mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
4d598ade86
Normally, secure keys generated by zkey are intentionally export restricted. Export restricted keys can not be wrapped with a key encrypting key (KEK). However, keys that are generated inside a Secure Execution for Linux guest that shall also be used outside of the Secure Execution for Linux guest can only be transported to outside the Secure Execution for Linux guest by wrapping them with a KEK and unwrapping them outside of the Secure Execution for Linux guest. For that such keys must be exportable. Add an option to generate and import exportable secure keys, which then can be wrapped, and thus transported to outside of a Secure Execution for Linux guest. This applies to keys of type 'CCA-AESCIPHER' and 'EP11-AES'. Keys of type 'CCA-AESDATA' are always exportable, and can not be export restricted. For keys of type 'EP11-AES' additionally allow to set the 'wrap-with-trusted' attribute. This restricts the key so that it only can be wrapped with a trusted key encrypting key. For keys of type 'EP11-AES' to be exportable, the access control point (ACP) XCP_CPB_ALLOW_COMBINED_EXTRACT must be 'ON' on all APQNs used. This access control point is only supported on newer EP11 firmware levels. If the access control point is 'OFF' or not supported by the EP11 firmware, then the IOCTL to generate the key fails with a generic error (Input/output error - EIO). The zkey tool prints an appropriate error message in that case. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
163 lines
5.7 KiB
C
163 lines
5.7 KiB
C
/*
|
|
* zkey - Generate, re-encipher, and validate secure keys
|
|
*
|
|
* Keystore handling functions
|
|
*
|
|
* Copyright IBM Corp. 2018, 2024
|
|
*
|
|
* s390-tools is free software; you can redistribute it and/or modify
|
|
* it under the terms of the MIT license. See LICENSE for details.
|
|
*/
|
|
|
|
#ifndef KEYSTORE_H
|
|
#define KEYSTORE_H
|
|
|
|
#include <stdbool.h>
|
|
|
|
#include "pkey.h"
|
|
#include "kms.h"
|
|
|
|
struct keystore {
|
|
bool verbose;
|
|
char *directory;
|
|
int lock_fd;
|
|
mode_t mode;
|
|
gid_t owner;
|
|
struct kms_info *kms_info;
|
|
};
|
|
|
|
#define PROP_NAME_KEY_TYPE "key-type"
|
|
#define PROP_NAME_CIPHER "cipher"
|
|
#define PROP_NAME_IV_MODE "iv-mode"
|
|
#define PROP_NAME_DESCRIPTION "description"
|
|
#define PROP_NAME_VOLUMES "volumes"
|
|
#define PROP_NAME_APQNS "apqns"
|
|
#define PROP_NAME_SECTOR_SIZE "sector-size"
|
|
#define PROP_NAME_CREATION_TIME "creation-time"
|
|
#define PROP_NAME_CHANGE_TIME "update-time"
|
|
#define PROP_NAME_REENC_TIME "reencipher-time"
|
|
#define PROP_NAME_KEY_VP "verification-pattern"
|
|
#define PROP_NAME_VOLUME_TYPE "volume-type"
|
|
#define PROP_NAME_KMS "kms"
|
|
#define PROP_NAME_KMS_KEY_ID "kms-key-id"
|
|
#define PROP_NAME_KMS_KEY_LABEL "kms-key-label"
|
|
#define PROP_NAME_KMS_XTS_KEY1_ID "kms-xts-key1-id"
|
|
#define PROP_NAME_KMS_XTS_KEY1_LABEL "kms-xts-key1-label"
|
|
#define PROP_NAME_KMS_XTS_KEY2_ID "kms-xts-key2-id"
|
|
#define PROP_NAME_KMS_XTS_KEY2_LABEL "kms-xts-key2-label"
|
|
|
|
struct keystore *keystore_new(const char *directory,
|
|
struct kms_info *kms_info, bool verbose);
|
|
|
|
int keystore_generate_key(struct keystore *keystore, const char *name,
|
|
const char *description, const char *volumes,
|
|
const char *apqns, bool noapqncheck,
|
|
size_t sector_size, size_t keybits, bool xts,
|
|
const char *clear_key_file, const char *volume_type,
|
|
const char *key_type, bool gen_passphrase,
|
|
const char *passphrase_file, bool exportable,
|
|
bool wrap_with_trusted, int pkey_fd);
|
|
|
|
int keystore_generate_key_kms(struct keystore *keystore, const char *name,
|
|
const char *description, const char *volumes,
|
|
size_t sector_size, size_t keybits, bool xts,
|
|
