From 2e8ad91d3ddd46f8155b6b9c68ed7e1d6828aa11 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 21 Aug 2017 19:49:29 +0200 Subject: [PATCH] zkey: validate XTS key: ignore domain and card When validating an XTS key, the 2 key parts are validated separately. This can happen on different crypto cards, when more than one crypto card is available to the system. Each key part can be validated on a different card, however, the 2 cards need to have the same master key, thus the master key validation pattern contained in the 2 key parts are checked. Signed-off-by: Ingo Franzki Signed-off-by: Michael Holzheu --- zkey/zkey.c | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/zkey/zkey.c b/zkey/zkey.c index a9960386..d2736a69 100644 --- a/zkey/zkey.c +++ b/zkey/zkey.c @@ -718,7 +718,6 @@ static int key_token_change(u8 *secure_key, unsigned int secure_key_size, } static int validate_secure_xts_key(u8 *secure_key, size_t secure_key_size, - u16 part1_cardnr, u16 part1_domain, u16 part1_keysize, u32 part1_attributes, size_t *clear_key_bitsize) { @@ -765,18 +764,6 @@ static int validate_secure_xts_key(u8 *secure_key, size_t secure_key_size, return EXIT_FAILURE; } - if (verifykey.cardnr != part1_cardnr) { - pr_verbose("XTS secure key contains 2 keys using different " - "cards"); - return EXIT_FAILURE; - } - - if (verifykey.domain != part1_domain) { - pr_verbose("XTS secure key contains 2 keys using different " - "domains"); - return EXIT_FAILURE; - } - if (verifykey.keysize != part1_keysize) { pr_verbose("XTS secure key contains 2 keys using different " "key sizes"); @@ -827,8 +814,6 @@ static int validate_secure_key(u8 *secure_key, size_t secure_key_size, /* XTS uses 2 secure key tokens concatenated to each other */ if (secure_key_size > SECURE_KEY_SIZE) { rc = validate_secure_xts_key(secure_key, secure_key_size, - verifykey.cardnr, - verifykey.domain, verifykey.keysize, verifykey.attributes, clear_key_bitsize);