zkey: Allow to specify the key type with the generate command

The zkey generate command allows to specify the --key-type|-K
option to specify the key type. If not specified, then the
default is CCA-AESDATA.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

zkey/keystore.c

@@ -1525,11 +1525,6 @@ static int _keystore_set_default_properties(struct properties *key_props)
 {
 	int rc;
 
-	rc = properties_set(key_props, PROP_NAME_KEY_TYPE,
-			    KEY_TYPE_CCA_AESDATA);
-	if (rc != 0)
-		return rc;
-
 	rc = properties_set(key_props, PROP_NAME_CIPHER, "paes");
 	if (rc != 0)
 		return rc;
@@ -1564,6 +1559,7 @@ static int _keystore_set_default_properties(struct properties *key_props)
  *                        the sector size is not specified and the system
  *                        default is used.
  * @param[in] volume_type the type of volume
+ * @param[in] key_type    the type of the key
  */
 static int _keystore_create_info_file(struct keystore *keystore,
 				      const char *name,
@@ -1572,7 +1568,8 @@ static int _keystore_create_info_file(struct keystore *keystore,
 				      const char *volumes, const char *apqns,
 				      bool noapqncheck,
 				      size_t sector_size,
-				      const char *volume_type)
+				      const char *volume_type,
+				      const char *key_type)
 {
 	struct volume_check vol_check = { .keystore = keystore, .name = name,
 					  .set = 0 };
@@ -1594,6 +1591,12 @@ static int _keystore_create_info_file(struct keystore *keystore,
 		goto out;
 	}
 
+	rc = properties_set2(key_props, PROP_NAME_KEY_TYPE, key_type, true);
+	if (rc != 0) {
+		warnx("Invalid characters in key-type");
+		goto out;
+	}
+
 	rc = _keystore_change_association(key_props, PROP_NAME_VOLUMES,
 					  volumes != NULL ? volumes : "",
 					  "volume", _keystore_volume_check,
@@ -1731,6 +1734,7 @@ out:
  *                        clear key contained in the file denoted here.
  *                        if NULL, the secure key is generated by random.
  * @param[in] volume_type the type of volume
+ * @param[in] key_type    the type of the key
  * @param[in] pkey_fd     the file descriptor of /dev/pkey
  *
  * @returns 0 for success or a negative errno in case of an error
@@ -1740,7 +1744,7 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
 			  const char *apqns, bool noapqncheck,
 			  size_t sector_size, size_t keybits, bool xts,
 			  const char *clear_key_file, const char *volume_type,
-			  int pkey_fd)
+			  const char *key_type, int pkey_fd)
 {
 	struct key_filenames file_names = { NULL, NULL, NULL };
 	struct properties *key_props = NULL;
@@ -1749,6 +1753,12 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
 
 	util_assert(keystore != NULL, "Internal error: keystore is NULL");
 	util_assert(name != NULL, "Internal error: name is NULL");
+	util_assert(key_type != NULL, "Internal error: key_type is NULL");
+
+	if (!_keystore_valid_key_type(key_type)) {
+		warnx("Invalid key-type specified");
+		return -EINVAL;
+	}
 
 	rc = _keystore_get_key_filenames(keystore, name, &file_names);
 	if (rc != 0)
@@ -1773,13 +1783,14 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
 	if (clear_key_file == NULL)
 		rc = generate_secure_key_random(pkey_fd,
 						file_names.skey_filename,
-						keybits, xts, card, domain,
+						keybits, xts, key_type,
+						card, domain,
 						keystore->verbose);
 	else
 		rc = generate_secure_key_clear(pkey_fd,
 					       file_names.skey_filename,
 					       keybits, xts, clear_key_file,
-					       card, domain,
+					       key_type, card, domain,
 					       keystore->verbose);
 	if (rc != 0)
 		goto out_free_props;
@@ -1790,7 +1801,8 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
 
 	rc = _keystore_create_info_file(keystore, name, &file_names,
 					description, volumes, apqns,
-					noapqncheck, sector_size, volume_type);
+					noapqncheck, sector_size, volume_type,
+					key_type);
 	if (rc != 0)
 		goto out_free_props;
 
