aboutsummaryrefslogtreecommitdiffstats
path: root/Documentation/security
diff options
context:
space:
mode:
authorRoberto Sassu <roberto.sassu@polito.it>2011-06-27 07:45:42 -0400
committerMimi Zohar <zohar@linux.vnet.ibm.com>2011-06-27 09:10:45 -0400
commit4e561d388feff18e4b798cef6a1a84a2cc7f20c2 (patch)
tree9208588c7d0e5e75766dd2c98e960840fdc8681e /Documentation/security
parent7103dff0e598cd634767f17a2958302c515700ca (diff)
encrypted-keys: add key format support
This patch introduces a new parameter, called 'format', that defines the format of data stored by encrypted keys. The 'default' format identifies encrypted keys containing only the symmetric key, while other formats can be defined to support additional information. The 'format' parameter is written in the datablob produced by commands 'keyctl print' or 'keyctl pipe' and is integrity protected by the HMAC. Signed-off-by: Roberto Sassu <roberto.sassu@polito.it> Acked-by: Gianluca Ramunno <ramunno@polito.it> Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Diffstat (limited to 'Documentation/security')
-rw-r--r--Documentation/security/keys-trusted-encrypted.txt48
1 files changed, 30 insertions, 18 deletions
diff --git a/Documentation/security/keys-trusted-encrypted.txt b/Documentation/security/keys-trusted-encrypted.txt
index 8fb79bc1ac4b..0afcb5023c75 100644
--- a/Documentation/security/keys-trusted-encrypted.txt
+++ b/Documentation/security/keys-trusted-encrypted.txt
@@ -53,12 +53,19 @@ they are only as secure as the user key encrypting them. The master user key
53should therefore be loaded in as secure a way as possible, preferably early in 53should therefore be loaded in as secure a way as possible, preferably early in
54boot. 54boot.
55 55
56The decrypted portion of encrypted keys can contain either a simple symmetric
57key or a more complex structure. The format of the more complex structure is
58application specific, which is identified by 'format'.
59
56Usage: 60Usage:
57 keyctl add encrypted name "new key-type:master-key-name keylen" ring 61 keyctl add encrypted name "new [format] key-type:master-key-name keylen"
58 keyctl add encrypted name "load hex_blob" ring 62 ring
59 keyctl update keyid "update key-type:master-key-name" 63 keyctl add encrypted name "load hex_blob" ring
64 keyctl update keyid "update key-type:master-key-name"
65
66format:= 'default'
67key-type:= 'trusted' | 'user'
60 68
61where 'key-type' is either 'trusted' or 'user'.
62 69
63Examples of trusted and encrypted key usage: 70Examples of trusted and encrypted key usage:
64 71
@@ -114,15 +121,25 @@ Reseal a trusted key under new pcr values:
114 7ef6a24defe4846104209bf0c3eced7fa1a672ed5b125fc9d8cd88b476a658a4434644ef 121 7ef6a24defe4846104209bf0c3eced7fa1a672ed5b125fc9d8cd88b476a658a4434644ef
115 df8ae9a178e9f83ba9f08d10fa47e4226b98b0702f06b3b8 122 df8ae9a178e9f83ba9f08d10fa47e4226b98b0702f06b3b8
116 123
117Create and save an encrypted key "evm" using the above trusted key "kmk": 124The initial consumer of trusted keys is EVM, which at boot time needs a high
125quality symmetric key for HMAC protection of file metadata. The use of a
126trusted key provides strong guarantees that the EVM key has not been
127compromised by a user level problem, and when sealed to specific boot PCR
128values, protects against boot and offline attacks. Create and save an
129encrypted key "evm" using the above trusted key "kmk":
118 130
131option 1: omitting 'format'
119 $ keyctl add encrypted evm "new trusted:kmk 32" @u 132 $ keyctl add encrypted evm "new trusted:kmk 32" @u
120 159771175 133 159771175
121 134
135option 2: explicitly defining 'format' as 'default'
136 $ keyctl add encrypted evm "new default trusted:kmk 32" @u
137 159771175
138
122 $ keyctl print 159771175 139 $ keyctl print 159771175
123 trusted:kmk 32 2375725ad57798846a9bbd240de8906f006e66c03af53b1b382dbbc55 140 default trusted:kmk 32 2375725ad57798846a9bbd240de8906f006e66c03af53b1b3
124 be2a44616e4959430436dc4f2a7a9659aa60bb4652aeb2120f149ed197c564e024717c64 141 82dbbc55be2a44616e4959430436dc4f2a7a9659aa60bb4652aeb2120f149ed197c564e0
125 5972dcb82ab2dde83376d82b2e3c09ffc 142 24717c64 5972dcb82ab2dde83376d82b2e3c09ffc
126 143
127 $ keyctl pipe 159771175 > evm.blob 144 $ keyctl pipe 159771175 > evm.blob
128 145
@@ -132,14 +149,9 @@ Load an encrypted key "evm" from saved blob:
132 831684262 149 831684262
133 150
134 $ keyctl print 831684262 151 $ keyctl print 831684262
135 trusted:kmk 32 2375725ad57798846a9bbd240de8906f006e66c03af53b1b382dbbc55 152 default trusted:kmk 32 2375725ad57798846a9bbd240de8906f006e66c03af53b1b3
136 be2a44616e4959430436dc4f2a7a9659aa60bb4652aeb2120f149ed197c564e024717c64 153 82dbbc55be2a44616e4959430436dc4f2a7a9659aa60bb4652aeb2120f149ed197c564e0
137 5972dcb82ab2dde83376d82b2e3c09ffc 154 24717c64 5972dcb82ab2dde83376d82b2e3c09ffc
138
139 155
140The initial consumer of trusted keys is EVM, which at boot time needs a high 156Other uses for trusted and encrypted keys, such as for disk and file encryption
141quality symmetric key for HMAC protection of file metadata. The use of a 157are anticipated.
142trusted key provides strong guarantees that the EVM key has not been
143compromised by a user level problem, and when sealed to specific boot PCR
144values, protects against boot and offline attacks. Other uses for trusted and
145encrypted keys, such as for disk and file encryption are anticipated.