Messages in this thread | | | Date | Tue, 20 Sep 2022 16:24:22 -0700 | From | Kees Cook <> | Subject | Re: [PATCH v2 10/10] PM: hibernate: seal the encryption key with a PCR policy |
| |
On Tue, Aug 23, 2022 at 03:25:26PM -0700, Evan Green wrote: > The key blob is not secret, and by default the TPM will happily unseal > it regardless of system state. We can protect against that by sealing > the secret with a PCR policy - if the current PCR state doesn't match, > the TPM will refuse to release the secret. For now let's just seal it to > PCR 23. In the long term we may want a more flexible policy around this, > such as including PCR 7 for PCs or 0 for Chrome OS. > > Sourced-from: Matthew Garrett <mjg59@google.com>
If it's a total rewrite, I'd say use:
Suggested-by: Matthew Garrett <...> Link: https://lore.kernel.org/of/what/it/was/based/on
If it's built on an existing patch, I'd say use:
Co-developed-by: Matthew Garrett <...> Signed-off-by: Matthew Garrett <...>
But I defer to what Matthew thinks. :)
Also, if you don't hear from Matthew, maybe ping his mjg59@srcf.ucam.org address.
-Kees
-- Kees Cook
| |