@@ -1894,7 +1906,8 @@ int keystore_import_key(struct keystore *keystore, const char *name,
 
 	rc = _keystore_create_info_file(keystore, name, &file_names,
 					description, volumes, apqns,
-					noapqncheck, sector_size, volume_type);
+					noapqncheck, sector_size, volume_type,
+					KEY_TYPE_CCA_AESDATA);
 	if (rc != 0)
 		goto out_free_props;
 

zkey/keystore.h

@@ -32,7 +32,7 @@ int keystore_generate_key(struct keystore *keystore, const char *name,
 			  const char *apqns, bool noapqncheck,
 			  size_t sector_size, size_t keybits, bool xts,
 			  const char *clear_key_file, const char *volume_type,
-			  int pkey_fd);
+			  const char *key_type, int pkey_fd);
 
 int keystore_import_key(struct keystore *keystore, const char *name,
 			const char *description, const char *volumes,

zkey/pkey.c

@@ -278,6 +278,7 @@ out:
  * @param[in] keyfile       the file name of the secure key to generate
  * @param[in] keybits       the cryptographic size of the key in bits
  * @param[in] xts           if true an XTS key is generated
+ * @param[in] key_type      the type of the key
  * @param[in] card          the card number to use (or AUTOSELECT)
  * @param[in] domain        the domain number to use (or AUTOSELECT)
  * @param[in] verbose       if true, verbose messages are printed
@@ -285,8 +286,8 @@ out:
  * @returns 0 on success, a negative errno in case of an error
  */
 int generate_secure_key_random(int pkey_fd, const char *keyfile,
-			       size_t keybits, bool xts, u16 card, u16 domain,
-			       bool verbose)
+			       size_t keybits, bool xts, const char *key_type,
+			       u16 card, u16 domain, bool verbose)
 {
 	struct pkey_genseck gensec;
 	size_t secure_key_size;
@@ -295,6 +296,12 @@ int generate_secure_key_random(int pkey_fd, const char *keyfile,
 
 	util_assert(pkey_fd != -1, "Internal error: pkey_fd is -1");
 	util_assert(keyfile != NULL, "Internal error: keyfile is NULL");
+	util_assert(key_type != NULL, "Internal error: key_type is NULL");
+
+	if (strcasecmp(key_type, KEY_TYPE_CCA_AESDATA) != 0) {
+		warnx("Invalid key-type: %s", key_type);
+		return -EINVAL;
+	}
 
 	if (keybits == 0)
 		keybits = DEFAULT_KEYBITS;
@@ -374,6 +381,7 @@ out:
  *                          determines the keybits.
  * @param[in] xts           if true an XTS key is generated
  * @param[in] clearkeyfile  the file name of the clear key to read
+ * @param[in] key_type      the type of the key
  * @param[in] card          the card number to use (or AUTOSELECT)
  * @param[in] domain        the domain number to use (or AUTOSELECT)
  * @param[in] verbose       if true, verbose messages are printed
@@ -382,7 +390,7 @@ out:
  */
 int generate_secure_key_clear(int pkey_fd, const char *keyfile,
 			      size_t keybits, bool xts,
-			      const char *clearkeyfile,
+			      const char *clearkeyfile, const char *key_type,
 			      u16 card, u16 domain,
 			      bool verbose)
 {
@@ -397,6 +405,12 @@ int generate_secure_key_clear(int pkey_fd, const char *keyfile,
 	util_assert(keyfile != NULL, "Internal error: keyfile is NULL");
 	util_assert(clearkeyfile != NULL,
 		    "Internal error: clearkeyfile is NULL");
+	util_assert(key_type != NULL, "Internal error: key_type is NULL");
+
+	if (strcasecmp(key_type, KEY_TYPE_CCA_AESDATA) != 0) {
+		warnx("Invalid key-type: %s", key_type);
+		return -EINVAL;
+	}
 
 	secure_key_size = DOUBLE_KEYSIZE_FOR_XTS(SECURE_KEY_SIZE, xts);
 	secure_key = util_malloc(secure_key_size);

zkey/pkey.h

@@ -103,12 +103,12 @@ struct pkey_verifykey {
 int open_pkey_device(bool verbose);
 
