mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
1b044b8a40
The pkey kernel module supports two key blob formats for EP11 AES keys. The first one (PKEY_TYPE_EP11) contains a 16 bytes header that overlays the first 32 bytes of the key blob which usually contain the ID of the EP11 session to which the key is bound. For zkey/dm-crypt that session ID used to be all zeros. The second blob format (PKEY_TYPE_EP11_AES) prepends the 16 bytes header to the blob, an thus does not overlay the blob. This format can be used for key blobs that are session-bound, i.e. have a non-zero session ID in the first 32 bytes. Change zkey to generate EP11 keys using the new format (i.e. pkey type PKEY_TYPE_EP11_AES), but existing key blobs using the old format can still be used. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Joerg Schmidbauer <jschmidb@de.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>