kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Remove the use of AF_ALG for calculating key verification patterns

Browse Source 
Instead of using AF_ALG to calculate key verification patterns, transform
the key blob into a protected key and calculate the key verification
patterns with CAPCF calls.

The 'zkey-cryptsetup convert' command also calculates key verification
patterns from clear keys. Support this, too.

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-08 13:15:30 +02:00
committed by Jan Höppner
parent 44d6020774
commit 7fffdcfe8c
8 changed files with 1098 additions and 221 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
zkey/pkey.h
View File

@@ -170,6 +170,10 @@ struct pkey_clrkey {
#define PKEY_KEYTYPE_AES_128 1
#define PKEY_KEYTYPE_AES_192 2
#define PKEY_KEYTYPE_AES_256 3
#define PKEY_KEYTYPE_AES_XTS_128 10
#define PKEY_KEYTYPE_AES_XTS_256 11
#define PKEY_KEYTYPE_HMAC_512 12
#define PKEY_KEYTYPE_HMAC_1024 13
struct pkey_genseck {
u16 cardnr; /* in: card to use or FFFF for any */
@@ -310,6 +314,10 @@ struct pkey_kblob2pkey3 {
#define PKEY_KBLOB2PROTK3 _IOWR(PKEY_IOCTL_MAGIC, 0x1D, struct pkey_kblob2pkey3)
#define MAX_AES_PROTKEYSIZE 64
#define MAX_XTSFULL_PROTKEYSIZE 96
#define MAX_HMAC_PROTKEYSIZE 160
#define KEY_TYPE_CCA_AESDATA "CCA-AESDATA"
#define KEY_TYPE_CCA_AESCIPHER "CCA-AESCIPHER"
#define KEY_TYPE_EP11_AES "EP11-AES"