 int generate_secure_key_random(int pkey_fd, const char *keyfile,
-			       size_t keybits, bool xts, u16 card, u16 domain,
-			       bool verbose);
+			       size_t keybits, bool xts, const char *key_type,
+			       u16 card, u16 domain, bool verbose);
 
 int generate_secure_key_clear(int pkey_fd, const char *keyfile,
 			      size_t keybits, bool xts,
-			      const char *clearkeyfile,
+			      const char *clearkeyfile, const char *key_type,
 			      u16 card, u16 domain,
 			      bool verbose);
 

zkey/zkey.1

@@ -79,6 +79,8 @@ key repository.
 .RB [ \-\-xts | \-x ]
 .RB [ \-\-clearkey | \-c
 .IR clear\-key\-file ]
+.RB [ \-\-key-type | \-K
+.IR type ]
 .RB [ \-\-verbose | \-V ]
 .
 .PP
@@ -102,6 +104,8 @@ key repository.
 .RB [ \-\-xts | \-x ]
 .RB [ \-\-clearkey | \-c
 .IR clear\-key\-file ]
+.RB [ \-\-key-type | \-K
+.IR type ]
 .RB [ \-\-verbose | \-V ]
 .PP
 Use the
@@ -129,6 +133,11 @@ additional information can be associated with a secure key using the
 , or the
 .B \-\-sector-size
 options.
+.PP
+You can generate different types of secure keys: \fBCCA-AESDATA\fP keys.
+Specify the type of the secure key using the
+.B \-\-key\-type
+option. The default key type is CCA-AESDATA.
 .
 .SS "Validating secure AES keys"
 .
@@ -730,6 +739,11 @@ This option is only available if
 has been compiled with LUKS2 support enabled. If LUKS2 support is not enabled,
 the default volume type is \fBplain\fP.
 This option is only used for secure keys contained in the secure key repository.
+.TP
+.BR \-K ", " \-\-key-type\~\fItype\fP
+Specifies the key type of the secure key. Possible values are \fBCCA-AESDATA\fP.
+If this option is omitted, then a secure key of type
+CCA-AESDATA is generated.
 .
 .
 .

zkey/zkey.c

@@ -217,6 +217,15 @@ static struct util_opt opt_vec[] = {
 		.command = COMMAND_GENERATE,
 	},
 #endif
+	{
+		.option = { "key-type", required_argument, NULL, 'K'},
+		.argument = "type",
+		.desc = "The type of the key. Possible values are '"
+			KEY_TYPE_CCA_AESDATA"'. "
+			"When this option is omitted, the default is '"
+			KEY_TYPE_CCA_AESDATA"'",
+		.command = COMMAND_GENERATE,
+	},
 	/***********************************************************/
 	{
 		.flags = UTIL_OPT_FLAG_SECTION,
@@ -1019,7 +1028,7 @@ static int command_generate_clear(void)
 
 	rc = generate_secure_key_clear(g.pkey_fd, g.pos_arg,
 				       g.keybits, g.xts,
-				       g.clearkeyfile,
+				       g.clearkeyfile, g.key_type,
 				       AUTOSELECT, AUTOSELECT,
 				       g.verbose);
 
@@ -1036,7 +1045,7 @@ static int command_generate_random(void)
 	int rc;
 
 	rc = generate_secure_key_random(g.pkey_fd, g.pos_arg,
-					g.keybits, g.xts,
+					g.keybits, g.xts, g.key_type,
 					AUTOSELECT, AUTOSELECT,
 					g.verbose);
 
@@ -1058,7 +1067,7 @@ static int command_generate_repository(void)
 	rc = keystore_generate_key(g.keystore, g.name, g.description, g.volumes,
 				   g.apqns, g.noapqncheck, g.sector_size,
 				   g.keybits, g.xts, g.clearkeyfile,
-				   g.volume_type, g.pkey_fd);
+				   g.volume_type, g.key_type, g.pkey_fd);
 
 	return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
 }
@@ -1085,6 +1094,8 @@ static int command_generate(void)
 		util_prg_print_parse_error();
 		return EXIT_FAILURE;
 	}
+	if (g.key_type == NULL)
+		g.key_type = KEY_TYPE_CCA_AESDATA;
 	if (g.name != NULL)
 		return command_generate_repository();
 	if (g.pos_arg != NULL) {