Re: [PATCH v1 3/3] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys

Hi!

On 25.03.2021, at 06:26, Sumit Garg [off-list ref] wrote:

On Wed, 24 Mar 2021 at 19:37, Ahmad Fatoum [off-list ref] wrote:

quoted

Hello Sumit,

On 24.03.21 11:47, Sumit Garg wrote:

quoted

On Wed, 24 Mar 2021 at 14:56, Ahmad Fatoum [off-list ref] wrote:

quoted

Hello Mimi,

On 23.03.21 19:07, Mimi Zohar wrote:

quoted

On Tue, 2021-03-23 at 17:35 +0100, Ahmad Fatoum wrote:

quoted

On 21.03.21 21:48, Horia Geantă wrote:

quoted

caam has random number generation capabilities, so it's worth using that
by implementing .get_random.

If the CAAM HWRNG is already seeding the kernel RNG, why not use the kernel's?

Makes for less code duplication IMO.

Using kernel RNG, in general, for trusted keys has been discussed
before.   Please refer to Dave Safford's detailed explanation for not
using it [1].

The argument seems to boil down to:

- TPM RNG are known to be of good quality
- Trusted keys always used it so far

Both are fine by me for TPMs, but the CAAM backend is new code and neither point
really applies.

get_random_bytes_wait is already used for generating key material elsewhere.
Why shouldn't new trusted key backends be able to do the same thing?

Please refer to documented trusted keys behaviour here [1]. New
trusted key backends should align to this behaviour and in your case
CAAM offers HWRNG so we should be better using that.

Why is it better?

Can you explain what benefit a CAAM user would have if the trusted key
randomness comes directly out of the CAAM instead of indirectly from
the kernel entropy pool that is seeded by it?

IMO, user trust in case of trusted keys comes from trusted keys
backend which is CAAM here. If a user doesn't trust that CAAM would
act as a reliable source for RNG then CAAM shouldn't be used as a
trust source in the first place.

And I think building user's trust for kernel RNG implementation with
multiple entropy contributions is pretty difficult when compared with
CAAM HWRNG implementation.

Generally speaking, I’d say trusting the CAAM RNG and trusting in it’s
other features are two separate things. However, reading through the CAAM
key blob spec I’ve got here, CAAM key blob keys (the keys that secure a blob’s
content) are generated using its internal RNG. So I’d save if the CAAM RNG
is insecure, so are generated key blobs. Maybe somebody with more insight
into the CAAM internals can verify that, but I don’t see any point in using
the kernel’s RNG as long as we let CAAM generate the key blob keys for us.

Cheers,
dave