mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
5a78c7f45d
The key check value (KCV) is the first 3 bytes of the ENC-ZERO key verification pattern of a key. ENC-ZERO encrypts an all zero block with the key using AES-ECB and returns the result truncated to 3 bytes as key check value. Report the KCV of a KMS generated key as part of its label. This is especially useful for AES-XTS keys, where the KCV is reported on each of the 2 individual AES keys that an AES-XTS key is built of. It allows users to compare the KCV displayed by zkey with the KCV displayed by the key management system where the key was generated on. If the KCV value is the same, then the key values are the same, too. The key verification pattern reported by zkey is also an ENC-ZERO key check value, but for AES-XTS keys it is built by encrypting the all zero block with AES-XTS, which produces a KCV for the complete AES-XTS key, but does not allow to check the individual key parts. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>