Hello,
I've been looking into how a migration to using trusted/encrypted keys
would look like (particularly with dm-crypt).
Currently, it seems the the only way is to re-encrypt the partitions
because trusted/encrypted keys always generate their payloads from
RNG.
If instead there was a key command to initialize a new trusted/encrypted
key with a user provided value, users could use whatever mechanism they
used beforehand to get a plaintext key and use that to initialize a new
trusted/encrypted key. From there on, the key will be like any other
trusted/encrypted key and not be disclosed again to userspace.
What are your thoughts on this? Would an API like
keyctl add trusted dmcrypt-key 'set <content>' # user-supplied content
be acceptable?
Cheers,
Ahmad
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
On Thu, 2021-01-28 at 18:31 +0100, Ahmad Fatoum wrote:
Hello,
I've been looking into how a migration to using trusted/encrypted keys
would look like (particularly with dm-crypt).
Currently, it seems the the only way is to re-encrypt the partitions
because trusted/encrypted keys always generate their payloads from
RNG.
If instead there was a key command to initialize a new trusted/encrypted
key with a user provided value, users could use whatever mechanism they
used beforehand to get a plaintext key and use that to initialize a new
trusted/encrypted key. From there on, the key will be like any other
trusted/encrypted key and not be disclosed again to userspace.
What are your thoughts on this? Would an API like
keyctl add trusted dmcrypt-key 'set <content>' # user-supplied content
be acceptable?
Maybe it's the lack of knowledge with dm-crypt, but why this would be
useful? Just want to understand the bottleneck, that's all.
Cheers,
Ahmad
/Jarkko
On Sat, 2021-01-30 at 19:53 +0200, Jarkko Sakkinen wrote:
On Thu, 2021-01-28 at 18:31 +0100, Ahmad Fatoum wrote:
quoted
Hello,
I've been looking into how a migration to using trusted/encrypted
keys would look like (particularly with dm-crypt).
Currently, it seems the the only way is to re-encrypt the
partitions because trusted/encrypted keys always generate their
payloads from RNG.
If instead there was a key command to initialize a new
trusted/encrypted key with a user provided value, users could use
whatever mechanism they used beforehand to get a plaintext key and
use that to initialize a new trusted/encrypted key. From there on,
the key will be like any other trusted/encrypted key and not be
disclosed again to userspace.
What are your thoughts on this? Would an API like
keyctl add trusted dmcrypt-key 'set <content>' # user-supplied
content
be acceptable?
Maybe it's the lack of knowledge with dm-crypt, but why this would be
useful? Just want to understand the bottleneck, that's all.
There was a recent patch to dm-crypt to add encrypted key support:
27f5411a718c ("dm crypt: support using encrypted keys"). The
implementation requires the actual disk encryption master key to be in
the payload. Most people don't want to change that key because it
involves re-encrypting the whole disk (usually what people mean when
they say "key" for dm-crypt is a passphrase that decrypts this master
key from a keyslot in the metadata, which is why you can change your
passphrase without changing the underlying encryption).
However, once we get the trusted key rework upstream, we do have a
solution: The key format becomes interoperable with the
openssl_tpm2_engine and we can now do seal_tpm2_data on any payload and
the kernel will accept it.
James