mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
9f99706c26
To retrieve a secure key from EKMF Web, a Elliptic-curve Diffie-Hellman (EC-DH) protocol is used to securely transport the key, without revealing the key to be transported in clear. The key to be transported remains encrypted all the time, either encrypted with the master key of the cryptographic adapter on the source or target side, or with a transport key, that is derived using the EC-DH key agreement protocol. The transport key is also a secure key, itself encrypted with the master key of the cryptographic adapters on both sides. To generate the transport key, each side generates a new secure ECC session key with its cryptographic adapter. This session keys are then used with EC-DH to derive the secure transport key. The secure key to be transported is then exported by EKMF Web under the transport key, is sent to the client, and is then imported using the transport key. The key retrieval request is signed using the identity key of the client. EKMF Web knows the public key of the client's identity key through a one time registration process, and can therefore verify the signature with the client's public key. The response is also signed by the EKMF Web server's identity key, and the client can verify the signature with the server's public key that it retrieved once during registration. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>