From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: linux-integrity@vger.kernel.org, Mimi Zohar <zohar@linux.ibm.com>,
David Woodhouse <dwmw2@infradead.org>,
keyrings@vger.kernel.org
Subject: Re: [PATCH v4 0/9] TPM 2.0 trusted keys with attached policy
Date: Tue, 31 Dec 2019 16:05:51 +0000 [thread overview]
Message-ID: <20191231160539.GB4790@linux.intel.com> (raw)
In-Reply-To: <20191230173802.8731-1-James.Bottomley@HansenPartnership.com>
On Mon, Dec 30, 2019 at 09:37:53AM -0800, James Bottomley wrote:
> This is basically a respin to update the ASN.1 interface to pass
> pointers in and out instead of updating in place. The remainder of
> the patches haven't changed in substance, but have changed to support
> the new ASN.1 encoder API.
>
> General Cover letter description:
>
> I've changed the output format to use the standardised ASN.1 coding
> for TPM2 keys, meaning they should interoperate with userspace TPM2
> key implementations. Apart from interoperability, another advantage
> of the existing key format is that it carries all parameters like
> parent and hash with it and it is capable of carrying policy
> directives in a way that mean they're tied permanently to the key (no
> having to try to remember what the policy was and reconstruct it from
> userspace). This actually allows us to support the TPM 1.2 commands
> like pcrinfo easily in 2.0.
>
> Using the TPM2_PolicyPassword trick, this series now combines
> authorization with policy in a flexible way that would allow us to
> move to HMAC based authorizations later for TPM security. In getting
> passwords to work, I fixed the tpm2 password format in a separate
> patch. TPM 1.2 only allows fixed length authorizations, but TPM 2.0
> allows for variable length passphrases, so we should support that in
> the keys.
>
> James
I'll finally go deep with this as soon as we land the fixes for
https://bugzilla.kernel.org/show_bug.cgi?id 5935.
I'm sorry for ignorance but there's been multiple factors that have
delayed the review (the bug mentioned, kind of sudden steep ramp up to
keyring maintenance as David had to focus on other things, SGX
upstreaming and generally time seems to dissappear somewhere towards the
end of the year).
This week is a bit catching up but I'm sure that next week I have space
to give the focus the patch set requires (and deserves).
/Jarkko
WARNING: multiple messages have this Message-ID (diff)
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: linux-integrity@vger.kernel.org, Mimi Zohar <zohar@linux.ibm.com>,
David Woodhouse <dwmw2@infradead.org>,
keyrings@vger.kernel.org
Subject: Re: [PATCH v4 0/9] TPM 2.0 trusted keys with attached policy
Date: Tue, 31 Dec 2019 18:05:51 +0200 [thread overview]
Message-ID: <20191231160539.GB4790@linux.intel.com> (raw)
In-Reply-To: <20191230173802.8731-1-James.Bottomley@HansenPartnership.com>
On Mon, Dec 30, 2019 at 09:37:53AM -0800, James Bottomley wrote:
> This is basically a respin to update the ASN.1 interface to pass
> pointers in and out instead of updating in place. The remainder of
> the patches haven't changed in substance, but have changed to support
> the new ASN.1 encoder API.
>
> General Cover letter description:
>
> I've changed the output format to use the standardised ASN.1 coding
> for TPM2 keys, meaning they should interoperate with userspace TPM2
> key implementations. Apart from interoperability, another advantage
> of the existing key format is that it carries all parameters like
> parent and hash with it and it is capable of carrying policy
> directives in a way that mean they're tied permanently to the key (no
> having to try to remember what the policy was and reconstruct it from
> userspace). This actually allows us to support the TPM 1.2 commands
> like pcrinfo easily in 2.0.
