From: Paolo Bonzini <pbonzini@redhat.com>
To: "Hao Feng" <fenghao@hygon.cn>,
"'Tom Lendacky '" <thomas.lendacky@amd.com>,
"'Gary Hook '" <gary.hook@amd.com>,
"'Herbert Xu '" <herbert@gondor.apana.org.au>,
"' David S. Miller '" <davem@davemloft.net>,
"'Janakarajan Natarajan '" <Janakarajan.Natarajan@amd.com>,
"'Joerg Roedel '" <joro@8bytes.org>,
"' Radim Krčmář '" <rkrcmar@redhat.com>,
"'Thomas Gleixner '" <tglx@linutronix.de>,
"'Ingo Molnar '" <mingo@redhat.com>,
"'Borislav Petkov '" <bp@alien8.de>,
"' H. Peter Anvin '" <hpa@zytor.com>
Cc: 'Zhaohui Du ' <duzhaohui@hygon.cn>,
'Zhiwei Ying ' <yingzhiwei@hygon.cn>, 'Wen Pu ' <puwen@hygon.cn>,
x86@kernel.org, linux-crypto@vger.kernel.org,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 0/6] Add Hygon SEV support
Date: Mon, 15 Apr 2019 17:37:49 +0200 [thread overview]
Message-ID: <3a1288ab-8e18-5421-05b4-4f4ef2fc531c@redhat.com> (raw)
In-Reply-To: <1555329868-17895-1-git-send-email-fenghao@hygon.cn>
On 15/04/19 14:04, Hao Feng wrote:
> Hygon SEV follows AMD SEV work flow, but uses China national standard
> cryptographic algorithms SM2/SM3/SM4 instead of (RSA, ECDSA,
> ECDH)/SHA/AES. Reuse most AMD SEV code path to support Hygon SEV,
> also adds 3 new commands(GM_PUBKEY_GEN, GM_GET_DIGEST,
> GM_VERIFY_DIGEST) to support SM2 key exchange protocol.
>
> SM2 is based on ECC(Elliptic Curve Cryptography), and uses a special
> curve. It can be used in digital signature, key exchange and
> asymmetric cryptography. For key exchange, SM2 is similar to ECDH, but
> involves new random key, meaning the two sides need to exchange extra
> random public key besides their public key, that's why additional APIs
> are needed to support Hygon SEV.
> SM3 is a hash algorithm, similar to SHA-256.
> SM4 is a block cipher algorithm, similar to AES-128.
I don't see SM2 and SM3 implemented elsewhere in Linux. SM4 is only
supported by a few wireless drivers.
Apart from the concerns that Thomas mentioned, you have to convince the
rest of the community that these primitives are secure (for example by
contributing support for them to drivers/crypto), and then KVM will
start using them.
Because as far as I know, they could be just as secure as double rot13.
Paolo
next prev parent reply other threads:[~2019-04-15 15:38 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-15 12:04 [PATCH 0/6] Add Hygon SEV support Hao Feng
2019-04-15 12:04 ` [PATCH 1/6] crypto: ccp: Add Hygon Dhyana support Hao Feng
2019-04-15 12:04 ` [PATCH 2/6] crypto: ccp: Define Hygon SEV commands Hao Feng
2019-04-15 12:04 ` [PATCH 3/6] crypto: ccp: Implement SEV_GM_PUBKEY_GEN ioctl command Hao Feng
2019-04-15 12:04 ` [PATCH 4/6] KVM: Define Hygon SEV commands Hao Feng
2019-04-15 12:04 ` [PATCH 5/6] KVM: SVM: Add support for KVM_SEV_GM_GET_DIGEST command Hao Feng
2019-04-15 15:09 ` Borislav Petkov
[not found] ` <896956377bf441c3bfd911716418ce7e@hygon.cn>
2019-04-16 8:15 ` Borislav Petkov
2019-04-16 11:47 ` Hao Feng
2019-04-15 12:04 ` [PATCH 6/6] KVM: SVM: Add support for KVM_SEV_GM_VERIFY_DIGEST command Hao Feng
2019-04-15 15:32 ` [PATCH 0/6] Add Hygon SEV support Lendacky, Thomas
2019-04-15 15:37 ` Paolo Bonzini [this message]
2019-04-15 15:51 ` Pascal Van Leeuwen
2019-04-15 16:04 ` Paolo Bonzini
2019-04-16 6:58 ` Pascal Van Leeuwen
2019-04-16 8:09 ` Paolo Bonzini
2019-04-16 9:08 ` Pascal Van Leeuwen
2019-04-16 10:28 ` Hao Feng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3a1288ab-8e18-5421-05b4-4f4ef2fc531c@redhat.com \
--to=pbonzini@redhat.com \
--cc=Janakarajan.Natarajan@amd.com \
--cc=bp@alien8.de \
--cc=davem@davemloft.net \
--cc=duzhaohui@hygon.cn \
--cc=fenghao@hygon.cn \
--cc=gary.hook@amd.com \
--cc=herbert@gondor.apana.org.au \
--cc=hpa@zytor.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=puwen@hygon.cn \
--cc=rkrcmar@redhat.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=x86@kernel.org \
--cc=yingzhiwei@hygon.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).