lkml.org 
[lkml]   [2021]   [Jan]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Migration to trusted keys: sealing user-provided key?
From
Date
On Thu, 2021-01-28 at 18:31 +0100, Ahmad Fatoum wrote:
> Hello,
>
> I've been looking into how a migration to using trusted/encrypted keys
> would look like (particularly with dm-crypt).
>
> Currently, it seems the the only way is to re-encrypt the partitions
> because trusted/encrypted keys always generate their payloads from
> RNG.
>
> If instead there was a key command to initialize a new trusted/encrypted
> key with a user provided value, users could use whatever mechanism they
> used beforehand to get a plaintext key and use that to initialize a new
> trusted/encrypted key. From there on, the key will be like any other
> trusted/encrypted key and not be disclosed again to userspace.
>
> What are your thoughts on this? Would an API like
>
>   keyctl add trusted dmcrypt-key 'set <content>' # user-supplied content
>
> be acceptable?

Maybe it's the lack of knowledge with dm-crypt, but why this would be
useful? Just want to understand the bottleneck, that's all.

> Cheers,
> Ahmad

/Jarkko

\
 
 \ /
  Last update: 2021-01-30 18:55    [W:0.096 / U:2.600 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site