kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Add PVSECRET-HMAC key type and general HMAC support

Browse Source 
Add the definitions and utility functions for the PVSECRET-HMAC key type.
A PVSECRET-HMAC key token contains the secret id of a protected
virtualization secret. It does not contain the key material, just a
reference to the key in the ultravisor.

When such a key token is used to perform HMAC operations later on, the
PHMAC kernel cipher will obtain the protected key belonging to this secret
id with the help of the pkey kernel module.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-03-11 17:17:58 +01:00
committed by Jan Höppner
parent c3d8208a57
commit a9059449b9
9 changed files with 493 additions and 304 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/zkey-cryptsetup.c
+25 -15
View File
@@ -73,7 +73,8 @@ static void misc_print_required_parms(const char *parm_name1,
*/
static const struct util_prg prg = {
.desc = "Manage secure volume keys of volumes encrypted with LUKS2 and "
"the 'paes' cipher",
"the 'paes' cipher, and optionally integrity protected with "
"the 'phmac' cipher.",
.command_args = "COMMAND DEVICE",
.args = "",
.copyright_vec = {
@@ -234,7 +235,8 @@ static struct util_opt opt_vec[] = {
.option = {"volume-key-file", required_argument, NULL, 'm'},
.argument = "FILE-NAME",
.desc = "Specifies the name of a file containing the secure "
"AES key that is set as new volume key",
"AES key (and optionally a secure HMAC key) that "
"is set as new volume key",
.command = COMMAND_SETKEY,
},
{
@@ -332,7 +334,9 @@ static struct zkey_cryptsetup_command zkey_cryptsetup_commands[] = {
.need_pkey_device = 1,
.short_desc = "Re-encipher a secure volume key",
.long_desc = "Re-encipher a secure volume key of a volume "
"encrypted with LUKS2 and the 'paes' cipher",
"encrypted with LUKS2 and the 'paes' cipher, and "
"optionally integrity protected with the 'phmac' "
"cipher",
.has_options = 1,
.pos_arg = "DEVICE",
.open_device = 1,
@@ -345,7 +349,9 @@ static struct zkey_cryptsetup_command zkey_cryptsetup_commands[] = {
.need_pkey_device = 1,
.short_desc = "Validate a secure volume key",
.long_desc = "Validate a secure volume key of a volume "
"encrypted with LUKS2 and the 'paes' cipher",
"encrypted with LUKS2 and the 'paes' cipher, and "
"optionally integrity protected with the 'phmac' "
"cipher",
.has_options = 1,
.pos_arg = "DEVICE",
.open_device = 1,
@@ -358,9 +364,10 @@ static struct zkey_cryptsetup_command zkey_cryptsetup_commands[] = {
.need_pkey_device = 1,
.short_desc = "Set a verification pattern of the secure volume "
"key",
.long_desc = "Set a verification pattern of the secure AES "
.long_desc = "Set a verification pattern of the secure "
"volume key of a volume encrypted with LUKS2 and "
"the 'paes' cipher",
"the 'paes' cipher, and optionally integrity "
"protected with the 'phmac' cipher",
.has_options = 1,
.pos_arg = "DEVICE",
.open_device = 1,
@@ -372,8 +379,10 @@ static struct zkey_cryptsetup_command zkey_cryptsetup_commands[] = {
.function = command_setkey,
.need_pkey_device = 1,
.short_desc = "Set a new secure volume key",
.long_desc = "Set a new secure AES volume key for a volume "
"encrypted with LUKS2 and the 'paes' cipher",
.long_desc = "Set a new secure volume key for a volume "
"encrypted with LUKS2 and the 'paes' cipher, and "
"optionally integrity protected with the 'phmac' "
"cipher",
.has_options = 1,
.pos_arg = "DEVICE",
.open_device = 1,
@@ -388,7 +397,8 @@ static struct zkey_cryptsetup_command zkey_cryptsetup_commands[] = {
"secure volume key",
.long_desc = "Convert a LUKS2 volume that uses a clear volume "
"key and the 'aes' cipher to use a secure volume "
"key and the 'paes' cipher",
"key and the 'paes' cipher, optionally integrity "
"protected with the 'phmac' cipher",
.has_options = 1,
.pos_arg = "DEVICE",
.open_device = 1,
@@ -1754,7 +1764,7 @@ static int reencipher_prepare(int token)
if (rc != 0) {
if (rc == -ENODEV) {
warnx("No APQN found that is suitable for "
"re-enciphering the secure AES volume "
"re-enciphering the secure volume "
"key from the OLD to the CURRENT master "
"key.");
} else {
@@ -1766,7 +1776,7 @@ static int reencipher_prepare(int token)
!is_ep11_aes_key_with_header((u8 *)key,
securekeysize))
print_msg_for_cca_envvars(
"secure AES volume key");
"secure volume key");
rc = -EINVAL;
}
goto out;
@@ -1780,7 +1790,7 @@ static int reencipher_prepare(int token)
if (rc != 0) {
if (rc == -ENODEV) {
warnx("No APQN found that is suitable for "
"re-enciphering the secure AES volume "
"re-enciphering the secure volume "
"key from the CURRENT to the NEW master "
"key.");
} else {
@@ -1792,7 +1802,7 @@ static int reencipher_prepare(int token)
!is_ep11_aes_key_with_header((u8 *)key,
securekeysize))
print_msg_for_cca_envvars(
"secure AES volume key");
"secure volume key");
rc = -EINVAL;
}
goto out;
@@ -1923,7 +1933,7 @@ static int reencipher_complete(int token)
if (rc != 0) {
if (rc == -ENODEV) {
warnx("No APQN found that is suitable for "
"re-enciphering the secure AES volume "
"re-enciphering the secure volume "
"key from the OLD to the CURRENT master "
"key.");
} else {
@@ -1935,7 +1945,7 @@ static int reencipher_complete(int token)
!is_ep11_aes_key_with_header((u8 *)key,
securekeysize))
print_msg_for_cca_envvars(
"secure AES volume key");
"secure volume key");
rc = -EINVAL;
}
goto out;