linux-security-module.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Richard Weinberger <richard@nod.at>
To: Sumit Garg <sumit.garg@linaro.org>
Cc: Ahmad Fatoum <a.fatoum@pengutronix.de>,
	Jarkko Sakkinen <jarkko@kernel.org>,
	horia geanta <horia.geanta@nxp.com>,
	Mimi Zohar <zohar@linux.ibm.com>,
	aymen sghaier <aymen.sghaier@nxp.com>,
	Herbert Xu <herbert@gondor.apana.org.au>,
	davem <davem@davemloft.net>, James Bottomley <jejb@linux.ibm.com>,
	kernel <kernel@pengutronix.de>,
	David Howells <dhowells@redhat.com>,
	James Morris <jmorris@namei.org>,
	"Serge E. Hallyn" <serge@hallyn.com>,
	Steffen Trumtrar <s.trumtrar@pengutronix.de>,
	Udit Agarwal <udit.agarwal@nxp.com>,
	Jan Luebbe <j.luebbe@pengutronix.de>, david <david@sigma-star.at>,
	Franck Lenormand <franck.lenormand@nxp.com>,
	linux-integrity <linux-integrity@vger.kernel.org>,
	"open list, ASYMMETRIC KEYS" <keyrings@vger.kernel.org>,
	Linux Crypto Mailing List <linux-crypto@vger.kernel.org>,
	linux-kernel <linux-kernel@vger.kernel.org>,
	LSM <linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v1 0/3] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys
Date: Thu, 1 Apr 2021 15:17:45 +0200 (CEST)	[thread overview]
Message-ID: <1666035815.140054.1617283065549.JavaMail.zimbra@nod.at> (raw)
In-Reply-To: <CAFA6WYO29o73nSg4ikU9cyaOr0kpaXFJpcGLGmFLgjKQWchcEg@mail.gmail.com>

Sumit,

----- Ursprüngliche Mail -----
> Von: "Sumit Garg" <sumit.garg@linaro.org>
> IIUC, this would require support for multiple trusted keys backends at
> runtime but currently the trusted keys subsystem only supports a
> single backend which is selected via kernel module parameter during
> boot.
> 
> So the trusted keys framework needs to evolve to support multiple
> trust sources at runtime but I would like to understand the use-cases
> first. IMO, selecting the best trust source available on a platform
> for trusted keys should be a one time operation, so why do we need to
> have other backends available at runtime as well?

I thought about devices with a TPM-Chip and CAAM.
IMHO allowing only one backend at the same time is a little over simplified. 

Thanks,
//richard

  reply	other threads:[~2021-04-01 18:17 UTC|newest]