>
> Using the TPM2_PolicyPassword trick, this series now combines
> authorization with policy in a flexible way that would allow us to
> move to HMAC based authorizations later for TPM security. In getting
> passwords to work, I fixed the tpm2 password format in a separate
> patch. TPM 1.2 only allows fixed length authorizations, but TPM 2.0
> allows for variable length passphrases, so we should support that in
> the keys.
>
> James
I'll finally go deep with this as soon as we land the fixes for
https://bugzilla.kernel.org/show_bug.cgi?id=205935.
I'm sorry for ignorance but there's been multiple factors that have
delayed the review (the bug mentioned, kind of sudden steep ramp up to
keyring maintenance as David had to focus on other things, SGX
upstreaming and generally time seems to dissappear somewhere towards the
end of the year).
This week is a bit catching up but I'm sure that next week I have space
to give the focus the patch set requires (and deserves).
/Jarkko
next prev parent reply other threads:[~2019-12-31 16:05 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-30 17:37 [PATCH v4 0/9] TPM 2.0 trusted keys with attached policy James Bottomley
2019-12-30 17:37 ` James Bottomley
2019-12-30 17:37 ` [PATCH v4 1/9] lib: add asn.1 encoder James Bottomley
2019-12-30 17:37 ` James Bottomley
2020-01-06 18:09 ` Jarkko Sakkinen
2020-01-06 18:09 ` Jarkko Sakkinen
2020-01-07 0:17 ` James Bottomley
2020-01-07 0:17 ` James Bottomley
2019-12-30 17:37 ` [PATCH v4 2/9] oid_registry: Add TCG defined OIDS for TPM keys James Bottomley
2019-12-30 17:37 ` James Bottomley
2019-12-30 17:37 ` [PATCH v4 3/9] security: keys: trusted fix tpm2 authorizations James Bottomley
2019-12-30 17:37 ` James Bottomley
2020-01-06 21:45 ` Jarkko Sakkinen
2020-01-06 21:45 ` Jarkko Sakkinen
2020-01-06 21:48 ` Jarkko Sakkinen
2020-01-06 21:48 ` Jarkko Sakkinen
2020-01-07 1:08 ` James Bottomley
2020-01-07 1:08 ` James Bottomley
2020-01-08 16:19 ` Jarkko Sakkinen
2020-01-08 16:19 ` Jarkko Sakkinen
2019-12-30 17:37 ` [PATCH v4 4/9] security: keys: trusted: use ASN.1 tpm2 key format for the blobs James Bottomley
2019-12-30 17:37 ` James Bottomley
2020-01-06 21:53 ` Jarkko Sakkinen
2020-01-06 21:53 ` Jarkko Sakkinen
2019-12-30 17:37 ` [PATCH v4 5/9] security: keys: trusted: Make sealed key properly interoperable James Bottomley
2019-12-30 17:37 ` James Bottomley
2020-01-06 21:58 ` Jarkko Sakkinen
2020-01-06 21:58 ` Jarkko Sakkinen
2019-12-30 17:37 ` [PATCH v4 6/9] security: keys: trusted: add PCR policy to TPM2 keys James Bottomley
2019-12-30 17:37 ` James Bottomley
2019-12-30 17:38 ` [PATCH v4 7/9] security: keys: trusted: add ability to specify arbitrary policy James Bottomley
2019-12-30 17:38 ` James Bottomley
2019-12-30 17:38 ` [PATCH v4 8/9] security: keys: trusted: implement counter/timer policy James Bottomley
2019-12-30 17:38 ` James Bottomley
2019-12-30 17:38 ` [PATCH v4 9/9] security: keys: trusted: add password based authorizations to policy keys James Bottomley
2019-12-30 17:38 ` James Bottomley
2019-12-31 16:05 ` Jarkko Sakkinen [this message]
2019-12-31 16:05 ` [PATCH v4 0/9] TPM 2.0 trusted keys with attached policy Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191231160539.GB4790@linux.intel.com \
--to=jarkko.sakkinen@linux.intel.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=dwmw2@infradead.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.