kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Support EP11 AES keys with prepended header to retain EP11 session

Browse Source 
The pkey kernel module supports two key blob formats for EP11 AES keys.
The first one (PKEY_TYPE_EP11) contains a 16 bytes header that overlays
the first 32 bytes of the key blob which usually contain the ID of the
EP11 session to which the key is bound. For zkey/dm-crypt that session
ID used to be all zeros. The second blob format (PKEY_TYPE_EP11_AES)
prepends the 16 bytes header to the blob, an thus does not overlay the
blob. This format can be used for key blobs that are session-bound, i.e.
have a non-zero session ID in the first 32 bytes.

Change zkey to generate EP11 keys using the new format (i.e. pkey type
PKEY_TYPE_EP11_AES), but existing key blobs using the old format can
still be used.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2023-07-21 14:06:18 +02:00
committed by Steffen Eiden
parent f46f6d34d3
commit 1b044b8a40
8 changed files with 294 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/zkey.c
+6 -2
View File
@@ -1968,7 +1968,9 @@ static int command_reencipher_file(void)
"master key has failed\n");
if (!selected &&
!is_ep11_aes_key(secure_key,
secure_key_size))
secure_key_size) &&
!is_ep11_aes_key_with_header(secure_key,
secure_key_size))
print_msg_for_cca_envvars(
"secure AES key");
}
@@ -1993,7 +1995,9 @@ static int command_reencipher_file(void)
"master key has failed\n");
if (!selected &&
!is_ep11_aes_key(secure_key,
secure_key_size))
secure_key_size) &&
!is_ep11_aes_key_with_header(secure_key,
secure_key_size))
print_msg_for_cca_envvars(
"secure AES key");
}