Messages in this thread | | | Subject | Re: [PATCH v2 1/2] crypto: ccree: enable support for hardware keys | From | Tudor Ambarus <> | Date | Wed, 25 Apr 2018 18:47:27 +0300 |
| |
Hi, Gilad,
On 04/23/2018 10:25 AM, Gilad Ben-Yossef wrote: > Enable CryptoCell support for hardware keys. > > Hardware keys are regular AES keys loaded into CryptoCell internal memory > via firmware, often from secure boot ROM or hardware fuses at boot time. > > As such, they can be used for enc/dec purposes like any other key but > cannot (read: extremely hard to) be extracted since since they are not > available anywhere in RAM during runtime. > > The mechanism has some similarities to s390 secure keys although the keys > are not wrapped or sealed, but simply loaded offline. The interface was > therefore modeled based on the s390 secure keys support.
I'm interested in hardware keys, ecc508 supports them too. In your proposal you expect that the user will provide a specific key token that is meaningful only for the ccree driver. If another driver that supports "cbc(paes)" shows up, you will force the user to select a specific driver implementation and to know what kind of key token to provide. Shouldn't we have a common API that can address other drivers too?
Best, ta
| |