mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
4d598ade86
Normally, secure keys generated by zkey are intentionally export restricted. Export restricted keys can not be wrapped with a key encrypting key (KEK). However, keys that are generated inside a Secure Execution for Linux guest that shall also be used outside of the Secure Execution for Linux guest can only be transported to outside the Secure Execution for Linux guest by wrapping them with a KEK and unwrapping them outside of the Secure Execution for Linux guest. For that such keys must be exportable. Add an option to generate and import exportable secure keys, which then can be wrapped, and thus transported to outside of a Secure Execution for Linux guest. This applies to keys of type 'CCA-AESCIPHER' and 'EP11-AES'. Keys of type 'CCA-AESDATA' are always exportable, and can not be export restricted. For keys of type 'EP11-AES' additionally allow to set the 'wrap-with-trusted' attribute. This restricts the key so that it only can be wrapped with a trusted key encrypting key. For keys of type 'EP11-AES' to be exportable, the access control point (ACP) XCP_CPB_ALLOW_COMBINED_EXTRACT must be 'ON' on all APQNs used. This access control point is only supported on newer EP11 firmware levels. If the access control point is 'OFF' or not supported by the EP11 firmware, then the IOCTL to generate the key fails with a generic error (Input/output error - EIO). The zkey tool prints an appropriate error message in that case. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>