On Sat, 2021-01-30 at 19:53 +0200, Jarkko Sakkinen wrote: > On Thu, 2021-01-28 at 18:31 +0100, Ahmad Fatoum wrote: > > Hello, > > > > I've been looking into how a migration to using trusted/encrypted keys > > would look like (particularly with dm-crypt). > > > > Currently, it seems the the only way is to re-encrypt the partitions > > because trusted/encrypted keys always generate their payloads from > > RNG. > > > > If instead there was a key command to initialize a new trusted/encrypted > > key with a user provided value, users could use whatever mechanism they > > used beforehand to get a plaintext key and use that to initialize a new > > trusted/encrypted key. From there on, the key will be like any other > > trusted/encrypted key and not be disclosed again to userspace. > > > > What are your thoughts on this? Would an API like > > > > keyctl add trusted dmcrypt-key 'set <content>' # user-supplied content > > > > be acceptable? > > Maybe it's the lack of knowledge with dm-crypt, but why this would be > useful? Just want to understand the bottleneck, that's all. We upstreamed "trusted" & "encrypted" keys together in order to address this sort of problem. Instead of directly using a "trusted" key for persistent file signatures being stored as xattrs, the "encrypted" key provides one level of indirection. The "encrypted" key may be encrypted/decrypted with either a TPM based "trusted" key or with a "user" type symmetric key[1]. Instead of modifying "trusted" keys, use a "user" type "encrypted" key. Mimi [1] The ima-evm-utils README contains EVM examples of "trusted" and "user" based "encrypted" keys.
