From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f41.google.com (mail-ej1-f41.google.com [209.85.218.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8638225D2 for ; Tue, 13 Feb 2024 10:00:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707818404; cv=none; b=geb4i8JzjqniZrVKBVm/pzxmoGAmFseEWDTY5+BQoBDqTKE73WCC4SlMWooApKEkRym+n6gN3toKkX1D4ATwLN1WENMzbs3qFFgm5owr4MO5i1ogWoXqqWPbOzp/tlWHLkL/oIbcN0VwoEnzxctpKeTvaFbzXIRBWp43dtc/e50= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707818404; c=relaxed/simple; bh=ACSk1jf/AZFiby2B/e9ooFgYbhyONiPoItuRKcyxhT8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=loegWpL+ue0mdYe3Bpd+B8D82HPWg3hmXodATK5N/Jv+SDT+lhk9oTmuldauTGabPFFqa/AyIfoJqXgYiaQjFX9jsnJiY7Cb2HAv9U60uEDgDKFUVQ3UEQtQM424d1gVl9aar01/ufZKOLvktmmEvcAh31yaVM0Swb7IBEF6BVs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sigma-star.at; spf=pass smtp.mailfrom=sigma-star.at; dkim=pass (2048-bit key) header.d=sigma-star.at header.i=@sigma-star.at header.b=t3Nh5fOM; arc=none smtp.client-ip=209.85.218.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sigma-star.at Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sigma-star.at Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=sigma-star.at header.i=@sigma-star.at header.b="t3Nh5fOM" Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-a3cb228b90bso180477266b.3 for ; Tue, 13 Feb 2024 02:00:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sigma-star.at; s=google; t=1707818399; x=1708423199; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=kyeDtepLgx0McOY1pO4WdkIJtQMiPkAy0vk69/uR3rI=; b=t3Nh5fOMdbo5hs3AYuhV7+iRzgscPMB5IgBZynixUnDsGoYpfPt/5eYSV+PeQJQDq5 V8P8pWAaj8oG7kxiSh1YI5vDnYp1y2rbIFESWUtuOnHSg71ZTW5aAqjWq8VZ8GbvmeDR hSvG5D//CTaEPNL7Pe+aUr8DmUd3eG9xAqzLqOhIF30OW1f5kDpahMLFca4jp9TZgurc Uym+reZWagKZ31l5azkjmIgjR4JxNZtbi46yZFSYKj+4iiItYwOfkJizK4zlq1W05cpn rjF8eXFU9L3mPUbmnQKxzyQH9mlPduVqSTZC0kWzciWrVxoN5jpqxJlhwrW257g8O4gB UQHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1707818399; x=1708423199; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kyeDtepLgx0McOY1pO4WdkIJtQMiPkAy0vk69/uR3rI=; b=tBQoh07ByLmMlbthHqHDp8jlg7YpQyalAg/aZuIrAwgSdfV5F7FMuQbkRee2t6jrqN 54qnHN5BBAqxDWGiKERF2YHsPfN2mUbrcA9GCkAmyBN8nG70L4qrOe5z/zO0oG1R3QVc ZKagGpX5ckIqOm95ZUdP1ZxcqXeaNB0qhKEN2hmSicBFTRgrek8/HRKu/D184nn6pgLP Yi/PuW6FuVMjHBsAeV+wy6O56dafke5vwnWb7jw4MfhJuZPqUCf+2ZvpMni9wz0S77QZ p48YUOfQXSs3kk32ThlRUcz6gRBPn1l/GMQwnkbLFgdwNGTcTwBmiPE6UO7mNEOLS7cY s5nw== X-Forwarded-Encrypted: i=1; AJvYcCU0wKr2+pt8f/MawgSJmUUjCc2Qe9UBt+k7Anv6NFvXIdamzbtdCy/bPqGAQ2Qgd5jn2Q0j28xs/1zTH4k38QQWbBM+fT3jAes= X-Gm-Message-State: AOJu0Yz7Ij5kIstuJ03fLQ/Vn5CpzWUp8B1qC2E5oe38/G9n7yxRX+0z DWnu24yeFxd4KXs+674uaLHPJehEkNiBk2l+GIXj1cPohJ4HhuiT853uC8cQlD0= X-Google-Smtp-Source: AGHT+IHEjTCzJQiMRtlAWhiS4vBU8FucNsWEQmzIuMGcPfQWtxNPG6A/AHgXHP88FZXuf9FpsLb1RA== X-Received: by 2002:a17:906:da03:b0:a3c:8772:97bc with SMTP id fi3-20020a170906da0300b00a3c877297bcmr4593945ejb.70.1707818399072; Tue, 13 Feb 2024 01:59:59 -0800 (PST) X-Forwarded-Encrypted: i=1; AJvYcCU9Lvd0gIyxW7fyt4/vBOTtTFhw8BwSuz+lp9azwGwU/sEacO3hp4UP5b9jT4ZdzTXdpxRrNw3yWTkRA2mZc0ViUYvJI1T1Wil0XREjFxK6TG0gNqfdSgjrNF3pi9+7ljipOLTqFxTmPut2EvJvoC8REQLk9w3hNJDOA5mnxH5VIGqWmQD6wpqUTTkgCCec3TIQHVlmxYJ+RIbhuiDhlBe61VOjQ6ixhteHpfb50d+9J3rO+r26f2iEIQN04Loa/NxVD9DoebEX0YjEI/E0wU7EuKGFQhUzHfBc7zRzkZICZaXj2PpNdGdV7ULDQtMx1e2tHpcuaNgXcZxx53a3PrQpPSWkPLUGh9PLTugf22ZPoLA79U+WpqCLjlqJ+wMIuGy4aRX2astyccDTpqopsnoZwr+Le8XQl44nQ6XGse4g+ZsL5HSIoGYaTdcc8put9I/V4NLPaVXKQeFqCJgyDybNC8Laewb91SL/TQRVdzTVLx9+dhvfWHwYXfHQeMNJCe72RkbkPzT6l/CPkYElYVrWj8wfEITjz6UKfDibWZB9i9ao8mCJ6B/0uiw9X6zcxuJUKi9qESLTeVDKBnfWtk8P58ZkCAu03Y+qtfwccvG07ICfkjzsKxpE5Pt861yDtMR6V1bK7JZVoQ72CkFkr4h1JAMpgffeNn5a8693YQG0btUA22KCxYl748oIeBuUaU5weN0OgylotSAWDn3J+w9D8+iAVNcYDDDm6vrBuVEVe/nkWh3eCqeE3h4+ixmPB1guSaScYDm3pSJsYggz3f3662OrPJO66ThrXIAoTwKOuD3gEuyFt9um4e5fU1zMso7lcn9Y4JkbAlXk5eM5zUfdLJX36PrPI/Cm6fIT2meQUyuGG0ZG0cYTECFnY1/RtGANkJEWV5Z1TL7Y/e+1gt9IS9+hus0u+UJ6M37+PAiCR0b1Lib4J7X75weyMTYmwhW0AK mqmjwh2l9tVFgBdCifZBmXLaCEPzP813Cy13sEjfE6Aw/xPVQ1s23IRXd3yquvCIyW2lH73g1yk3Yd1QO9sJHXm84uLvW1g9PraVncRy64krUOqC22xsO9nxpucuoBjrbq Received: from blindfold.localnet ([82.150.214.1]) by smtp.gmail.com with ESMTPSA id vg9-20020a170907d30900b00a3cf4e8fdf5sm657479ejc.150.2024.02.13.01.59.