kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pvattest: Verify hybrid keys

Browse Source 
Allow pvattest verify to verify hybrid keys. The hybrid key is
represented by a sha512 hash truncated to 32 bytes.

Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Steffen Eiden
2026-07-22 17:24:38 +02:00
parent 1078e6d45f
commit 73c227fa9a
4 changed files with 51 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/pv/src/req/keyslot.rs
+15 -8
View File
@@ -4,7 +4,7 @@
//! IBM Z Host key-slot implementations.
use openssl::hash::MessageDigest;
use openssl::hash::{DigestBytes, MessageDigest};
use openssl::pkey::{PKey, PKeyRef, Private, Public};
use crate::crypto::{derive_aes256_gcm_key, derive_aes256_gcm_key_hybrid, encrypt_aead, hash};
@@ -101,6 +101,19 @@ impl KeyslotV2 {
}
}
/// calculates the sha512 of this hybrid key
pub fn sha512(&self) -> Result<DigestBytes> {
let mut phk_buf = Vec::<u8>::with_capacity(160 + 1568);
let ec_phk: EcPubKeyCoord = self.ec_hostkey.as_ref().try_into()?;
phk_buf.extend_from_slice(ec_phk.as_ref());
phk_buf.extend_from_slice(&self.mlkem_hostkey.raw_public_key()?);
assert_eq!(phk_buf.len(), 160 + 1568);
let hash = hash(MessageDigest::sha512(), &phk_buf)?;
assert_eq!(hash.len(), 64);
Ok(hash)
}
/// Encrypts `secret` using `self` and `priv_key` the encryption.
///
/// # Returns
@@ -132,12 +145,6 @@ impl KeyslotV2 {
priv_key: &PKeyRef<Private>,
to: &mut Vec<u8>,
) -> Result<()> {
let mut phk_buf = Vec::<u8>::with_capacity(160 + 1568);
let ec_phk: EcPubKeyCoord = self.ec_hostkey.as_ref().try_into()?;
phk_buf.extend_from_slice(ec_phk.as_ref());
phk_buf.extend_from_slice(&self.mlkem_hostkey.raw_public_key()?);
assert_eq!(phk_buf.len(), 160 + 1568);
let (derived_key, ciphertext) =
derive_aes256_gcm_key_hybrid(priv_key, &self.ec_hostkey, &self.mlkem_hostkey)?;
let mut wrpk_and_kst =
@@ -145,7 +152,7 @@ impl KeyslotV2 {
assert_eq!(wrpk_and_kst.len(), 48);
to.reserve(1680);
let hash = hash(MessageDigest::sha512(), &phk_buf)?;
let hash = self.sha512()?;
assert_eq!(hash.len(), 64);
to.extend_from_slice(&hash);
to.append(&mut wrpk_and_kst);