On Tue May 21, 2024 at 5:13 PM EEST, James Bottomley wrote: > On Tue, 2024-05-21 at 17:02 +0300, Jarkko Sakkinen wrote: > > Secondly, it also roots to the null key if a parent is not given. So > > it covers all the basic features of the HMAC patch set. > > I don't think that can work. The key file would be wrapped to the > parent and the null seed (and hence the wrapping) changes with every > reboot. If you want a permanent key, it has to be in one of the > accessible permanent hierarchies (storage ideally or endorsement). I'm fully aware that null seed is randomized per power cycle. The fallback was inherited from James Prestwood's original code and I decided to keep it as a testing feature, and also to test HMAC changes. If you look at the testing transcript in the cover letter, it should be obvious that a primary key is created in my basic test. BR, Jarkko
