Messages in this thread | | | From | Ahmad Fatoum <> | Subject | Migration to trusted keys: sealing user-provided key? | Date | Thu, 28 Jan 2021 18:31:57 +0100 |
| |
Hello,
I've been looking into how a migration to using trusted/encrypted keys would look like (particularly with dm-crypt).
Currently, it seems the the only way is to re-encrypt the partitions because trusted/encrypted keys always generate their payloads from RNG.
If instead there was a key command to initialize a new trusted/encrypted key with a user provided value, users could use whatever mechanism they used beforehand to get a plaintext key and use that to initialize a new trusted/encrypted key. From there on, the key will be like any other trusted/encrypted key and not be disclosed again to userspace.
What are your thoughts on this? Would an API like
keyctl add trusted dmcrypt-key 'set <content>' # user-supplied content
be acceptable?
Cheers, Ahmad
-- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
| |