Re: [PATCH 0/4][RFC v2] Introduce the in-kernel hibernation encryption

From: joeyli <jlee@suse.com>
To: Oliver Neukum <oneukum@suse.com>
Cc: Yu Chen <yu.c.chen@intel.com>, Pavel Machek <pavel@ucw.cz>,
	"Rafael J . Wysocki" <rafael.j.wysocki@intel.com>,
	Eric Biggers <ebiggers@google.com>, Theodore Ts o <tytso@mit.edu>,
	Stephan Mueller <smueller@chronox.de>,
	Denis Kenzior <denkenz@gmail.com>,
	linux-pm@vger.kernel.org, linux-crypto@vger.kernel.org,
	linux-kernel@vger.kernel.org, "Gu, Kookoo" <kookoo.gu@intel.com>,
	"Zhang, Rui" <rui.zhang@intel.com>
Subject: Re: [PATCH 0/4][RFC v2] Introduce the in-kernel hibernation encryption
Date: Thu, 26 Jul 2018 16:14:04 +0800	[thread overview]
Message-ID: <20180726081404.GG4244@linux-l9pv.suse> (raw)
In-Reply-To: <1532590246.7411.3.camel@suse.com>

On Thu, Jul 26, 2018 at 09:30:46AM +0200, Oliver Neukum wrote:
> On Di, 2018-07-24 at 00:23 +0800, Yu Chen wrote:
> > 
> > Good point, we once tried to generate key in kernel, but people
> > suggest to generate key in userspace and provide it to the
> > kernel, which is what ecryptfs do currently, so it seems this
> > should also be safe for encryption in kernel.
> > https://www.spinics.net/lists/linux-crypto/msg33145.html
> > Thus Chun-Yi's signature can use EFI key and both the key from
> > user space.
> 
> Hi,
> 
> ecryptfs can trust user space. It is supposed to keep data
> safe while the system is inoperative. The whole point of Secure
> Boot is a cryptographic system of trust that does not include
> user space.
> 
> I seriously doubt we want to use trusted computing here. So the
> key needs to be generated in kernel space and stored in a safe
> manner. As we have a saolution doing that, can we come to ausable
> synthesis?
> 
> 	Regards
> 		Oliver

Crurently there have two solutions, they are trusted key and EFI key.
Both of them are generated in kernel and are not visible in user space.

The trusted key is generated by kernel then sealed by the TPM's
SRK. So the trusted key can be stored in anywhere then be enrolled
to kernel when we need it. EVM already uses it.

The EFI key is Jiri Kosina's idea. It is stored in boot services
variable, which means that it can only be access by signed EFI binary
(e.g. signed EFI boot stub) when secure boot be enabled. SLE applied
this solution a couple of years.

I am working on put the EFI key to key retention service. Then
EFI key can be a master key of encrypted key. EVM can also use
it: 
https://github.com/joeyli/linux-s4sign/commit/bae39460393ada4c0226dd07cd5e3afcef86b71f
https://github.com/joeyli/linux-s4sign/commit/f552f97cc3cca5acd84f424b7f946ffb5fe8e9ec

That's why I want to use key retention service in hibernation
encryption/authentication. Which means that we can use key
API to access trusted key and EFI key.  

Thanks
Joey Lee