[lkml]   [2018]   [May]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 07/24] hibernate: Disable when the kernel is locked down
Hi experts, 

Sorry for I missed this discussion...

On Thu, Apr 26, 2018 at 10:20:29AM +0200, Jiri Kosina wrote:
> On Thu, 26 Apr 2018, Pavel Machek wrote:
> > That's not how the crypto needs to work. Talk to Jiri Kosina, ok?
> Yeah, Joey Lee (adding to CC) implemented it here:
> I think there have been more respins, Joey definitely knows more details
> and status quo.
> The design is specifically tailored for secure-boot environments though.

I am working on the next version of hibernation encryption and authentication:

My plan is:

- Hibernation encryption:
There is a draft patch to encrypt image by ctr(aes). This patch works
with the first version of hibernation verification:

- Adapt hibernation to key retention service:
- Using the encrypted key to derive encrypt key and auth key to
encrypt and hmac snapshot image. Put the encrypted key in the image
header of snapshot.
- The encrypted key will be encrypted by KMK (kernel master key). Either
trusted key(sealed by TPM) or EFI key (explain in later) can be the KMK.
If there have appropriate UI support in initrd, user key can also be
the KMK.
- Similar with the enrolling EVM key, but more earler:
The systemd and dracut must be changed for enrolling kernel master key
before the swap partition be mounted.

- EFI key:
- A new master key type to key retention service.
- It can be a new option beyond trusted key(TPM) and user key.
- EFI stub generates a random key and stores in EFI boot service
- This random key in boot variable can be called ERK (EFI Root Key)
- The ERK is secure when secure boot enabled.
- User must aware and enable secure boot by themself if they want.
- ERK can be a secret to encrypt a random number for generate a EFI key
- The EFI key can be used by hibernation encryption/authentication.
- The EFI key can be a master key to generate a encrypted key for EVM.
- Rescue mechanism for ERK:
- The ERK may be regenerated after the old ERK be erased by firmware update
or firmware recovery.
- Current idea is using the public key in first/second trusted keyring
to encrypt the ERK for backup. User can enroll the EFI key with old ERK to
request kernel to re-encrypt the EFI key with new ERK.

Thanks a lot!
Joey Lee

 \ /
  Last update: 2018-05-23 10:47    [W:0.132 / U:1.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site