mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
c04a0919f6
Add pvebc tool for parsing and verifying EBC Add-Secret-Request structures Introduce pvebc, a CLI tool that parses and verifies the integrity of Add-Secret-Request (ASR) structures used in Early Boot Customization for SEL guests. The tool processes an integrity-protected ASR structure consisting of: - toc.asr: Meta secret that links to toc.pol via relative filepath and SHA512 hash, integrity-protected by its AES GCM authentication tag - toc.pol: Policy file containing AES GCM authentication tags (last 16 bytes) of all user-provided ASRs - User ASRs: Individual Add-Secret-Requests containing encrypted secrets This structure guarantees: - Prevents ASR removal: toc.pol lists all expected ASR authentication tags - Prevents ASR insertion: Unlisted ASRs are rejected - Prevents ASR modification: AES GCM authentication tags provide cryptographic integrity - Prevents toc.pol tampering: toc.asr's integrity protection secures the link The tool verifies completeness by checking that all ASRs listed in toc.pol are present and their AES GCM authentication tags match. This prevents attackers from removing, inserting, or modifying ASRs during transport over unsecured channels. After verification, pvebc adds all ASRs to the Ultravisor (UV), which decrypts them using the guest's secret key and makes them available to the guest during early boot. Assisted-by: IBM Bob:1.0.1 Acked-by: Holger Dengler <dengler@linux.ibm.com> Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>