Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH 00/22] KEYS: Support TPM-wrapped key and crypto ops
To:     David Woodhouse <dwmw2@infradead.org>,
        David Howells <dhowells@redhat.com>
Cc:     jmorris@namei.org, keyrings@vger.kernel.org,
        linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
References: <fdee179b-cfdf-7a2b-3193-e114f0084ecb@gmail.com>
 <153618445730.7946.10001472635835806478.stgit@warthog.procyon.org.uk>
 <1537253993.20009.62.camel@infradead.org>
 <14067.1537285833@warthog.procyon.org.uk>
 <745318a0-51bd-be8f-2251-44701ad75830@gmail.com>
 <0d51fca9a29458a40121df0c5380af91e3429c08.camel@infradead.org>
From:   Denis Kenzior <denkenz@gmail.com>
Message-ID: <2c5a34af-c2ae-b98c-e5d3-d89462ad3a20@gmail.com>
Date:   Tue, 18 Sep 2018 00:41:59 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.3.0
MIME-Version: 1.0
In-Reply-To: <0d51fca9a29458a40121df0c5380af91e3429c08.camel@infradead.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi David,

On 09/18/2018 11:17 AM, David Woodhouse wrote:
> On Tue, 2018-09-18 at 00:24 -0500, Denis Kenzior wrote:
>> Hi David,
>>
>> On 09/18/2018 10:50 AM, David Howells wrote:
>>> Denis Kenzior <denkenz@gmail.com> wrote:
>>>
>>>>      openssl asn1parse -inform pem -in /tmp/privkey.2048.tpm -noout \
>>>>                        -out /tmp/privkey.2048.der
>>>
>>> You can use "... -out - | ..." instead.
>>
>> Aha! okay, that is even more elegant.  Your openssl-fu is better than
>> mine :)
> 
> 'grep -v ^----- | base64 -d' also works most of the time :)
> 
> You are passing the raw DER to the kernel in both cases, right? And the
> kernel just happens to know that if it receives a bare OCTET-STRING
> it's supposed to treat it as a TPMv1.2 key?
> 

Short answer: right.

Long answer: The kernel runs all the registered parsers until all fail 
or one of them recognizes the format.  All the currently supported 
asymmetric key formats are DER based, e.g. PKCS8, PKCS7, TPM-1.2, etc. 
All these have a very specific DER structure with the TPM-1.2 being the 
simplest format.

Regards,
-Denis