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Feb 2024 01:59:58 -0800 (PST) From: Richard Weinberger To: Mimi Zohar , James Bottomley , Jarkko Sakkinen , Herbert Xu , "David S. Miller" , upstream@sigma-star.at Cc: Shawn Guo , Jonathan Corbet , Sascha Hauer , "kernel@pengutronix.de" , Fabio Estevam , NXP Linux Team , Ahmad Fatoum , sigma star Kernel Team , David Howells , Li Yang , Paul Moore , James Morris , "Serge E. Hallyn" , "Paul E. McKenney" , Randy Dunlap , Catalin Marinas , "Rafael J. Wysocki" , Tejun Heo , "Steven Rostedt (Google)" , linux-doc@vger.kernel.org, "linux-kernel@vger.kernel.org" , "linux-integrity@vger.kernel.org" , "keyrings@vger.kernel.org" , "linux-crypto@vger.kernel.org" , linux-arm-kernel@lists.infradead.org, linuxppc-dev@lists.ozlabs.org, "linux-security-module@vger.kernel.org" , David Gstir Subject: Re: [PATCH v5 0/6] DCP as trusted keys backend Date: Tue, 13 Feb 2024 10:59:56 +0100 Message-ID: <47439997.XUcTiDjVJD@somecomputer> In-Reply-To: <7AED262F-9387-446D-B11A-C549C02542F9@sigma-star.at> References: <20231215110639.45522-1-david@sigma-star.at> <7AED262F-9387-446D-B11A-C549C02542F9@sigma-star.at> Precedence: bulk X-Mailing-List: keyrings@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Am Montag, 5. Februar 2024, 09:39:07 CET schrieb David Gstir: > Hi, >=20 > > On 15.12.2023, at 12:06, David Gstir wrote: > >=20 > > This is a revival of the previous patch set submitted by Richard Weinbe= rger: > > https://lore.kernel.org/linux-integrity/20210614201620.30451-1-richard@= nod.at/ > >=20 > > v4 is here: > > https://lore.kernel.org/keyrings/20231024162024.51260-1-david@sigma-sta= r.at/ > >=20 > > v4 -> v5: > > - Make Kconfig for trust source check scalable as suggested by Jarkko S= akkinen > > - Add Acked-By from Herbert Xu to patch #1 - thanks! > > v3 -> v4: > > - Split changes on MAINTAINERS and documentation into dedicated patches > > - Use more concise wording in commit messages as suggested by Jarkko Sa= kkinen > > v2 -> v3: > > - Addressed review comments from Jarkko Sakkinen > > v1 -> v2: > > - Revive and rebase to latest version > > - Include review comments from Ahmad Fatoum > >=20 > > The Data CoProcessor (DCP) is an IP core built into many NXP SoCs such > > as i.mx6ull. > >=20 > > Similar to the CAAM engine used in more powerful SoCs, DCP can AES- > > encrypt/decrypt user data using a unique, never-disclosed, > > device-specific key. Unlike CAAM though, it cannot directly wrap and > > unwrap blobs in hardware. As DCP offers only the bare minimum feature > > set and a blob mechanism needs aid from software. A blob in this case > > is a piece of sensitive data (e.g. a key) that is encrypted and > > authenticated using the device-specific key so that unwrapping can only > > be done on the hardware where the blob was wrapped. > >=20 > > This patch series adds a DCP based, trusted-key backend and is similar > > in spirit to the one by Ahmad Fatoum [0] that does the same for CAAM. > > It is of interest for similar use cases as the CAAM patch set, but for > > lower end devices, where CAAM is not available. > >=20 > > Because constructing and parsing the blob has to happen in software, > > we needed to decide on a blob format and chose the following: > >=20 > > struct dcp_blob_fmt { > > __u8 fmt_version; > > __u8 blob_key[AES_KEYSIZE_128]; > > __u8 