On Wed, 2022-09-07 at 07:22 +0000, Pankaj Gupta wrote: > Even if somehow the key is retrieved from the keyring, the retrieved key > would be an encrypted key. > This encrypted key can only be decrypted by Hardware, which generated it. > > Hence, the retrieved key is unusable outside of the hardware. NXP's CAAM unit (i.e. on i.MX6) supports several modes of sealed/encrypted keys. The (un)sealing process uses a key that is normally derived from a per-device key in eFUSES. One aspect of these modes is whether the plaintext key material is accessible to the kernel or not. Ahmad's patch set added support for a mode where the CAAM is used to seal plaintext known to the kernel to a "blob" (in CAAM terminology) on export to userspace and the reverse on import. This mode allows the kernel to use the plaintext for dm-crypt, to encrypt other keyrings and similar. The CAAM has another sealing mode, where it will not allow writing of the plaintext key to memory. Instead, it is kept in one of the CAAM-internal key registers. There, it can be used for cryptographic operations (i.e. AES). This way, the plaintext key is protected even from the kernel. The kernel could keep a copy of in sealed form, so it can reload the CAAM's key register when needed. Pankaj, is that the mode you intend to support with this series? Could you describe the high-level use-cases this would be need for, compared to the existing mode where plaintext keys are accessible to the kernel? In which cases would you use each mode? Regards, Jan -- Pengutronix e.K. | | Industrial Linux Solutions | http://www.pengutronix.de/ | Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
