Re: Reading public key portion of asymmetric keys

["Jarkko Sakkinen" <jarkko@kernel.org>]

On Fri Nov 8, 2024 at 9:44 PM EET, Jarkko Sakkinen wrote:
> On Mon Sep 30, 2024 at 9:40 PM EEST, James Prestwood wrote:
> > Hi,
> >
> > Unless I'm missing something it does not seem possible to read back the 
> > public key portion of an asymmetric key to userspace once added to the 
> > kernel. I have a use case where two separate applications need to 
> > perform crypto operations using the same private/public key pair and for 
> > added security it would be convenient to add the key (or load from TPM) 
> > once and pass around a key ID rather than the keys themselves.
> >
> > One of the things I need is to create and sign a CSR. To create the CSR 
> > I need the public key contents which can't be obtained from the key ID.
> >
> > To solve this problem I would propose adding a "read" operation to the 
> > asymmetric key type, but limiting it to only reading the public key 
> > portion of the key (if it exists). Alternatively a entirely new 
> > "read_public" keyctl API could be added as well, but re-using the 
> > existing read seemed more straight forward. Adding this seems easy 
> > enough, but I wanted to get an idea if this is something that would be 
> > accepted upstream or if others had better suggestions.
> >
> > Thanks,
> >
> > James
>
> Missed earlier (CC to dhowells).

Right *obviously* to linux-crypto and Herbert! And people/lists relevant
(at least according to MAINTAINERS file).

BR, Jarkko