kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Reject re-enciphering of PVSECRET-AES keys

Browse Source 
Keys of type PVSECRET-AES can not be reenciphered using 'zkey reencipher'
or 'zkey-cryptsetup reencipher'. Reject that with a proper error message.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jorg Schmidbauer <jschmidb@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-02-19 11:26:41 +01:00
committed by Steffen Eiden
parent 5276d408fd
commit a8eb2bd4e7
5 changed files with 38 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
zkey/keystore.c
View File

@@ -3567,6 +3567,15 @@ static int _keystore_process_reencipher(struct keystore *keystore,
goto out;
}
if (!is_secure_key(secure_key, secure_key_size)) {
warnx("Key '%s' is of type %s and can not be re-enciphered, "
"skipping", name, get_key_type(secure_key,
secure_key_size));
info->num_skipped++;
rc = 0;
goto out;
}
apqns = properties_get(properties, PROP_NAME_APQNS);
if (apqns != NULL)
apqn_list = str_list_split(apqns);

8
zkey/zkey-cryptsetup.1
View File

@@ -1,8 +1,8 @@
.\" Copyright IBM Corp. 2018
.\" Copyright IBM Corp. 2018, 2024
.\" s390-tools is free software; you can redistribute it and/or modify
.\" it under the terms of the MIT license. See LICENSE for details.
.\"
.TH ZKEY\-CRYPTSETUP 1 "May 2018" "s390-tools"
.TH ZKEY\-CRYPTSETUP 1 "February 2024" "s390-tools"
.SH NAME
zkey\-cryptsetup \- Manage secure AES volume keys of volumes encrypted with
\fBLUKS2\fP and the \fBpaes\fP cipher
@@ -115,6 +115,10 @@ command to re-encipher a secure AES volume key of a volume encrypted with
re-enciphered when the master key of the cryptographic adapter in CCA or EP11
coprocessor mode changes.
.PP
Volume keys of type \fBPVSECRET\-AES\fP can not be re-enciphered. These keys do
not use a cryptographic adapter, thus they do not need to be re-enciphered when
the master key of a cryptographic adapter changes.
.PP
The cryptographic adapter in CCA coprocessor mode has three different registers
to store master keys:
.RS 2

16
zkey/zkey-cryptsetup.c
View File

@@ -2,7 +2,7 @@
* zkey-cryptsetup - Re-encipher or validate volume keys of volumes
* encrypted with LUKS2 and the paes cipher.
*
* Copyright IBM Corp. 2018
* Copyright IBM Corp. 2018, 2024
*
* s390-tools is free software; you can redistribute it and/or modify
* it under the terms of the MIT license. See LICENSE for details.
@@ -82,7 +82,7 @@ static const struct util_prg prg = {
{
.owner = "IBM Corp.",
.pub_first = 2018,
.pub_last = 2018,
.pub_last = 2024,
},
UTIL_PRG_COPYRIGHT_END
}
@@ -1609,14 +1609,22 @@ static int reencipher_prepare(int token)
if (rc < 0)
goto out;
securekeysize = keysize - integrity_keysize;
if (!is_secure_key((u8 *)key, securekeysize)) {
warnx("The volume key of device '%s' is of type %s and can "
"not be re-enciphered", g.pos_arg,
get_key_type((u8 *)key, securekeysize));
rc = -EINVAL;
goto out;
}
reenc_tok.original_keyslot = rc;
rc = ensure_is_active_keylot(reenc_tok.original_keyslot);
if (rc != 0)
goto out;
securekeysize = keysize - integrity_keysize;
rc = generate_key_verification_pattern((u8 *)key, securekeysize,
reenc_tok.verification_pattern,
sizeof(reenc_tok.verification_pattern),

4
zkey/zkey.1
View File

@@ -266,6 +266,10 @@ command to re-encipher an existing secure key with a new master key.
A secure key must be re-enciphered when the master key of the CCA or EP11
cryptographic adapter changes.
.PP
Keys of type \fBPVSECRET\-AES\fP can not be re-enciphered. These keys do not
use a cryptographic adapter, thus they do not need to be re-enciphered when the
master of a cryptographic adapter changes.
.PP
The CCA cryptographic adapter has three different registers to store
master keys:
.RS 2

7
zkey/zkey.c
View File

@@ -2118,6 +2118,13 @@ static int command_reencipher_file(void)
if (secure_key == NULL)
return EXIT_FAILURE;
if (!is_secure_key(secure_key, secure_key_size)) {
warnx("A key of type %s can not be re-enciphered",
get_key_type(secure_key, secure_key_size));
rc = EXIT_FAILURE;
goto out;
}
rc = validate_secure_key(g.pkey_fd, secure_key, secure_key_size, NULL,
&is_old_mk, NULL, g.verbose);
if (rc != 0) {