Re: [PATCH v15 0/5] TPM 2.0 trusted key rework

[Jarkko Sakkinen <jarkko@kernel.org>]

On Wed, Jan 27, 2021 at 11:06:12AM -0800, James Bottomley wrote:
> v15: fix 0day sign issue and add reviews and testeds
> 
> General cover letter minus policy bit:
> 
> This patch updates the trusted key code to export keys in the ASN.1
> format used by current TPM key tools (openssl_tpm2_engine and
> openconnect).  The current code will try to load keys containing
> policy, but being unable to formulate the policy commands necessary to
> load them, the unseal will always fail unless the policy is executed
> in user space and a pre-formed policy session passed in.
> 
> The key format is designed to be compatible with our two openssl
> engine implementations as well as with the format used by openconnect.
> I've added seal/unseal to my engine so I can use it for
> interoperability testing and I'll later use this for sealed symmetric
> keys via engine:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/jejb/openssl_tpm2_engine.git/
> 
> James
> 
> ---
> 
> James Bottomley (5):
>   lib: add ASN.1 encoder
>   oid_registry: Add TCG defined OIDS for TPM keys
>   security: keys: trusted: fix TPM2 authorizations
>   security: keys: trusted: use ASN.1 TPM2 key format for the blobs
>   security: keys: trusted: Make sealed key properly interoperable

AFAIK, bug fixes should merged before functional changes and migratable
flag has a regression:

https://marc.info/?l=linux-integrity&m=160255753405345

I'll send an update to this series.

/Jarkko

> 
>  .../security/keys/trusted-encrypted.rst       |  58 +++
>  include/keys/trusted-type.h                   |   2 +
>  include/linux/asn1_encoder.h                  |  32 ++
>  include/linux/oid_registry.h                  |   5 +
>  include/linux/tpm.h                           |   2 +
>  lib/Kconfig                                   |   3 +
>  lib/Makefile                                  |   1 +
>  lib/asn1_encoder.c                            | 454 ++++++++++++++++++
>  security/keys/Kconfig                         |   3 +
>  security/keys/trusted-keys/Makefile           |   4 +-
>  security/keys/trusted-keys/tpm2key.asn1       |  11 +
>  security/keys/trusted-keys/trusted_tpm1.c     |  34 +-
>  security/keys/trusted-keys/trusted_tpm2.c     | 269 ++++++++++-
>  13 files changed, 846 insertions(+), 32 deletions(-)
>  create mode 100644 include/linux/asn1_encoder.h
>  create mode 100644 lib/asn1_encoder.c
>  create mode 100644 security/keys/trusted-keys/tpm2key.asn1
> 
> -- 
> 2.26.2
> 
>