Messages in this thread | | | Subject | Re: [PATCH 0/4][RFC v2] Introduce the in-kernel hibernation encryption | From | Oliver Neukum <> | Date | Thu, 26 Jul 2018 09:30:46 +0200 |
| |
On Di, 2018-07-24 at 00:23 +0800, Yu Chen wrote: > > Good point, we once tried to generate key in kernel, but people > suggest to generate key in userspace and provide it to the > kernel, which is what ecryptfs do currently, so it seems this > should also be safe for encryption in kernel. > https://www.spinics.net/lists/linux-crypto/msg33145.html > Thus Chun-Yi's signature can use EFI key and both the key from > user space.
Hi,
ecryptfs can trust user space. It is supposed to keep data safe while the system is inoperative. The whole point of Secure Boot is a cryptographic system of trust that does not include user space.
I seriously doubt we want to use trusted computing here. So the key needs to be generated in kernel space and stored in a safe manner. As we have a saolution doing that, can we come to ausable synthesis?
Regards Oliver
| |