From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 52BC0C48BF6 for ; Mon, 4 Mar 2024 22:16:56 +0000 (UTC) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=CBO/PZrh; dkim-atps=neutral Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4TpY2Z5wNpz3blb for ; Tue, 5 Mar 2024 09:16:54 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=CBO/PZrh; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=kernel.org (client-ip=2604:1380:40e1:4800::1; helo=sin.source.kernel.org; envelope-from=jarkko@kernel.org; receiver=lists.ozlabs.org) Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4TpY1h1G4Cz2xTP for ; Tue, 5 Mar 2024 09:16:08 +1100 (AEDT) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id C568DCE12CD; Mon, 4 Mar 2024 22:16:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8818CC433F1; Mon, 4 Mar 2024 22:15:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1709590564; bh=B+/HnwLCpt/nEMTn4HJHKj5QZDdRYTH3xkzZZRrm/f4=; h=Date:Cc:Subject:From:To:References:In-Reply-To:From; b=CBO/PZrhwSGAEynPUUI7ML6hnhaCbGTiiTHzoHmr+9ec0e5SmimPveLrvY4LQv0me TB2ANRLYFVCnP1MvwrCsp+mQDJo7QhAJrPc4hxwn1sU+PoR7uGdJM4qOf32KyIcpNa GpI9yQrlW0wk4KF7FwpoaQQrgEvr+j+y8l50ThTjH9InyidHtNRu7R5CglByl39ihI Q+YumRMidl3W5wFHOEAE2k0WzHfjhjPGIPnEW1yrIeY+qYTpVM7R2Wrf/motGoaWvj UoYDMRCq/G+kMZ5bjeEEvwaCxFwJSnsmihpqBYVNLd3H/H9+Nwajp4Ly/63l4detSQ ww8WPT8KJ9qXg== Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Tue, 05 Mar 2024 00:15:55 +0200 Message-Id: Subject: Re: [PATCH v5 1/6] crypto: mxs-dcp: Add support for hardware-bound keys From: "Jarkko Sakkinen" To: "David Gstir" , "Mimi Zohar" , "James Bottomley" , "Herbert Xu" , "David S. Miller" X-Mailer: aerc 0.15.2 References: <20231215110639.45522-1-david@sigma-star.at> <20231215110639.45522-2-david@sigma-star.at> In-Reply-To: <20231215110639.45522-2-david@sigma-star.at> X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-doc@vger.kernel.org, Catalin Marinas , David Howells , keyrings@vger.kernel.org, Fabio Estevam , Ahmad Fatoum , Paul Moore , Jonathan Corbet , Richard Weinberger , "Rafael J. Wysocki" , James Morris , NXP Linux Team , "Serge E. Hallyn" , "Paul E. McKenney" , Sascha Hauer , sigma star Kernel Team , "Steven Rostedt \(Google\)" , David Oberhollenzer , linux-arm-kernel@lists.infradead.org, linuxppc-dev@lists.ozlabs.org, Randy Dunlap , linux-kernel@vger.kernel.org, Li Yang , linux-security-module@vger.kernel.org, linux-crypto@vger.kernel.org, Pengutronix Kernel Team , Tejun Heo , linux-integrity@vger.kernel.org, Shawn Guo Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Sender: "Linuxppc-dev" On Fri Dec 15, 2023 at 1:06 PM EET, David Gstir wrote: > DCP is capable of performing AES with two hardware-bound keys: > > - The one-time programmable (OTP) key which is burnt via on-chip fuses > - The unique key (UK) which is derived from the OTP key This is somewhat cryptic explanation for the commmon and reoccuring theme of having a fused random seed and a key derivation function. I'd just write it is all about. "DCP is able to derive private keys for a fused random seed, which can be referenced by handle but not accessed by the CPU. These keys can be used to perform AES encryption." My explanation neither includes acronyms OTP and UK and still delivers the message so much better. That actually further makes it better because less crappy standard consortium terminology is always better :-) BR, Jarkko