kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Add KMS support for 'zkey generate' command

Browse Source 
When a repository that is bound to a key management system, the
keys are generated by the key management system by default. To
generate a local key, add option '--local'.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2020-06-08 15:40:42 +02:00
committed by Jan Höppner
parent 35dd59d04c
commit bb6a47db55
8 changed files with 758 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/zkey.1
+42 -10
View File
@@ -125,25 +125,36 @@ key repository.
.IR clear\-key\-file ]
.RB [ \-\-key-type | \-K
.IR type ]
.RB [ \-\-local | \-L ]
.RB [ KMS\-plugin\ specific\ options ]
.RB [ \-\-verbose | \-V ]
.PP
Use the
.B generate
command to generate a new secure AES key either randomly within the CCA or EP11
cryptographic adapter, or from a clear AES key specified as input. When specifying
a clear key as input, the clear key should be kept in a secure place, or be
securely erased after creation of the secure key. The secure key itself does
not need to be kept secure, because it can only be used together with a
CCA or EP11 cryptographic adapter that contains the master key with which the
secure key was generated.
cryptographic adapter, from a clear AES key specified as input, or using a key
management system plugin (KMS plugin). When specifying a clear key as input, the
clear key should be kept in a secure place, or be securely erased after creation
of the secure key. The secure key itself does not need to be kept secure,
because it can only be used together with a CCA or EP11 cryptographic adapter
that contains the master key with which the secure key was generated.
.PP
When the secure key repository is bound to a key management system plugin (KMS
plugin), then the secure key is generated by using the key management system,
except the \fB\-\-local\fP option is specified.
.PP
A key management system plugin may offer plugin specific options that can be
specified with the \fBgenerate\fP command. Use \fBgenerate \-\-help\fP
to display the plugin specific options and their meaning.
.PP
The generated secure key can either be stored in a file in the file system,
or in the secure key repository. To store the generated secure key in a
file, specify the file name with option \fIsecure\-key\-file\fP. To store the
secure key in the secure key repository, specify the name of the key using the
.B \-\-name
option. When storing the secure key in a key repository,
additional information can be associated with a secure key using the
option. Secure keys generated using a key management system plugin can only be
stored in a secure key repository. When storing the secure key in a key
repository, additional information can be associated with a secure key using the
.B \-\-description
,
.B \-\-volumes
@@ -151,13 +162,18 @@ additional information can be associated with a secure key using the
.B \-\-apqns
, or the
.B \-\-sector-size
options.
options. When the secure key repository is bound to a key management system
plugin, then you can not associate specific APQNs with such keys, but the keys
inherit the APQNs that are associated with the key management system plugin.
.PP
You can generate different types of secure keys: \fBCCA-AESDATA\fP keys,
\fBCCA-AESCIPHER\fP, and \fBEP11-AES\fP keys.
Specify the type of the secure key using the
.B \-\-key\-type
option. The default key type is CCA-AESDATA.
option. Normally, the default key type is CCA-AESDATA. If the secure key
repository is bound to a key management system plugin, and the plugin does not
support keys of type CCA-AESDATA, then the default key type is CCA-AESCIPHER, or
EP11-AES, whichever the plugin supports.
.PP
.B Note:
Secure keys of type \fBCCA-AESCIPHER\fP require an IBM cryptographic
@@ -1013,6 +1029,8 @@ determines the size of the AES key. If option \fB\-\-keybits\fP
is specified, the size of the specified file must match the specified
key size. Valid file sizes are of 16, 24, or 32 bytes, and of 32 or 64
bytes for keys to be used with the XTS cipher mode.
When the secure key is generated using a key management system, then this option
can not be specified.
.TP
.BR \-N ", " \-\-name\~\fIkey-name\fP
Specifies the name of the secure key in the secure key repository.
@@ -1039,6 +1057,8 @@ then the first online APQN is used to generate the key. If no APQNs are
specified, then an APQN is selected automatically. All specified APQNs must be
online, unless the \fB\-\-no\-apqn\-check\fP option is specified.
This option is only used for secure keys contained in the secure key repository.
When the secure key is generated using a key management system, then this option
can not be specified.
.TP
.BR \-\-no\-apqn\-check
Do not check if the specified APQNs are available. Use this option to
@@ -1068,6 +1088,18 @@ Secure keys of type \fBCCA-AESCIPHER\fP require an IBM cryptographic adapter
in CCA coprocessor mode of version 6 or later, e.g. a CEX6C.
Secure keys of type \fBEP11-AES\fP require an IBM cryptographic adapter
in EP11 coprocessor mode of version 7 or later, e.g. a CEX7P.
.TP
.BR \-L ", "\-\-local
Generate the secure AES key locally. This is the default when no key management
system plugin (KMS plugin) is bound to the secure key repository. If the
repository is bound to a key management system plugin, then keys are generated
using the key management system by default.
.TP
.B KMS-plugin specific options
A key management system plugin may offer and even require plugin specific
options that can be specified with the generate command when the secure key
repository is bound to a key management system plugin. Use \fBgenerate
\-\-help\fP to display the plugin specific options and their meaning.
.
.
.