kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Support generating verification patterns for HMAC keys

Browse Source 
Similar as for AES keys, a verification pattern is calculated from an HMAC
key by MACing an all zero message of 64 bytes. The first 32 bytes of the
result is the verification pattern.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-03-12 14:16:43 +01:00
committed by Jan Höppner
parent a9059449b9
commit d9eee82ab0
5 changed files with 168 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
zkey/keystore.c
View File

@@ -1958,8 +1958,10 @@ static int _keystore_create_info_file(struct keystore *keystore,
if (rc != 0) {
warnx("Failed to generate the key verification pattern: %s",
strerror(-rc));
warnx("Make sure that kernel module 'paes_s390' is loaded and "
"that the 'paes' cipher is available");
warnx("Make sure that kernel module '%s' is loaded and "
"that the '%s' cipher is available",
is_aes_key_type(key_type) ? "paes_s390" : "phmac_s390",
is_aes_key_type(key_type) ? "paes" : "phmac");
remove(filenames->pass_filename);
goto out;
}
@@ -2251,8 +2253,10 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name,
if (rc != 0) {
warnx("Failed to generate the key verification pattern: %s",
strerror(-rc));
warnx("Make sure that kernel module 'paes_s390' is loaded and "
"that the 'paes' cipher is available");
warnx("Make sure that kernel module '%s' is loaded and "
"that the '%s' cipher is available",
is_aes_key_type(key_type) ? "paes_s390" : "phmac_s390",
is_aes_key_type(key_type) ? "paes" : "phmac");
goto out_free_props;
}
@@ -3698,8 +3702,12 @@ static int _keystore_process_reencipher(struct keystore *keystore,
warnx("Failed to generate the key verification pattern "
"for key '%s': %s", file_names->skey_filename,
strerror(-rc));
warnx("Make sure that kernel module 'paes_s390' is loaded and "
"that the 'paes' cipher is available");
warnx("Make sure that kernel module '%s' is loaded and "
"that the '%s' cipher is available",
is_aes_key(secure_key, secure_key_size) ?
"paes_s390" : "phmac_s390",
is_aes_key(secure_key, secure_key_size) ?
"paes" : "phmac");
goto out;
}
@@ -5567,8 +5575,12 @@ prompt_alt_name:
if (rc != 0) {
warnx("Failed to generate the key verification pattern: %s",
strerror(-rc));
warnx("Make sure that kernel module 'paes_s390' is loaded and "
"that the 'paes' cipher is available");
warnx("Make sure that kernel module '%s' is loaded and "
"that the '%s' cipher is available",
is_aes_key(secure_key, secure_key_size) ?
"paes_s390" : "phmac_s390",
is_aes_key(secure_key, secure_key_size) ?
"paes" : "phmac");
fatal_err = true;
goto out_remove;
}