From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF78AC433B4 for ; Thu, 1 Apr 2021 10:05:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 711EC6108B for ; Thu, 1 Apr 2021 10:05:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233845AbhDAKEl (ORCPT ); Thu, 1 Apr 2021 06:04:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233637AbhDAKEi (ORCPT ); Thu, 1 Apr 2021 06:04:38 -0400 Received: from metis.ext.pengutronix.de (metis.ext.pengutronix.de [IPv6:2001:67c:670:201:290:27ff:fe1d:cc33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7378DC0613E6 for ; Thu, 1 Apr 2021 03:04:38 -0700 (PDT) Received: from gallifrey.ext.pengutronix.de ([2001:67c:670:201:5054:ff:fe8d:eefb] helo=[IPv6:::1]) by metis.ext.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1lRuBo-0000f3-JJ; Thu, 01 Apr 2021 12:04:36 +0200 Subject: Re: [PATCH v1 0/3] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys To: Richard Weinberger Cc: Jarkko Sakkinen , =?UTF-8?Q?Horia_Geant=c4=83?= , Mimi Zohar , Aymen Sghaier , Herbert Xu , "David S. Miller" , James Bottomley , kernel@pengutronix.de, David Howells , James Morris , "Serge E. Hallyn" , Steffen Trumtrar , Udit Agarwal , Jan Luebbe , David Gstir , Franck LENORMAND , Sumit Garg , linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, Linux Crypto Mailing List , LKML , LSM References: From: Ahmad Fatoum Message-ID: <897df7dd-83a1-3e3e-1d9f-5a1adfd5b2fb@pengutronix.de> Date: Thu, 1 Apr 2021 12:04:31 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-SA-Exim-Connect-IP: 2001:67c:670:201:5054:ff:fe8d:eefb X-SA-Exim-Mail-From: a.fatoum@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-security-module@vger.kernel.org Precedence: bulk List-ID: Hello Richard, On 30.03.21 23:50, Richard Weinberger wrote: > Ahmad, > > On Wed, Mar 17, 2021 at 3:08 PM Ahmad Fatoum wrote: > >> TABLE="0 $BLOCKS crypt $ALGO :32:trusted:$KEYNAME 0 $DEV 0 1 allow_discards" >> echo $TABLE | dmsetup create mydev >> echo $TABLE | dmsetup load mydev > > Do you also plan to add support for this to cryptsetup? > > David and I have added (rough) support for our CAAM/DCP based keyrings > to cryptsetup: > https://github.com/sigma-star/cryptsetup/tree/rw/plain > > I'm pretty sure with minimal changes it will work with your recent approach too. I am using dmsetup directly in my project. I am not familiar with cryptsetup plain. What benefits do you see with this over direct dmsetup? What I'd like to see eventually is support for this with LUKS. There is a RFE on trusted keys and cryptsetup on the project's repository[1]. The behavior I'd want it that the LUKS header would point at the trusted key blob to use and load it into the kernel. This of course means that you won't be able to have multiple keys for the encrypted partition. [1]: https://gitlab.com/cryptsetup/cryptsetup/-/issues/443 Cheers, Ahmad -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |