On Thu, 2021-01-28 at 18:31 +0100, Ahmad Fatoum wrote: > Hello, > > I've been looking into how a migration to using trusted/encrypted keys > would look like (particularly with dm-crypt). > > Currently, it seems the the only way is to re-encrypt the partitions > because trusted/encrypted keys always generate their payloads from > RNG. > > If instead there was a key command to initialize a new trusted/encrypted > key with a user provided value, users could use whatever mechanism they > used beforehand to get a plaintext key and use that to initialize a new > trusted/encrypted key. From there on, the key will be like any other > trusted/encrypted key and not be disclosed again to userspace. > > What are your thoughts on this? Would an API like > > keyctl add trusted dmcrypt-key 'set <content>' # user-supplied content > > be acceptable? Maybe it's the lack of knowledge with dm-crypt, but why this would be useful? Just want to understand the bottleneck, that's all. > Cheers, > Ahmad /Jarkko