nonce[AES_KEYSIZE_128]; > > __le32 payload_len; > > __u8 payload[]; > > } __packed; > >=20 > > The `fmt_version` is currently 1. > >=20 > > The encrypted key is stored in the payload area. It is AES-128-GCM > > encrypted using `blob_key` and `nonce`, GCM auth tag is attached at > > the end of the payload (`payload_len` does not include the size of > > the auth tag). > >=20 > > The `blob_key` itself is encrypted in AES-128-ECB mode by DCP using > > the OTP or UNIQUE device key. A new `blob_key` and `nonce` are generated > > randomly, when sealing/exporting the DCP blob. > >=20 > > This patchset was tested with dm-crypt on an i.MX6ULL board. > >=20 > > [0] https://lore.kernel.org/keyrings/20220513145705.2080323-1-a.fatoum@= pengutronix.de/ > >=20 > > David Gstir (6): > > crypto: mxs-dcp: Add support for hardware-bound keys > > KEYS: trusted: improve scalability of trust source config > > KEYS: trusted: Introduce NXP DCP-backed trusted keys > > MAINTAINERS: add entry for DCP-based trusted keys > > docs: document DCP-backed trusted keys kernel params > > docs: trusted-encrypted: add DCP as new trust source > >=20 > > .../admin-guide/kernel-parameters.txt | 13 + > > .../security/keys/trusted-encrypted.rst | 85 +++++ > > MAINTAINERS | 9 + > > drivers/crypto/mxs-dcp.c | 104 +++++- > > include/keys/trusted_dcp.h | 11 + > > include/soc/fsl/dcp.h | 17 + > > security/keys/trusted-keys/Kconfig | 18 +- > > security/keys/trusted-keys/Makefile | 2 + > > security/keys/trusted-keys/trusted_core.c | 6 +- > > security/keys/trusted-keys/trusted_dcp.c | 311 ++++++++++++++++++ > > 10 files changed, 562 insertions(+), 14 deletions(-) > > create mode 100644 include/keys/trusted_dcp.h > > create mode 100644 include/soc/fsl/dcp.h > > create mode 100644 security/keys/trusted-keys/trusted_dcp.c >=20 > Jarkko, Mimi, David do you need anything from my side for these patches t= o get them merged? =46riendly ping also from my side. :-) Thanks, //richard =2D-=20 =E2=80=8B=E2=80=8B=E2=80=8B=E2=80=8B=E2=80=8Bsigma star gmbh | Eduard-Bodem= =2DGasse 6, 6020 Innsbruck, AUT UID/VAT Nr: ATU 66964118 | FN: 374287y From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A2266C4829A for ; Tue, 13 Feb 2024 10:00:53 +0000 (UTC) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=sigma-star.at header.i=@sigma-star.at header.a=rsa-sha256 header.s=google header.b=IJimwB3v; dkim-atps=neutral Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4TYxfX24ngz3dXK for ; Tue, 13 Feb 2024 21:00:52 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=sigma-star.at header.i=@sigma-star.at header.a=rsa-sha256 header.s=google header.b=IJimwB3v; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sigma-star.at (client-ip=2a00:1450:4864:20::62e; helo=mail-ej1-x62e.google.com; envelope-from=richard@sigma-star.at; receiver=lists.ozlabs.org) Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [IPv6:2a00:1450:4864:20::62e]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4TYxdg5dHgz2ydW for ; Tue, 13 Feb 2024 21:00:05 +1100 (AEDT) Received: by mail-ej1-x62e.google.com with SMTP id a640c23a62f3a-a3ce44c5ac0so134939466b.1 for ; Tue, 13 Feb 2024 02:00:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sigma-star.at; s=google; t=1707818399; x=1708423199; darn=lists.ozlabs.