kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: validate XTS key: ignore domain and card

Browse Source 
When validating an XTS key, the 2 key parts are validated separately.
This can happen on different crypto cards, when more than one crypto
card is available to the system. Each key part can be validated on
a different card, however, the 2 cards need to have the same master
key, thus the master key validation pattern contained in the 2 key
parts are checked.

Signed-off-by: Ingo Franzki <ifranzki@linux.vnet.ibm.com>
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
This commit is contained in:
Ingo Franzki
2017-08-21 19:49:29 +02:00
committed by Michael Holzheu
parent 7548b470c2
commit 2e8ad91d3d
1 changed files with 0 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
zkey/zkey.c
View File

@@ -718,7 +718,6 @@ static int key_token_change(u8 *secure_key, unsigned int secure_key_size,
}
static int validate_secure_xts_key(u8 *secure_key, size_t secure_key_size,
u16 part1_cardnr, u16 part1_domain,
u16 part1_keysize, u32 part1_attributes,
size_t *clear_key_bitsize)
{
@@ -765,18 +764,6 @@ static int validate_secure_xts_key(u8 *secure_key, size_t secure_key_size,
return EXIT_FAILURE;
}
if (verifykey.cardnr != part1_cardnr) {
pr_verbose("XTS secure key contains 2 keys using different "
"cards");
return EXIT_FAILURE;
}
if (verifykey.domain != part1_domain) {
pr_verbose("XTS secure key contains 2 keys using different "
"domains");
return EXIT_FAILURE;
}
if (verifykey.keysize != part1_keysize) {
pr_verbose("XTS secure key contains 2 keys using different "
"key sizes");
@@ -827,8 +814,6 @@ static int validate_secure_key(u8 *secure_key, size_t secure_key_size,
/* XTS uses 2 secure key tokens concatenated to each other */
if (secure_key_size > SECURE_KEY_SIZE) {
rc = validate_secure_xts_key(secure_key, secure_key_size,
verifykey.cardnr,
verifykey.domain,
verifykey.keysize,
verifykey.attributes,
clear_key_bitsize);