Hello, I've been looking into how a migration to using trusted/encrypted keys would look like (particularly with dm-crypt). Currently, it seems the the only way is to re-encrypt the partitions because trusted/encrypted keys always generate their payloads from RNG. If instead there was a key command to initialize a new trusted/encrypted key with a user provided value, users could use whatever mechanism they used beforehand to get a plaintext key and use that to initialize a new trusted/encrypted key. From there on, the key will be like any other trusted/encrypted key and not be disclosed again to userspace. What are your thoughts on this? Would an API like keyctl add trusted dmcrypt-key 'set <content>' # user-supplied content be acceptable? Cheers, Ahmad -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
