[PATCH v2 0/4] Paes and Phmac: Refuse clear key material by default

[Harald Freudenberger <freude@linux.ibm.com>]

The modivation of these patches is to disable clear key usage
of the protected key implementations paes and phmac by default.

With a new kernel module parameter "clrkey" this behavior can be
controlled. By default clrkey is 'N' but for testing purpose on module
load a true value (1, 'Y') may be given to accept clear key tokens.

Note that during selftest clear keys are always used and thus as long
as the algorithm is in larval state indicated by
crypto_skcipher_tested() clear keys need to be accepted. However, in
this state there is no way to establish an instance of the tfm other
than for selftest reasons.

Changelog:

v0: Initial version. Request for internal feedback and review
    Please note I assume that patch #1 goes via s390, whereas
    patch #2, #3 and #4 may go via Herbert Xu's Linux Kernel Crypto.
v1: Sequence changed and feedback from Ingo, Holger and Heiko
    integrated.
v2: Integrated the feedback from Holger and Ingo. First version
    going out to the linux kernel crypto mailing list

Harald Freudenberger (4):
  crypto: skcipher - Add new helper function crypto_skcipher_tested
  s390/pkey: Support new xflag PKEY_XFLAG_NOCLEARKEY
  crypto: s390/phmac - Refuse clear key material by default
  crypto: s390/paes - Refuse clear key material by default

 arch/s390/crypto/paes_s390.c       | 93 ++++++++++++++++++------------
 arch/s390/crypto/phmac_s390.c      | 29 +++++++---
 arch/s390/include/asm/pkey.h       |  8 ++-
 drivers/s390/crypto/pkey_cca.c     |  5 ++
 drivers/s390/crypto/pkey_ep11.c    |  5 ++
 drivers/s390/crypto/pkey_pckmo.c   | 12 +++-
 include/crypto/internal/skcipher.h |  7 +++
 7 files changed, 110 insertions(+), 49 deletions(-)


base-commit: 9448598b22c50c8a5bb77a9103e2d49f134c9578
--
2.43.0