From: Mattijs Korpershoek <mkorpershoek@kernel.org>
To: Igor Opaniuk <igor.opaniuk@gmail.com>, u-boot@lists.u-boot-project.org
Cc: Tom Rini <trini@konsulko.com>,
Mattijs Korpershoek <mkorpershoek@kernel.org>,
Peter Robinson <pbrobinson@gmail.com>,
Quentin Schulz <quentin.schulz@cherry.de>,
Johan Jonker <jbx6244@gmail.com>,
Igor Opaniuk <igor.opaniuk@gmail.com>
Subject: Re: [PATCH 4/4] doc: android: document the AVB root key source
Date: Mon, 10 Aug 2026 11:46:45 +0200 [thread overview]
Message-ID: <87cxvq2tq2.fsf@kernel.org> (raw)
In-Reply-To: <20260727-avb-root-key-pluggable-v1-4-7e27b2b92cc0@gmail.com>
Hi Igor,
Thank you for the patch.
On Mon, Jul 27, 2026 at 19:14, Igor Opaniuk <igor.opaniuk@gmail.com> wrote:
> The root-key choice carries security pitfalls that are not obvious from the
> Kconfig prompts alone: the built-in key is only a test key, a digest stored
> as a TEE persistent value is worthless unless the TA refuses to overwrite
> it while the device is unlocked, and the board provider must fail closed.
> Spell these out so an integrator does not ship an insecure default by
> accident.
>
> Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
> ---
prev parent reply other threads:[~2026-08-10 9:46 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-27 17:14 [PATCH 0/4] avb: make the AVB root key source pluggable Igor Opaniuk
2026-07-27 17:14 ` [PATCH 1/4] " Igor Opaniuk
2026-08-10 9:41 ` Mattijs Korpershoek
2026-07-27 17:14 ` [PATCH 2/4] avb: add OP-TEE root key digest provider Igor Opaniuk
2026-08-10 9:43 ` Mattijs Korpershoek
2026-07-27 17:14 ` [PATCH 3/4] avb: add board-specific root key provider Igor Opaniuk
2026-08-10 9:44 ` Mattijs Korpershoek
2026-07-27 17:14 ` [PATCH 4/4] doc: android: document the AVB root key source Igor Opaniuk
2026-08-10 9:46 ` Mattijs Korpershoek [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87cxvq2tq2.fsf@kernel.org \
--to=mkorpershoek@kernel.org \
--cc=igor.opaniuk@gmail.com \
--cc=jbx6244@gmail.com \
--cc=pbrobinson@gmail.com \
--cc=quentin.schulz@cherry.de \
--cc=trini@konsulko.com \
--cc=u-boot@lists.u-boot-project.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.