On Thu, Jul 26, 2018 at 09:30:46AM +0200, Oliver Neukum wrote: > On Di, 2018-07-24 at 00:23 +0800, Yu Chen wrote: > > > > Good point, we once tried to generate key in kernel, but people > > suggest to generate key in userspace and provide it to the > > kernel, which is what ecryptfs do currently, so it seems this > > should also be safe for encryption in kernel. > > https://www.spinics.net/lists/linux-crypto/msg33145.html > > Thus Chun-Yi's signature can use EFI key and both the key from > > user space. > > Hi, > > ecryptfs can trust user space. It is supposed to keep data > safe while the system is inoperative. The whole point of Secure > Boot is a cryptographic system of trust that does not include > user space. > > I seriously doubt we want to use trusted computing here. So the > key needs to be generated in kernel space and stored in a safe > manner. As we have a saolution doing that, can we come to ausable > synthesis? > > Regards > Oliver Crurently there have two solutions, they are trusted key and EFI key. Both of them are generated in kernel and are not visible in user space. The trusted key is generated by kernel then sealed by the TPM's SRK. So the trusted key can be stored in anywhere then be enrolled to kernel when we need it. EVM already uses it. The EFI key is Jiri Kosina's idea. It is stored in boot services variable, which means that it can only be access by signed EFI binary (e.g. signed EFI boot stub) when secure boot be enabled. SLE applied this solution a couple of years. I am working on put the EFI key to key retention service. Then EFI key can be a master key of encrypted key. EVM can also use it: https://github.com/joeyli/linux-s4sign/commit/bae39460393ada4c0226dd07cd5e3afcef86b71f https://github.com/joeyli/linux-s4sign/commit/f552f97cc3cca5acd84f424b7f946ffb5fe8e9ec That's why I want to use key retention service in hibernation encryption/authentication. Which means that we can use key API to access trusted key and EFI key. Thanks Joey Lee
