lkml.org 
[lkml]   [2022]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v4 08/11] PM: hibernate: Use TPM-backed keys to encrypt image
    On Thu, Nov 03, 2022 at 11:01:16AM -0700, Evan Green wrote:
    > When using encrypted hibernate images, have the TPM create a key for us
    > and seal it. By handing back a sealed blob instead of the raw key, we
    > prevent usermode from being able to decrypt and tamper with the
    > hibernate image on a different machine.
    >
    > We'll also go through the motions of having PCR23 set to a known value at
    > the time of key creation and unsealing. Currently there's nothing that
    > enforces the contents of PCR23 as a condition to unseal the key blob,
    > that will come in a later change.
    >
    > Sourced-from: Matthew Garrett <mjg59@google.com>

    I'd say Suggested-by. "Source-from:" is not a tag that has ever been
    used before. :)

    Otherwise, looks good.

    Reviewed-by: Kees Cook <keescook@chromium.org>

    --
    Kees Cook

    \
     
     \ /
      Last update: 2022-11-04 19:43    [W:3.314 / U:0.476 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site