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=kyeDtepLgx0McOY1pO4WdkIJtQMiPkAy0vk69/uR3rI=; b=IJimwB3vIWcv0qeGU67Dby9ljAJsO1Z8NpHUq+L5XcqFhMnSa2IP1j8/H3PpHzHwxp 3l/IXo4PIiDogNVkSblqXlGsa6nt/Pp24f1M7tyRiju154gHAVnodBPiya5VSPOTBpVx 9nKtvi7RuBTR1FR3S6ZUteEwxtOSBVQUtmA98gcmSi/7rFIHPe20wj4RfI+HsrbL4vG8 uqEsdMpSOUduh61uVGd8Qo09CGx4qI4Nius63V74egYjFCMBWQX6I0ZKdYRU381YAtfX QEQyMaBWk9Uu1ap4smxdgj+W14vpKEEdEJYGZ3DxatckiTXdAaAkOBoGrOd3ovNk2v5m la4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1707818399; x=1708423199; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kyeDtepLgx0McOY1pO4WdkIJtQMiPkAy0vk69/uR3rI=; b=bEa/4IRsgESSDFWwqx/2LavWI3kjFKvWYd2z1WQV17NttDYeXk6mRCeOGl4Gr4V6Yt 7pa9rfYMshYPB7IVgTEy85MNIjvUp5XUR9fsVzMxYLgrWqS2tidWFbnkR+mM5muViKfC wKTe3xW/WXQ3Jm6FBBEWD3preoodcpo3SW2YAcEYQYE+0IcWvkmsMhsFS2+qT0h3uLF9 XbQRmQSPdouAcr1He5ddFW8ryiYmSgJrJEJzUz3XivrpYRwZcEeTEUB8fxXZH6mLWtoR khtLRf/zm3NtZS87xFMIk0l5xZ48VqZEjkNuzf/PLNONr7cm6R4bNdTRKtCUYBIbHpqZ TgPg== X-Forwarded-Encrypted: i=1; AJvYcCWc1KIMT1sYY3L4V7CAR8cLE3bYzG22rLOENdm77wbKtWtW90DF8gL5Ep1B7h4A8fLBjmt+/mclIDQNfwXT4Ex0HeBmMCvbMMevU7Ij+g== X-Gm-Message-State: AOJu0YyvvURwTuUETTk3cpe22KMGXrfHYM1FXc+2yU8wQUQROcWt7s3h FWOoLIN6/qkQw6Y+jOWAKhgAfz5U2ueziJ/oWrnJuaE0z+A41GobpGYsRCPsGnw= X-Google-Smtp-Source: AGHT+IHEjTCzJQiMRtlAWhiS4vBU8FucNsWEQmzIuMGcPfQWtxNPG6A/AHgXHP88FZXuf9FpsLb1RA== X-Received: by 2002:a17:906:da03:b0:a3c:8772:97bc with SMTP id fi3-20020a170906da0300b00a3c877297bcmr4593945ejb.70.1707818399072; Tue, 13 Feb 2024 01:59:59 -0800 (PST) X-Forwarded-Encrypted: i=1; AJvYcCU9Lvd0gIyxW7fyt4/vBOTtTFhw8BwSuz+lp9azwGwU/sEacO3hp4UP5b9jT4ZdzTXdpxRrNw3yWTkRA2mZc0ViUYvJI1T1Wil0XREjFxK6TG0gNqfdSgjrNF3pi9+7ljipOLTqFxTmPut2EvJvoC8REQLk9w3hNJDOA5mnxH5VIGqWmQD6wpqUTTkgCCec3TIQHVlmxYJ+RIbhuiDhlBe61VOjQ6ixhteHpfb50d+9J3rO+r26f2iEIQN04Loa/NxVD9DoebEX0YjEI/E0wU7EuKGFQhUzHfBc7zRzkZICZaXj2PpNdGdV7ULDQtMx1e2tHpcuaNgXcZxx53a3PrQpPSWkPLUGh9PLTugf22ZPoLA79U+WpqCLjlqJ+wMIuGy4aRX2astyccDTpqopsnoZwr+Le8XQl44nQ6XGse4g+ZsL5HSIoGYaTdcc8put9I/V4NLPaVXKQeFqCJgyDybNC8Laewb91SL/TQRVdzTVLx9+dhvfWHwYXfHQeMNJCe72RkbkPzT6l/CPkYElYVrWj8wfEITjz6UKfDibWZB9i9ao8mCJ6B/0uiw9X6zcxuJUKi9qESLTeVDKBnfWtk8P58ZkCAu03Y+qtfwccvG07ICfkjzsKxpE5Pt861yDtMR6V1bK7JZVoQ72CkFkr4h1JAMpgffeNn5a8693YQG0btUA22KCxYl748oIeBuUaU5weN0OgylotSAWDn3J+w9D8+iAVNcYDDDm6vrBuVEVe/nkWh3eCqeE3h4+ixmPB1guSaScYDm3pSJsYggz3f3662OrPJO66ThrXIAoTwKOuD3gEuyFt9um4e5fU1zMso7lcn9Y4JkbAlXk5eM5zUfdLJX36PrPI/Cm6fIT2meQUyuGG0ZG0cYTECFnY1/RtGANkJEWV5Z1TL7Y/e+1gt9IS9+hus0u+UJ6M37+PAiCR0b1Lib4J7X75weyMTYmwhW0AK mqmjwh2l9tVFgBdCifZBmXLaCEPzP813Cy13sEjfE6Aw/xPVQ1s23IRXd3yquvCIyW2lH73g1yk3Yd1QO9sJHXm84uLvW1g9PraVncRy64krUOqC22xsO9nxpucuoBjrbq Received: from blindfold.localnet ([82.150.214.1]) by smtp.gmail.com with ESMTPSA id vg9-20020a170907d30900b00a3cf4e8fdf5sm657479ejc.150.2024.02.13.01.59.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Feb 2024 01:59:58 -0800 (PST) From: Richard Weinberger To: Mimi Zohar , James Bottomley , Jarkko Sakkinen , Herbert Xu , "David S. Miller" , upstream@sigma-star.at Subject: Re: [PATCH v5 0/6] DCP as trusted keys backend Date: Tue, 13 Feb 2024 10:59:56 +0100 Message-ID: <47439997.XUcTiDjVJD@somecomputer> In-Reply-To: <7AED262F-9387-446D-B11A-C549C02542F9@sigma-star.at> References: <20231215110639.45522-1-david@sigma-star.at> <7AED262F-9387-446D-B11A-C549C02542F9@sigma-star.at> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: David Gstir , linux-doc@vger.kernel.org, Catalin Marinas , David Howells , "keyrings@vger.kernel.org" , Fabio Estevam , Ahmad Fatoum , Paul Moore , Jonathan Corbet , "Rafael J. Wysocki" , James Morris , NXP Linux Team , "Serge E. Hallyn" , "Paul E. McKenney" , Sascha Hauer , sigma star Kernel Team , "Steven Rostedt \(Google\)" , linux-arm-kernel@lists.infradead.org, linuxppc-dev@lists.ozlabs.org, Randy Dunlap , "linux-kernel@vger.kernel.org" , Li Yang , "linux-security-module@vger.kernel.org" , "linux-crypto@vger.kernel.org" , "kernel@pengutronix.de" , Tejun Heo , "linux-integrity@vger.kernel.org" , Shawn Guo Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Sender: "Linuxppc-dev" Am Montag, 5. Februar 2024, 09:39:07 CET schrieb David Gstir: > Hi, >=20 > > On 15.12.2023, at 12:06, David Gstir wrote: > >=20 > > This is a revival of the previous patch set submitted by Richard Weinbe= rger: > > https://lore.kernel.org/linux-integrity/20210614201620.30451-1-richard@= nod.at/ > >=20 > > v4 is here: > > https://lore.kernel.org/keyrings/20231024162024.51260-1-david@sigma-sta= r.at/ > >=20 > > v4 -> v5: > > - Make Kconfig for trust source check scalable as suggested by Jarkko S= akkinen > > - Add Acked-By from Herbert Xu to patch #1 - thanks! > > v3 -> v4: > > - Split changes on MAINTAINERS and documentation into dedicated patches > > - Use more concise wording in commit messages as suggested by Jarkko Sa= kkinen > > v2 -> v3: > > - Addressed review comments from Jarkko Sakkinen > > v1 -> v2: > > - Revive and rebase to latest version > > - Include review comments from Ahmad Fatoum > >=20 > > The Data CoProcessor (DCP) is an IP core built into many NXP SoCs such > > as i.mx6ull. > >=20 > > Similar to the CAAM engine used in more powerful SoCs, DCP can AES- > > encrypt/decrypt user data using a unique, never-disclosed, > > device-specific key. Unlike CAAM though, it cannot directly wrap and > > unwrap blobs in hardware. As DCP offers only the bare minimum feature > > set and a blob mechanism needs aid from software. A blob in this case > > is a piece of sensitive data (e.g. a key) that is encrypted and > > authenticated using the device-specific key so that unwrapping can only > > be done on the hardware where the blob was wrapped. > >=20 > > This patch series adds a DCP based, trusted-key backend and is similar > > in spirit to the one by Ahmad Fatoum [0] that does the same for CAAM. > > It is of interest for similar use cases as the CAAM patch set, but for > > lower end devices, where CAAM is not available. > >=20 > > Because constructing and parsing the blob has to happen in software, > > we needed to decide on a blob format and chose the following: > >=20 > > struct dcp_blob_fmt { > > __u8 fmt_version; > > __u8 blob_key[AES_KEYSIZE_128]; > > __u8 nonce[AES_KEYSIZE_128]; > > __le32 payload_len; > > __u8 payload[]; > > } __packed; > >=20 > > The `fmt_version` is currently 1. > >=20 > > The encrypted key is stored in the payload area. It is AES-128-GCM > > encrypted using `blob_key` and `nonce`, GCM auth tag is attached at > > the end of the payload (`payload_len` does not include the size of > > the auth tag). > >=20 > > The `blob_key` itself is encrypted in AES-128-ECB mode by DCP using > > the OTP or UNIQUE device key. A new `blob_key` and `nonce` are generated > > randomly, when sealing/exporting the DCP blob. > >=20 > > This patchset was tested with dm-crypt on an i.MX6ULL board. > >=20 > > [0] https://lore.kernel.org/keyrings/20220513145705.2080323-1-a.fatoum@= pengutronix.de/ > >=20 > > David Gstir (6): > > crypto: mxs-dcp: Add support for hardware-bound keys > > KEYS: trusted: improve scalability of trust source config > > KEYS: trusted: Introduce NXP DCP-backed trusted keys > > MAINTAINERS: add entry for DCP-based trusted keys > > docs: document DCP-backed trusted keys kernel params > > docs: trusted-encrypted: add DCP as new trust source > >=20 > > .../admin-guide/kernel-parameters.txt | 13 + > > .../security/keys/trusted-encrypted.rst | 85 +++++ > > MAINTAINERS | 9 + > > drivers/crypto/mxs-dcp.c | 104 +++++- > > include/keys/trusted_dcp.h | 11 + > > include/soc/fsl/dcp.h | 17 + > > security/keys/trusted-keys/Kconfig | 18 +- > > security/keys/trusted-keys/Makefile | 2 + > > security/keys/trusted-keys/trusted_core.c | 6 +- > > security/keys/trusted-keys/trusted_dcp.c | 311 ++++++++++++++++++ > > 10 files changed, 562 insertions(+), 14 deletions(-) > > create mode 100644 include/keys/trusted_dcp.h > > create mode 100644 include/soc/fsl/dcp.h > > create mode 100644 security/keys/trusted-keys/trusted_dcp.c >=20 > Jarkko, Mimi, David do you need anything from my side for these patches t= o get them merged? =46riendly ping also from my side. :-) Thanks, //richard =2D-=20 =E2=80=8B=E2=80=8B=E2=80=8B=E2=80=8B=E2=80=8Bsigma star gmbh | Eduard-Bodem= =2DGasse 6, 6020 Innsbruck, AUT UID/VAT Nr: ATU 66964118 | FN: 374287y From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 85ED2C4829A for ; Tue, 13 Feb 2024 10:00:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-ID:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=beKXGM8t9NT7r1X2ZdrsuEk5tyBlwg5FXT2i4a24VZ8=; b=OpZrbPv1Q0cK2d iSzmYmuowMfLIwTM/cPdA4PzalPzvR8QAnwlNkZuhTve3Ra2PgzIkkRjpoD6JEMXRIK4iRcoeLlis zD26ffsMehuzV4ZsGVgOx0YcV+gnGQRs5gQL80cIp6Ivmo/+sKA8NK5/s3G4skmiZap7dnxfpxZI6 ww0oYlDo9cc37olM58FcA4Ap3bLGeVNwPK/H62kAAbW1V69FRVZH3MfeDECAtj4Ive72VM58wuaNk YQIbOzXuOsTSUr9ScfeX1+TwGAk32CQFjaQyv3cJX3VPoVN6SrW3rxG1rKDKABVBwMJnYhuiHpejQ aV2GEy1DMxVE9SXe9NIw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rZpa9-00000008jP1-0K4Y; Tue, 13 Feb 2024 10:00:05 +0000 Received: from mail-ej1-x62a.google.com ([2a00:1450:4864:20::62a]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rZpa5-00000008jLu-2Jwq for linux-arm-kernel@lists.infradead.org; Tue, 13 Feb 2024 10:00:03 +0000 Received: by mail-ej1-x62a.google.com with SMTP id a640c23a62f3a-a2f79e79f0cso645904466b.2 for ; Tue, 13 Feb 2024 02:00:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sigma-star.at; s=google; t=1707818399; x=1708423199; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=kyeDtepLgx0McOY1pO4WdkIJtQMiPkAy0vk69/uR3rI=; b=VvQkswNm/56dETXOrFT5EIf0ghz+e3q1WNrbi+DLyPEHnPI+DoRlrajbh3Al69MFVu /7+NagF05D6H+mFpdRNzlVa2YWV1jNORJi/H8GGkCOMLMgeCWEdWT92YBgYvPw3Lc2GA lnBiHGr8GqZdydiIF98oQLv3v+TssmgcRlJpuX9biWiAfspbhdpm4skSebpLrkWqDI0Z Av2AA1i6FDlpn4ShQsSdgYFZTqvm7ySJ60hI5Hn9ip0lqU0RJ8BGa7QXBim7dIdmbutn e6KLgW3uaSPMiKkh4LrpvhbVwJZC111eDOMiNlzlgaJp0wvwV63RYeaemvz8Iw8h8Uao BJJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1707818399; x=1708423199; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kyeDtepLgx0McOY1pO4WdkIJtQMiPkAy0vk69/uR3rI=; b=aLzgL5yBI1HXJMQpJUmtX5aiECz3NghMjEOdr1ycY4MLMlAdIpMJ8IQAB2jLl9QmjL JGitLXfkNeH6L5ezxaSSlvx2+GVy5SusNWWPKEQIaBhCGX1O32waFGU+Hj7Ehp1cfRYb poCNrEfy142VBtQ4EVmWoGPEU/Auuyjf7qrBJs6nQaHyOQ5TFcG9P8LlRN9muCHq72UM 9+IE1WzWc4y3euukqm8vT/9PBMTpChT5sYJBF5iBmSC7F+1FSqIHu8YedrHpQrcx9OBb HNOI7mXo5dfycY5OztK4OR1SviXvkvMjHoGKTqJi6l24Qrv3QK2lYOIcXbGL8FlhzktU ZxDA== X-Forwarded-Encrypted: i=1; AJvYcCUKEhN351xexo1POpPO17cgKE6JtBo/NJm/YvoHbMxYGYOk2bo9k6OPGJZM4L/wjPqalHaKFQ6q+EZt9TS3gtO+obcCee+WaI63/PWUQcSZjGflHt8= X-Gm-Message-State: AOJu0Yw4/Ehfpk3KwoTlbyCWdaCA8XdGHL14xUSR+cd4MWsBiWYLcwyT HP7EDS4xQ9q9VS6Od+6K5QXA0XcIvhhGvht0tvP47zKQVWZFF6ObFGmT2R2Yo30= X-Google-Smtp-Source: AGHT+IHEjTCzJQiMRtlAWhiS4vBU8FucNsWEQmzIuMGcPfQWtxNPG6A/AHgXHP88FZXuf9FpsLb1RA== X-Received: by 2002:a17:906:da03:b0:a3c:8772:97bc with SMTP id fi3-20020a170906da0300b00a3c877297bcmr4593945ejb.70.1707818399072; Tue, 13 Feb 2024 01:59:59 -0800 (PST) X-Forwarded-Encrypted: i=1; AJvYcCU9Lvd0gIyxW7fyt4/vBOTtTFhw8BwSuz+lp9azwGwU/sEacO3hp4UP5b9jT4ZdzTXdpxRrNw3yWTkRA2mZc0ViUYvJI1T1Wil0XREjFxK6TG0gNqfdSgjrNF3pi9+7ljipOLTqFxTmPut2EvJvoC8REQLk9w3hNJDOA5mnxH5VIGqWmQD6wpqUTTkgCCec3TIQHVlmxYJ+RIbhuiDhlBe61VOjQ6ixhteHpfb50d+9J3rO+r26f2iEIQN04Loa/NxVD9DoebEX0YjEI/E0wU7EuKGFQhUzHfBc7zRzkZICZaXj2PpNdGdV7ULDQtMx1e2tHpcuaNgXcZxx53a3PrQpPSWkPLUGh9PLTugf22ZPoLA79U+WpqCLjlqJ+wMIuGy4aRX2astyccDTpqopsnoZwr+Le8XQl44nQ6XGse4g+ZsL5HSIoGYaTdcc8put9I/V4NLPaVXKQeFqCJgyDybNC8Laewb91SL/TQRVdzTVLx9+dhvfWHwYXfHQeMNJCe72RkbkPzT6l/CPkYElYVrWj8wfEITjz6UKfDibWZB9i9ao8mCJ6B/0uiw9X6zcxuJUKi9qESLTeVDKBnfWtk8P58ZkCAu03Y+qtfwccvG07ICfkjzsKxpE5Pt861yDtMR6V1bK7JZVoQ72CkFkr4h1JAMpgffeNn5a8693YQG0btUA22KCxYl748oIeBuUaU5weN0OgylotSAWDn3J+w9D8+iAVNcYDDDm6vrBuVEVe/nkWh3eCqeE3h4+ixmPB1guSaScYDm3pSJsYggz3f3662OrPJO66ThrXIAoTwKOuD3gEuyFt9um4e5fU1zMso7lcn9Y4JkbAlXk5eM5zUfdLJX36PrPI/Cm6fIT2meQUyuGG0ZG0cYTECFnY1/RtGANkJEWV5Z1TL7Y/e+1gt9IS9+hus0u+UJ6M37+PAiCR0b1Lib4J7X75weyMTYmwhW0AK mqmjwh2l9tVFgBdCifZBmXLaCEPzP813Cy13sEjfE6Aw/xPVQ1s23IRXd3yquvCIyW2lH73g1yk3Yd1QO9sJHXm84uLvW1g9PraVncRy64krUOqC22xsO9nxpucuoBjrbq Received: from blindfold.localnet ([82.150.214.1]) by smtp.gmail.com with ESMTPSA id vg9-20020a170907d30900b00a3cf4e8fdf5sm657479ejc.150.2024.02.13.01.59.