Coupling Key-Ring and Linux Crypto-API Framework(LCF) via Crypto-Transformation(tfm)
summary
Proposes linking kernel keyring attributes into Linux Crypto-API TFMs so drivers can enforce usage, algorithm and lifetime restrictions at crypto time. Implements add key attributes to key payload and extend crypto_tfm with key_type and payload_ref, demonstrates DMcrypt calling SKCIPHER with a payload reference and NXP CAM offload reading attributes to deny disallowed ops. RFC patches exist, testing uses keyctl to load blobs, and reviewers note the need to pin the payload before passing it.
AI-written summary · about
chapters (6)
- 0:00Key-ring and LCF coupling
- 3:18Security requirements in IoT
- 8:58Gaps in LCF robustness
- 13:39Solution for key attribute coupling
- 17:49Kernel keyring with LCF
- 21:27Conclusion and future steps
related talks
35mOverview and Recent Developments of Keyrings Subsystem
36mUnder Lock & Key: Using Hardware Protected Keys with the Linux Crypto API
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
33mBringing fscrypt Encryption to CephFS Userspace
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
51mThe Linux Crypto API
34mAuthenticated and Encrypted Storage on Embedded Linux