On Mon, Apr 25, 2016 at 08:29:22PM -0700, Elliott, Robert (Persistent Memory) wrote: > > > > -----Original Message----- > > From: linux-block-owner@xxxxxxxxxxxxxxx [mailto:linux-block- > > owner@xxxxxxxxxxxxxxx] On Behalf Of Christoph Hellwig > > Sent: Monday, April 25, 2016 3:24 AM > > To: Rafael Antognolli <rafael.antognolli@xxxxxxxxx> > > Cc: linux-nvme@xxxxxxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; > > linux-block@xxxxxxxxxxxxxxx > > Subject: Re: [PATCH 0/2] Add Opal unlock support to NVMe. > > > > On Fri, Apr 22, 2016 at 04:12:10PM -0700, Rafael Antognolli wrote: > > > This patch series implement a small set of the Opal protocol for > > > self encrypting devices. It's implemented only what is needed for > > > saving a password and unlocking a given "locking range". The > > > password is saved on the driver and replayed back to the device > > > on resume from suspend to RAM. It is specifically supporting > > > the single user mode. > > Passwords stored in memory are subject to cold boot attacks. > > Could you tie this into the keyring infrastructure, so it would > least be no worse than other kernel modules? This would allow > support for TPM-based keys (if present) to resist more attacks. > If register-based key storage or other techniques prove viable, > they would probably show up there first. I'll take a look at it. > > > It is not planned to implement the full Opal protocol (at least > > > not for now). > > > > I think the OPAL code should be a generic library outside the NVMe > > code so that we can use it for SATA and SAS as well, just with a > > little glue code for the Security Send / Receive commands to wire > > it up to NVMe. > > NVDIMMs would benefit from that as well. Yes, I can definitely change it to be that generic. Thank you, Rafael -- To unsubscribe from this list: send the line "unsubscribe linux-block" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