const char *volume_type, const char *key_type,
|
|
bool gen_passphrase, const char *passphrase_file,
|
|
struct kms_option *kms_options,
|
|
size_t num_kms_options);
|
|
|
|
int keystore_import(struct keystore *keystore, unsigned char *secure_key,
|
|
size_t secure_key_size, const char *name,
|
|
const char *description, const char *volumes,
|
|
const char *apqns, bool noapqncheck, size_t sector_size,
|
|
const char *volume_type, bool gen_passphrase,
|
|
const char *passphrase_file, bool exportable,
|
|
struct ext_lib *lib);
|
|
|
|
int keystore_import_key(struct keystore *keystore, const char *name,
|
|
const char *description, const char *volumes,
|
|
const char *apqns, bool noapqncheck, size_t sector_size,
|
|
const char *import_file, const char *volume_type,
|
|
bool gen_passphrase, const char *passphrase_file,
|
|
bool exportable, struct ext_lib *lib);
|
|
|
|
int keystore_change_key(struct keystore *keystore, const char *name,
|
|
const char *description, const char *volumes,
|
|
const char *apqns, bool noapqncheck,
|
|
long int sector_size, const char *volume_type,
|
|
bool gen_passphrase, const char *passphrase_file,
|
|
bool remove_passphrase, bool quiet);
|
|
|
|
int keystore_rename_key(struct keystore *keystore, const char *name,
|
|
const char *newname);
|
|
|
|
int keystore_validate_key(struct keystore *keystore, const char *name_filter,
|
|
const char *apqn_filter, bool noapqncheck,
|
|
int pkey_fd);
|
|
|
|
int keystore_reencipher_key(struct keystore *keystore, const char *name_filter,
|
|
const char *apqn_filter,
|
|
bool from_old, bool to_new, bool inplace,
|
|
bool staged, bool complete, int pkey_fd,
|
|
struct ext_lib *lib);
|
|
|
|
int keystore_copy_key(struct keystore *keystore, const char *name,
|
|
const char *newname, const char *volumes, bool local);
|
|
|
|
int keystore_export_key(struct keystore *keystore, const char *name,
|
|
const char *export_file);
|
|
|
|
int keystore_remove_key(struct keystore *keystore, const char *name,
|
|
bool quiet, struct kms_option *kms_options,
|
|
size_t num_kms_options);
|
|
|
|
int keystore_list_keys(struct keystore *keystore, const char *name_filter,
|
|
const char *volume_filter, const char *apqn_filter,
|
|
const char *volume_type, const char *key_type,
|
|
bool local, bool kms_bound);
|
|
|
|
int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
|
|
bool execute, const char *volume_type,
|
|
const char *keyfile, size_t keyfile_offset,
|
|
size_t keyfile_size, size_t tries, bool batch_mode,
|
|
bool open, bool format);
|
|
|
|
int keystore_crypttab(struct keystore *keystore, const char *volume_filter,
|
|
const char *volume_type, const char *keyfile,
|
|
size_t keyfile_offset, size_t keyfile_size, size_t tries);
|
|
|
|
int keystore_convert_key(struct keystore *keystore, const char *name,
|
|
const char *key_type, bool noapqncheck, bool quiet,
|
|
bool exportable, int pkey_fd, struct ext_lib *lib);
|
|
|
|
int keystore_kms_keys_set_property(struct keystore *keystore,
|
|
const char *key_type,
|
|
const char *prop_name,
|
|
const char *prop_value);
|
|
|
|
int keystore_kms_keys_unbind(struct keystore *keystore);
|
|
|
|
int keystore_msg_for_kms_key(struct keystore *keystore, const char *key_type,
|
|
const char *msg);
|
|
|
|
int keystore_import_kms_keys(struct keystore *keystore,
|
|
const char *label_filter,
|
|
const char *name_filter,
|
|
const char *volume_filter,
|
|
const char *volume_type,
|
|
struct kms_option *kms_options,
|
|
size_t num_kms_options,
|
|
bool batch_mode, bool novolcheck);
|
|
|
|
int keystore_refresh_kms_keys(struct keystore *keystore,
|
|
const char *name_filter,
|
|
const char *volume_filter,
|
|
const char *volume_type, const char *key_type,
|
|
bool refres_properties, bool novolcheck);
|
|
|
|
void keystore_free(struct keystore *keystore);
|
|
|
|
|
|
|
|
#endif
|