kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Add KMS key properties and show them with list and validate

Browse Source 
To support keys that are bound to a key management system (via a KMS
plugin) add new key properties that reflect this. Display if a key is
bound to a KMS with the 'zkey list' and 'zkey validate' commands.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2020-06-03 11:01:31 +02:00
committed by Jan Höppner
parent f25aaf32b8
commit 92fc94f152
5 changed files with 224 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/zkey.1
+36 -6
View File
@@ -1,8 +1,8 @@
.\" Copyright IBM Corp. 2017, 2018
.\" Copyright IBM Corp. 2017, 2020
.\" s390-tools is free software; you can redistribute it and/or modify
.\" it under the terms of the MIT license. See LICENSE for details.
.\"
.TH ZKEY 1 "May 2018" "s390-tools"
.TH ZKEY 1 "July 2020" "s390-tools"
.SH NAME
zkey \- Manage secure AES keys
.
@@ -56,6 +56,17 @@ length of 128, or 256 bits each, for keys that are used for the XTS cipher mode.
Note that the file size is not related to the key bit size, but is specific for
the secure key type. The key is enciphered with the master key of the CCA or
EP11 cryptographic adapter.
.PP
Secure keys in a key repository can either be generated locally, or by a \fBkey
management system (KMS)\fP. A key repository can be bound to a key management
system (KMS) via a key management system plugin (KMS plugin), which builds the
interface to the key management system. This allows to integrate a zkey key
repository into an enterprise key management system, that manages the keys in
a larger environment.
When a key repository is bound to a key management system, then all keys are
generated by the key management system per default, and are thus also bound to
the key management system. Any additional information associated with the keys
in the repository is also stored in the key management system.
.
.
.
@@ -402,6 +413,8 @@ The exported secure key also remains in the secure key repository.
.IR type ]
.RB [ \-\-key-type | \-K
.IR type ]
.RB [ \-\-local | \-L ]
.RB [ \-\-kms\-bound | \-M ]
.RB [ \-\-verbose | \-V ]
.
.PP
@@ -409,8 +422,9 @@ Use the
.B list
command to display a list of secure keys contained in the secure key repository.
You can filter the displayed list by key name, associated volumes, associated
cryptographic adapters (APQNs), and volume type. You can use wildcards for the
key name, associated APQNs, and associated volumes. The device-mapper name of an
cryptographic adapters (APQNs), volume type, and whether the keys are local or
bound to a key management system (MKS). You can use wildcards for the key name,
associated APQNs, and associated volumes. The device-mapper name of an
associated volume can be omitted; if it is specified then only those keys are
listed that are associated with the specified volume and device-mapper name.
.PP
@@ -419,8 +433,9 @@ The
command displays the attributes of the secure keys, such as key sizes, key type,
whether it is a secure key that can be used for the XTS cipher mode, the textual
description, associated cryptographic adapters (APQNs) and volumes, the
sector size, the key verification pattern, and timestamps for key creation, last
modification and last re-encipherment.
sector size, the key verification pattern, timestamps for key creation, last
modification and last re-encipherment, and whether the key is local or
bound to a key management systen (KMS).
.
.SS "Remove existing AES secure keys from the secure key repository"
.
@@ -1024,6 +1039,21 @@ Specifies the key type of the secure key. Possible values are \fBCCA-AESDATA\fP,
\fBCCA-AESCIPHER\fP, and \fBEP11-AES\fP. Only keys with the specified key type
are listed.
This option is only used for secure keys contained in the secure key repository.
.TP
.BR \-L ", " \-\-local\fP
Lists only local keys. Local keys are not bound to a key management system
(KMS).
This option is only used for secure keys contained in the secure key repository,
and can not be specified together with the
.BR \-\-kms\-bound
option.
.TP
.BR \-M ", " \-\-kms\-bound\fP
Lists only keys that are bound to a key management system (KMS).
This option is only used for secure keys contained in the secure key repository,
and can not be specified together with the
.BR \-\-local
option.
.
.
.