[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-keyrings
Subject:    Re: [PATCH v7 12/21] tpm: Add NULL primary creation
From:       Gabríel_Arthúr_ =?ISO-8859-1?Q?P=E9tursson?= <gabriel () syste
Date:       2024-03-31 16:52:31
Message-ID: ea2a3a9a2bea2f1af5565ed32e9584caee2fbecf.camel () system ! is
[Download RAW message or body]

On Sun, 2024-03-31 at 19:00 +0300, Jarkko Sakkinen wrote:
> Null key is not provisioned, what is the motivation here?

The terms here, to create a key and to provision a key, are almost
interchangeable. The latter merely implies the additional step of
saving the key to NVRAM and making it available through a persistent
handle.

The template, aside from defining what kind of key we want to create,
is fed into the TPM's KDF used to generate the key. Different template,
different key.

Userspace will want to recreate the same key the kernel has, thus must
use the same template. Which template shall be used then?

+	/*
+	 * create the template.  Note: in order for userspace to
+	 * verify the security of the system, it will have to create
+	 * and certify this NULL primary, meaning all the template
+	 * parameters will have to be identical, so conform exactly to
+	 * the TCG TPM v2.0 Provisioning Guidance for the SRK ECC
+	 * key
+	 */

The TPM specifications have a standardized set of templates for the
Endorsement Keys, and a recommendation on a template to
create/provision the shared SRK.

Why not use that one then, above something else? We are required to use
a template for key generation after all, might as well pick the one
most fitting from the standards.

That's at least my understanding of the author's motivation.

> So for the time being the patch set is NAK just because we lack
> clear definition of done here. I revisit it only when I know how
> to test it.

I want to note that I'm not affiliated with the patches' author. I'm
merely an outside observer who has taken interest in the proposed
changes. Wanted to share my thoughts.

[prev in list] [next in list] [prev in thread] [next in thread]