Thread overview: 71+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-16 17:01 [PATCH v1 0/3] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys Ahmad Fatoum
2021-03-16 17:01 ` [PATCH v1 1/3] crypto: caam - add in-kernel interface for blob generator Ahmad Fatoum
2021-03-21 20:46   ` Horia Geantă
2021-03-23 16:41     ` Ahmad Fatoum
2021-03-16 17:01 ` [PATCH v1 2/3] KEYS: trusted: implement fallback to kernel RNG Ahmad Fatoum
2021-03-16 17:01 ` [PATCH v1 3/3] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys Ahmad Fatoum
2021-03-16 19:22   ` Jarkko Sakkinen
2021-03-17 13:58     ` Ahmad Fatoum
2021-03-16 23:14   ` Richard Weinberger
2021-03-17  7:39     ` Sumit Garg
2021-03-17  8:07       ` Richard Weinberger
2021-03-17 14:02     ` Ahmad Fatoum
2021-03-30 21:28       ` Richard Weinberger
2021-03-21 20:48   ` Horia Geantă
2021-03-23 16:35     ` Ahmad Fatoum
2021-03-23 18:07       ` Mimi Zohar
2021-03-24  9:26         ` Ahmad Fatoum
2021-03-24 10:47           ` Sumit Garg
2021-03-24 14:07             ` Ahmad Fatoum
2021-03-25  5:26               ` Sumit Garg
2021-03-27 12:41                 ` David Gstir
2021-03-28 20:37                   ` Jarkko Sakkinen
2021-03-29 10:11                     ` Ahmad Fatoum
2021-03-31 23:29                       ` Jarkko Sakkinen
2021-03-30  7:26                     ` Sumit Garg
2021-03-31 23:30                       ` Jarkko Sakkinen
2021-04-01  7:41                         ` Ahmad Fatoum
2021-03-30 21:47                     ` Eric Biggers
2021-03-31 23:31                       ` Jarkko Sakkinen
2021-03-31 23:34                         ` Eric Biggers
2021-04-01  1:11                           ` Herbert Xu
2021-04-01  5:50                             ` Jarkko Sakkinen
2021-04-01  6:03                               ` Eric Biggers
2021-04-01  5:46                           ` Jarkko Sakkinen
2021-03-24 16:14         ` James Bottomley
2021-03-24 20:49           ` Mimi Zohar
2021-03-24 21:58             ` James Bottomley
2021-04-02  1:49           ` Serge E. Hallyn
2021-03-31 18:35   ` Richard Weinberger
2021-04-01 10:15     ` Ahmad Fatoum
2021-04-01 10:23       ` Richard Weinberger
2021-03-16 23:10 ` [PATCH v1 0/3] " Richard Weinberger
2021-03-17 14:08   ` Ahmad Fatoum
2021-03-30 21:50     ` Richard Weinberger
2021-04-01 10:04       ` Ahmad Fatoum
2021-04-01 10:20         ` Richard Weinberger
2021-04-01 10:28           ` Ahmad Fatoum
2021-04-01 10:53             ` Richard Weinberger
2021-04-01 10:57               ` Ahmad Fatoum
2021-04-01 11:05                 ` Richard Weinberger
2021-04-01 11:13                   ` Ahmad Fatoum
2021-04-01 11:16                     ` Richard Weinberger
2021-03-30 22:04     ` Richard Weinberger
2021-03-30 22:16       ` James Bottomley
2021-03-31 18:36         ` Richard Weinberger
2021-03-31 18:49           ` James Bottomley
2021-03-31 19:36             ` Richard Weinberger
2021-04-01 10:06               ` Ahmad Fatoum
2021-04-01 13:20                 ` Sumit Garg
2021-04-01 18:26                   ` James Bottomley
2021-04-01 12:55       ` Sumit Garg
2021-04-01 13:17         ` Richard Weinberger [this message]
2021-04-01 13:30           ` Ahmad Fatoum
2021-04-01 13:52             ` Sumit Garg
2021-04-01 13:59               ` Richard Weinberger
2021-04-01 14:12                 ` Sumit Garg
2021-04-01 11:11     ` David Howells
2021-03-21 20:01 ` Horia Geantă
2021-03-23 16:34   ` Ahmad Fatoum
2021-03-24  6:23     ` Sumit Garg
2021-03-23 16:37   ` Ahmad Fatoum

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1666035815.140054.1617283065549.JavaMail.zimbra@nod.at \
    --to=richard@nod.at \
    --cc=a.fatoum@pengutronix.de \
    --cc=aymen.sghaier@nxp.com \
    --cc=davem@davemloft.net \
    --cc=david@sigma-star.at \
    --cc=dhowells@redhat.com \
    --cc=franck.lenormand@nxp.com \
    --cc=herbert@gondor.apana.org.au \
    --cc=horia.geanta@nxp.com \
    --cc=j.luebbe@pengutronix.de \
    --cc=jarkko@kernel.org \
    --cc=jejb@linux.ibm.com \
    --cc=jmorris@namei.org \
    --cc=kernel@pengutronix.de \
    --cc=keyrings@vger.kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=s.trumtrar@pengutronix.de \
    --cc=serge@hallyn.com \
    --cc=sumit.garg@linaro.org \
    --cc=udit.agarwal@nxp.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).