS: Allow the public_key struct to hold a private key
KEYS: Implement encrypt, decrypt and sign for software asymmetric key
KEYS: Implement PKCS#8 RSA Private Key parser
Denis Kenzior (14):
crypto: rsa-pkcs1pad: Allow hash to be optional
KEYS: asym_tpm: add skeleton for asym_tpm
KEYS: asym_tpm: extract key size & public key
KEYS: Add parser for TPM-based keys
KEYS: asym_tpm: Implement pkey_query
KEYS: asym_tpm: Implement encryption operation
KEYS: trusted: Expose common functionality
KEYS: Move trusted.h to include/keys
KEYS: asym_tpm: Add loadkey2 and flushspecific
KEYS: asym_tpm: Implement tpm_unbind
KEYS: asym_tpm: Implement the decrypt operation
KEYS: asym_tpm: Implement signature verification
KEYS: asym_tpm: Implement tpm_sign
KEYS: asym_tpm: Add support for the sign operation
Documentation/crypto/asymmetric-keys.txt | 26 +
Documentation/security/keys/core.rst | 217 ++++++
crypto/asymmetric_keys/Kconfig | 31 +
crypto/asymmetric_keys/Makefile | 25 +
crypto/asymmetric_keys/asym_tpm.c | 988 +++++++++++++++++++++++++++++
crypto/asymmetric_keys/asymmetric_keys.h | 3
crypto/asymmetric_keys/asymmetric_type.c | 43 +
crypto/asymmetric_keys/pkcs7_parser.c | 1
crypto/asymmetric_keys/pkcs8.asn1 | 24 +
crypto/asymmetric_keys/pkcs8_parser.c | 184 +++++
crypto/asymmetric_keys/public_key.c | 191 +++++-
crypto/asymmetric_keys/signature.c | 95 +++
crypto/asymmetric_keys/tpm.asn1 | 5
crypto/asymmetric_keys/tpm_parser.c | 102 +++
crypto/asymmetric_keys/x509_cert_parser.c | 21 -
crypto/rsa-pkcs1pad.c | 59 +-
include/crypto/asym_tpm_subtype.h | 19 +
include/crypto/public_key.h | 14
include/keys/asymmetric-subtype.h | 9
include/keys/trusted.h | 136 ++++
include/linux/key-type.h | 11
include/linux/keyctl.h | 46 +
include/uapi/linux/keyctl.h | 30 +
security/keys/Makefile | 1
security/keys/compat.c | 18 +
security/keys/internal.h | 39 +
security/keys/keyctl.c | 24 +
security/keys/keyctl_pkey.c | 323 +++++++++
security/keys/trusted.c | 14
security/keys/trusted.h | 124 ----
30 files changed, 2639 insertions(+), 184 deletions(-)
create mode 100644 crypto/asymmetric_keys/asym_tpm.c
create mode 100644 crypto/asymmetric_keys/pkcs8.asn1
create mode 100644 crypto/asymmetric_keys/pkcs8_parser.c
create mode 100644 crypto/asymmetric_keys/tpm.asn1
create mode 100644 crypto/asymmetric_keys/tpm_parser.c
create mode 100644 include/crypto/asym_tpm_subtype.h
create mode 100644 include/keys/trusted.h
create mode 100644 include/linux/keyctl.h
create mode 100644 security/keys/keyctl_pkey.c
delete mode 100644 security/keys/trusted.h
next reply other threads:[~2018-10-09 16:46 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-09 16:46 David Howells [this message]
2018-10-09 16:46 ` [PATCH 01/22] KEYS: Provide key type operations for asymmetric key ops [ver #2] David Howells
2018-10-09 16:46 ` [PATCH 02/22] KEYS: Provide keyctls to drive the new key type ops for asymmetric keys " David Howells
2018-10-09 16:47 ` [PATCH 03/22] KEYS: Provide missing asymmetric key subops for new key type ops " David Howells
2018-10-09 16:47 ` [PATCH 04/22] KEYS: Make the X.509 and PKCS7 parsers supply the sig encoding type " David Howells
2018-10-09 16:47 ` [PATCH 05/22] KEYS: Provide software public key query function " David Howells
2018-10-09 16:47 ` [PATCH 06/22] KEYS: Allow the public_key struct to hold a private key " David Howells
2018-10-09 16:47 ` [PATCH 07/22] KEYS: Implement encrypt, decrypt and sign for software asymmetric " David Howells
2018-10-09 16:47 ` [PATCH 08/22] KEYS: Implement PKCS#8 RSA Private Key parser " David Howells
2018-10-09 16:47 ` [PATCH 09/22] crypto: rsa-pkcs1pad: Allow hash to be optional " David Howells
2018-10-09 16:48 ` [PATCH 10/22] KEYS: asym_tpm: add skeleton for asym_tpm " David Howells
2018-10-09 16:48 ` [PATCH 11/22] KEYS: asym_tpm: extract key size & public key " David Howells
2018-10-09 16:48 ` [PATCH 12/22] KEYS: Add parser for TPM-based keys " David Howells
2018-10-09 16:48 ` [PATCH 13/22] KEYS: asym_tpm: Implement pkey_query " David Howells
2018-10-09 16:48 ` [PATCH 14/22] KEYS: asym_tpm: Implement encryption operation " David Howells
2018-10-09 16:48 ` [PATCH 15/22] KEYS: trusted: Expose common functionality " David Howells
2018-10-09 16:48 ` [PATCH 16/22] KEYS: Move trusted.h to include/keys " David Howells
2018-10-09 16:48 ` [PATCH 17/22] KEYS: asym_tpm: Add loadkey2 and flushspecific " David Howells
2018-10-09 16:49 ` [PATCH 18/22] KEYS: asym_tpm: Implement tpm_unbind " David Howells
2018-10-09 16:49 ` [PATCH 19/22] KEYS: asym_tpm: Implement the decrypt operation " David Howells
2018-10-09 16:49 ` [PATCH 20/22] KEYS: asym_tpm: Implement signature verification " David Howells
2018-10-09 16:49 ` [PATCH 21/22] KEYS: asym_tpm: Implement tpm_sign " David Howells
2018-10-09 16:49 ` [PATCH 22/22] KEYS: asym_tpm: Add support for the sign operation " David Howells
2018-10-09 19:26 ` [PATCH 00/22] KEYS: Support TPM-wrapped key and crypto ops " James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=153910360263.12141.6032694262361399627.stgit@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=denkenz@gmail.com \
--cc=james.morris@microsoft.com \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=marcel@holtmann.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).