On Mon, 2019-12-09 at 21:47 +0200, Jarkko Sakkinen wrote: > On Mon, Dec 02, 2019 at 10:55:32AM -0800, James Bottomley wrote: > > blob but it looks like we need to fix the API. I suppose the good > > news is given this failure that we have the opportunity to rewrite > > the API since no-one else can have used it for anything because of > > this. The > > I did successfully run this test when I wrote it 5 years ago: > > https://github.com/jsakkine-intel/tpm2-scripts/blob/master/keyctl-smo > ke.sh > > Given that there is API a way must be found that backwards > compatibility > is not broken. New format is fine but it must co-exist. The old API is unsupportable in the combination of policy + auth as I already explained. The kernel doesn't have access to the nonces to generate the HMAC because the session was created by the user and the API has no way to pass them in (plus passing them in would be a huge security failure if we tried). Given that Shirley appears to be the first person ever to try this, I don't think the old API has grown any policy users so its safe to remove it. If we get a complaint, we can discuss adding it back. James
