[lkml]   [2021]   [Jan]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Migration to trusted keys: sealing user-provided key?
On Sun, 2021-01-31 at 15:14 +0100, Jan Lübbe wrote:
> On Sun, 2021-01-31 at 07:09 -0500, Mimi Zohar wrote:


> >
> > [1] The ima-evm-utils README contains EVM examples of "trusted" and
> > "user" based "encrypted" keys.
> I assume you refer to
> "Generate EVM encrypted keys" and "Generate EVM trusted keys (TPM based)"?
> In both cases, the key used by EVM is a *newly generated* random key. The only
> difference is whether it's encrypted to a user key or a (random) trusted key.

The "encrypted" asymmetric key data doesn't change, "update" just
changes the key under which it is encrypted/decrypted.


keyctl add encrypted name "new [format] key-type:master-key-name
keyctl add encrypted name "load hex_blob" ring
keyctl update keyid "update key-type:master-key-name"


 \ /
  Last update: 2021-01-31 15:32    [W:0.129 / U:20.792 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site