Messages in this thread | | | Date | Tue, 26 Apr 2016 14:33:49 -0700 | From | Rafael Antognolli <> | Subject | Re: [PATCH 0/2] Add Opal unlock support to NVMe. |
| |
On Mon, Apr 25, 2016 at 08:29:22PM -0700, Elliott, Robert (Persistent Memory) wrote: > > > > -----Original Message----- > > From: linux-block-owner@vger.kernel.org [mailto:linux-block- > > owner@vger.kernel.org] On Behalf Of Christoph Hellwig > > Sent: Monday, April 25, 2016 3:24 AM > > To: Rafael Antognolli <rafael.antognolli@intel.com> > > Cc: linux-nvme@lists.infradead.org; linux-kernel@vger.kernel.org; > > linux-block@vger.kernel.org > > Subject: Re: [PATCH 0/2] Add Opal unlock support to NVMe. > > > > On Fri, Apr 22, 2016 at 04:12:10PM -0700, Rafael Antognolli wrote: > > > This patch series implement a small set of the Opal protocol for > > > self encrypting devices. It's implemented only what is needed for > > > saving a password and unlocking a given "locking range". The > > > password is saved on the driver and replayed back to the device > > > on resume from suspend to RAM. It is specifically supporting > > > the single user mode. > > Passwords stored in memory are subject to cold boot attacks. > > Could you tie this into the keyring infrastructure, so it would > least be no worse than other kernel modules? This would allow > support for TPM-based keys (if present) to resist more attacks. > If register-based key storage or other techniques prove viable, > they would probably show up there first.
I'll take a look at it.
> > > It is not planned to implement the full Opal protocol (at least > > > not for now). > > > > I think the OPAL code should be a generic library outside the NVMe > > code so that we can use it for SATA and SAS as well, just with a > > little glue code for the Security Send / Receive commands to wire > > it up to NVMe. > > NVDIMMs would benefit from that as well.
Yes, I can definitely change it to be that generic.
Thank you, Rafael
| |