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Feb 2024 01:59:58 -0800 (PST) From: Richard Weinberger To: Mimi Zohar , James Bottomley , Jarkko Sakkinen , Herbert Xu , "David S. Miller" , upstream@sigma-star.at Cc: Shawn Guo , Jonathan Corbet , Sascha Hauer , "kernel@pengutronix.de" , Fabio Estevam , NXP Linux Team , Ahmad Fatoum , sigma star Kernel Team , David Howells , Li Yang , Paul Moore , James Morris , "Serge E. Hallyn" , "Paul E. McKenney" , Randy Dunlap , Catalin Marinas , "Rafael J. Wysocki" , Tejun Heo , "Steven Rostedt (Google)" , linux-doc@vger.kernel.org, "linux-kernel@vger.kernel.org" , "linux-integrity@vger.kernel.org" , "keyrings@vger.kernel.org" , "linux-crypto@vger.kernel.org" , linux-arm-kernel@lists.infradead.org, linuxppc-dev@lists.ozlabs.org, "linux-security-module@vger.kernel.org" , David Gstir Subject: Re: [PATCH v5 0/6] DCP as trusted keys backend Date: Tue, 13 Feb 2024 10:59:56 +0100 Message-ID: <47439997.XUcTiDjVJD@somecomputer> In-Reply-To: <7AED262F-9387-446D-B11A-C549C02542F9@sigma-star.at> References: <20231215110639.45522-1-david@sigma-star.at> <7AED262F-9387-446D-B11A-C549C02542F9@sigma-star.at> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240213_020002_019515_BDC9B052 X-CRM114-Status: GOOD ( 35.34 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org QW0gTW9udGFnLCA1LiBGZWJydWFyIDIwMjQsIDA5OjM5OjA3IENFVCBzY2hyaWViIERhdmlkIEdz dGlyOgo+IEhpLAo+IAo+ID4gT24gMTUuMTIuMjAyMywgYXQgMTI6MDYsIERhdmlkIEdzdGlyIDxk YXZpZEBzaWdtYS1zdGFyLmF0PiB3cm90ZToKPiA+IAo+ID4gVGhpcyBpcyBhIHJldml2YWwgb2Yg dGhlIHByZXZpb3VzIHBhdGNoIHNldCBzdWJtaXR0ZWQgYnkgUmljaGFyZCBXZWluYmVyZ2VyOgo+ ID4gaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcvbGludXgtaW50ZWdyaXR5LzIwMjEwNjE0MjAxNjIw LjMwNDUxLTEtcmljaGFyZEBub2QuYXQvCj4gPiAKPiA+IHY0IGlzIGhlcmU6Cj4gPiBodHRwczov L2xvcmUua2VybmVsLm9yZy9rZXlyaW5ncy8yMDIzMTAyNDE2MjAyNC41MTI2MC0xLWRhdmlkQHNp Z21hLXN0YXIuYXQvCj4gPiAKPiA+IHY0IC0+IHY1Ogo+ID4gLSBNYWtlIEtjb25maWcgZm9yIHRy dXN0IHNvdXJjZSBjaGVjayBzY2FsYWJsZSBhcyBzdWdnZXN0ZWQgYnkgSmFya2tvIFNha2tpbmVu Cj4gPiAtIEFkZCBBY2tlZC1CeSBmcm9tIEhlcmJlcnQgWHUgdG8gcGF0Y2ggIzEgLSB0aGFua3Mh Cj4gPiB2MyAtPiB2NDoKPiA+IC0gU3BsaXQgY2hhbmdlcyBvbiBNQUlOVEFJTkVSUyBhbmQgZG9j dW1lbnRhdGlvbiBpbnRvIGRlZGljYXRlZCBwYXRjaGVzCj4gPiAtIFVzZSBtb3JlIGNvbmNpc2Ug d29yZGluZyBpbiBjb21taXQgbWVzc2FnZXMgYXMgc3VnZ2VzdGVkIGJ5IEphcmtrbyBTYWtraW5l bgo+ID4gdjIgLT4gdjM6Cj4gPiAtIEFkZHJlc3NlZCByZXZpZXcgY29tbWVudHMgZnJvbSBKYXJr a28gU2Fra2luZW4KPiA+IHYxIC0+IHYyOgo+ID4gLSBSZXZpdmUgYW5kIHJlYmFzZSB0byBsYXRl c3QgdmVyc2lvbgo+ID4gLSBJbmNsdWRlIHJldmlldyBjb21tZW50cyBmcm9tIEFobWFkIEZhdG91 bQo+ID4gCj4gPiBUaGUgRGF0YSBDb1Byb2Nlc3NvciAoRENQKSBpcyBhbiBJUCBjb3JlIGJ1aWx0 IGludG8gbWFueSBOWFAgU29DcyBzdWNoCj4gPiBhcyBpLm14NnVsbC4KPiA+IAo+ID4gU2ltaWxh ciB0byB0aGUgQ0FBTSBlbmdpbmUgdXNlZCBpbiBtb3JlIHBvd2VyZnVsIFNvQ3MsIERDUCBjYW4g QUVTLQo+ID4gZW5jcnlwdC9kZWNyeXB0IHVzZXIgZGF0YSB1c2luZyBhIHVuaXF1ZSwgbmV2ZXIt ZGlzY2xvc2VkLAo+ID4gZGV2aWNlLXNwZWNpZmljIGtleS4gVW5saWtlIENBQU0gdGhvdWdoLCBp dCBjYW5ub3QgZGlyZWN0bHkgd3JhcCBhbmQKPiA+IHVud3JhcCBibG9icyBpbiBoYXJkd2FyZS4g QXMgRENQIG9mZmVycyBvbmx5IHRoZSBiYXJlIG1pbmltdW0gZmVhdHVyZQo+ID4gc2V0IGFuZCBh IGJsb2IgbWVjaGFuaXNtIG5lZWRzIGFpZCBmcm9tIHNvZnR3YXJlLiBBIGJsb2IgaW4gdGhpcyBj YXNlCj4gPiBpcyBhIHBpZWNlIG9mIHNlbnNpdGl2ZSBkYXRhIChlLmcuIGEga2V5KSB0aGF0IGlz IGVuY3J5cHRlZCBhbmQKPiA+IGF1dGhlbnRpY2F0ZWQgdXNpbmcgdGhlIGRldmljZS1zcGVjaWZp YyBrZXkgc28gdGhhdCB1bndyYXBwaW5nIGNhbiBvbmx5Cj4gPiBiZSBkb25lIG9uIHRoZSBoYXJk d2FyZSB3aGVyZSB0aGUgYmxvYiB3YXMgd3JhcHBlZC4KPiA+IAo+ID4gVGhpcyBwYXRjaCBzZXJp ZXMgYWRkcyBhIERDUCBiYXNlZCwgdHJ1c3RlZC1rZXkgYmFja2VuZCBhbmQgaXMgc2ltaWxhcgo+ ID4gaW4gc3Bpcml0IHRvIHRoZSBvbmUgYnkgQWhtYWQgRmF0b3VtIFswXSB0aGF0IGRvZXMgdGhl IHNhbWUgZm9yIENBQU0uCj4gPiBJdCBpcyBvZiBpbnRlcmVzdCBmb3Igc2ltaWxhciB1c2UgY2Fz ZXMgYXMgdGhlIENBQU0gcGF0Y2ggc2V0LCBidXQgZm9yCj4gPiBsb3dlciBlbmQgZGV2aWNlcywg d2hlcmUgQ0FBTSBpcyBub3QgYXZhaWxhYmxlLgo+ID4gCj4gPiBCZWNhdXNlIGNvbnN0cnVjdGlu ZyBhbmQgcGFyc2luZyB0aGUgYmxvYiBoYXMgdG8gaGFwcGVuIGluIHNvZnR3YXJlLAo+ID4gd2Ug bmVlZGVkIHRvIGRlY2lkZSBvbiBhIGJsb2IgZm9ybWF0IGFuZCBjaG9zZSB0aGUgZm9sbG93aW5n Ogo+ID4gCj4gPiBzdHJ1Y3QgZGNwX2Jsb2JfZm10IHsKPiA+IF9fdTggZm10X3ZlcnNpb247Cj4g PiBfX3U4IGJsb2Jfa2V5W0FFU19LRVlTSVpFXzEyOF07Cj4gPiBfX3U4IG5vbmNlW0FFU19LRVlT SVpFXzEyOF07Cj4gPiBfX2xlMzIgcGF5bG9hZF9sZW47Cj4gPiBfX3U4IHBheWxvYWRbXTsKPiA+ IH0gX19wYWNrZWQ7Cj4gPiAKPiA+IFRoZSBgZm10X3ZlcnNpb25gIGlzIGN1cnJlbnRseSAxLgo+ ID4gCj4gPiBUaGUgZW5jcnlwdGVkIGtleSBpcyBzdG9yZWQgaW4gdGhlIHBheWxvYWQgYXJlYS4g SXQgaXMgQUVTLTEyOC1HQ00KPiA+IGVuY3J5cHRlZCB1c2luZyBgYmxvYl9rZXlgIGFuZCBgbm9u Y2VgLCBHQ00gYXV0aCB0YWcgaXMgYXR0YWNoZWQgYXQKPiA+IHRoZSBlbmQgb2YgdGhlIHBheWxv YWQgKGBwYXlsb2FkX2xlbmAgZG9lcyBub3QgaW5jbHVkZSB0aGUgc2l6ZSBvZgo+ID4gdGhlIGF1 dGggdGFnKS4KPiA+IAo+ID4gVGhlIGBibG9iX2tleWAgaXRzZWxmIGlzIGVuY3J5cHRlZCBpbiBB RVMtMTI4LUVDQiBtb2RlIGJ5IERDUCB1c2luZwo+ID4gdGhlIE9UUCBvciBVTklRVUUgZGV2aWNl IGtleS4gQSBuZXcgYGJsb2Jfa2V5YCBhbmQgYG5vbmNlYCBhcmUgZ2VuZXJhdGVkCj4gPiByYW5k b21seSwgd2hlbiBzZWFsaW5nL2V4cG9ydGluZyB0aGUgRENQIGJsb2IuCj4gPiAKPiA+IFRoaXMg cGF0Y2hzZXQgd2FzIHRlc3RlZCB3aXRoIGRtLWNyeXB0IG9uIGFuIGkuTVg2VUxMIGJvYXJkLgo+ ID4gCj4gPiBbMF0gaHR0cHM6Ly9sb3JlLmtlcm5lbC5vcmcva2V5cmluZ3MvMjAyMjA1MTMxNDU3 MDUuMjA4MDMyMy0xLWEuZmF0b3VtQHBlbmd1dHJvbml4LmRlLwo+ID4gCj4gPiBEYXZpZCBHc3Rp ciAoNik6Cj4gPiAgY3J5cHRvOiBteHMtZGNwOiBBZGQgc3VwcG9ydCBmb3IgaGFyZHdhcmUtYm91 bmQga2V5cwo+ID4gIEtFWVM6IHRydXN0ZWQ6IGltcHJvdmUgc2NhbGFiaWxpdHkgb2YgdHJ1c3Qg c291cmNlIGNvbmZpZwo+ID4gIEtFWVM6IHRydXN0ZWQ6IEludHJvZHVjZSBOWFAgRENQLWJhY2tl ZCB0cnVzdGVkIGtleXMKPiA+ICBNQUlOVEFJTkVSUzogYWRkIGVudHJ5IGZvciBEQ1AtYmFzZWQg dHJ1c3RlZCBrZXlzCj4gPiAgZG9jczogZG9jdW1lbnQgRENQLWJhY2tlZCB0cnVzdGVkIGtleXMg a2VybmVsIHBhcmFtcwo+ID4gIGRvY3M6IHRydXN0ZWQtZW5jcnlwdGVkOiBhZGQgRENQIGFzIG5l dyB0cnVzdCBzb3VyY2UKPiA+IAo+ID4gLi4uL2FkbWluLWd1aWRlL2tlcm5lbC1wYXJhbWV0ZXJz LnR4dCAgICAgICAgIHwgIDEzICsKPiA+IC4uLi9zZWN1cml0eS9rZXlzL3RydXN0ZWQtZW5jcnlw dGVkLnJzdCAgICAgICB8ICA4NSArKysrKwo+ID4gTUFJTlRBSU5FUlMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgICA5ICsKPiA+IGRyaXZlcnMvY3J5cHRvL214cy1kY3AuYyAg ICAgICAgICAgICAgICAgICAgICB8IDEwNCArKysrKy0KPiA+IGluY2x1ZGUva2V5cy90cnVzdGVk X2RjcC5oICAgICAgICAgICAgICAgICAgICB8ICAxMSArCj4gPiBpbmNsdWRlL3NvYy9mc2wvZGNw LmggICAgICAgICAgICAgICAgICAgICAgICAgfCAgMTcgKwo+ID4gc2VjdXJpdHkva2V5cy90cnVz dGVkLWtleXMvS2NvbmZpZyAgICAgICAgICAgIHwgIDE4ICstCj4gPiBzZWN1cml0eS9rZXlzL3Ry dXN0ZWQta2V5cy9NYWtlZmlsZSAgICAgICAgICAgfCAgIDIgKwo+ID4gc2VjdXJpdHkva2V5cy90 cnVzdGVkLWtleXMvdHJ1c3RlZF9jb3JlLmMgICAgIHwgICA2ICstCj4gPiBzZWN1cml0eS9rZXlz L3RydXN0ZWQta2V5cy90cnVzdGVkX2RjcC5jICAgICAgfCAzMTEgKysrKysrKysrKysrKysrKysr Cj4gPiAxMCBmaWxlcyBjaGFuZ2VkLCA1NjIgaW5zZXJ0aW9ucygrKSwgMTQgZGVsZXRpb25zKC0p Cj4gPiBjcmVhdGUgbW9kZSAxMDA2NDQgaW5jbHVkZS9rZXlzL3RydXN0ZWRfZGNwLmgKPiA+IGNy ZWF0ZSBtb2RlIDEwMDY0NCBpbmNsdWRlL3NvYy9mc2wvZGNwLmgKPiA+IGNyZWF0ZSBtb2RlIDEw MDY0NCBzZWN1cml0eS9rZXlzL3RydXN0ZWQta2V5cy90cnVzdGVkX2RjcC5jCj4gCj4gSmFya2tv LCBNaW1pLCBEYXZpZCBkbyB5b3UgbmVlZCBhbnl0aGluZyBmcm9tIG15IHNpZGUgZm9yIHRoZXNl IHBhdGNoZXMgdG8gZ2V0IHRoZW0gbWVyZ2VkPwoKRnJpZW5kbHkgcGluZyBhbHNvIGZyb20gbXkg c2lkZS4gOi0pCgpUaGFua3MsCi8vcmljaGFyZAoKLS0gCuKAi+KAi+KAi+KAi+KAi3NpZ21hIHN0 YXIgZ21iaCB8IEVkdWFyZC1Cb2RlbS1HYXNzZSA2LCA2MDIwIElubnNicnVjaywgQVVUClVJRC9W QVQgTnI6IEFUVSA2Njk2NDExOCB8IEZOOiAzNzQyODd5CgoKCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCmxpbnV4LWFybS1rZXJuZWwgbWFpbGluZyBsaXN0 CmxpbnV4LWFybS1rZXJuZWxAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFk ZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWFybS1rZXJuZWwK