Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Pankaj Gupta <pankaj.gupta@nxp.com>
To:     gaurav.jain@nxp.com, sahil.malhotra@nxp.com,
        kshitiz.varshney@nxp.com, horia.geanta@nxp.com,
        linux-kernel@vger.kernel.org, V.Sethi@nxp.com
Cc:     Pankaj Gupta <pankaj.gupta@nxp.com>
Subject: [RFC PATCH HBK: 0/8] HW BOUND KEY as TRUSTED KEY
Date:   Mon,  5 Sep 2022 20:06:23 +0530
Message-Id: <20220905143631.2832-1-pankaj.gupta@nxp.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?F93FGUQtoOmBhkhd/ronwrm7SZGCvHBWEzdTbGJMFKs7NS8k4xqdQx2F11A0?=
 =?us-ascii?Q?6/vTUQR3QIQSYjsOuvfCpn3Kv+P86H/9a94WNYF8vUZJuXqR3olCZMk7f2rJ?=
 =?us-ascii?Q?aVhdWK1zgvxU0PVccAcpqVC9QjXKOs4GuVO9CM/Atp3PBUGfOTu2v3RD9ASY?=
 =?us-ascii?Q?1h0s3hbnmVvauENfRNTJwxWoIZ1h1AXqzcne4HmD0GKsf1MS70/3TywxX2Rk?=
 =?us-ascii?Q?SUQLK+fdAPOOoaqd1Xx/7rWFSkwU/HnMBUricmM8XR0c0xxjqWtihTbCjhAr?=
 =?us-ascii?Q?YeZCXf4yiWsa37yZPd+U+ca0pGM/3cfUZILSADjifAA6n7kQNZWjHfRxlqE8?=
 =?us-ascii?Q?gMqZB4TUcXVoNmM9XuCCLfTZ1d5r47DJt9kh1LYSXWmtvHSZO7VISYRiRPSI?=
 =?us-ascii?Q?yOHnf48xEYf8IUIa+kd69enDsNWgoWNz60w+MF6OomjeTWL/N2tnNvR5OJBY?=
 =?us-ascii?Q?+qvAx+1deLYKMUoGeoJy8zWAKHSHLC6baWVM6rtoEW8fUHlUiHSfX5/P6UBX?=
 =?us-ascii?Q?VsQczEAlh5zFWuDMBEHlcj+u0rXr3wf6hX1dbuGABHi+Qku8YIpeJ4q8xrBG?=
 =?us-ascii?Q?gURAuzr1Tge3abka29miYQ/cDhkQ5GnWYeeGxWcpn4sY2vySmP9Dugk8gxIk?=
 =?us-ascii?Q?ThbLgRtDpyIPDevB4e2HOLosAvkvV0ts5/Rvj/aQo14bdz2tDfs+OoYxPRQC?=
 =?us-ascii?Q?eSGS4LswjtqsOGt39jcKLgoZlemubMUcCytMsNfnFQmQJryLe0BS3Fu0phD9?=
 =?us-ascii?Q?/EpJU4zxKmlT0vszIMjtpoNAM0UEEMJIi5vwnLsVJhywF3HFLscpdfwudG2/?=
 =?us-ascii?Q?MsLbwzqxnH2h0Ip5tcsziMjHbg130fyhRzM8cOwFmDNX8E7oAcxiSoH4qYGT?=
 =?us-ascii?Q?3OMg6PjHfa+xI1Mg6aTIgCNLyU72DTc7IJ1HUsqoh4jePmT0kx+ObYVSAX9r?=
 =?us-ascii?Q?U9NbvOU7zDytv8HDXfL6b16CU0q0GawWFiLScb9dd/QkjliyL+AWZOWnlQqu?=
 =?us-ascii?Q?CjWLEZXiCSxy2q1ZnbfBsKPOFo+03MMIyEBTs5qyN8MbyR1W/vSkNln18HMx?=
 =?us-ascii?Q?Wnpvpchn8QaNRGIbanoMDqZtvVG/AO8nJPXuAxDLK4Y1lyL0GwAf2hdtYLel?=
 =?us-ascii?Q?VXdBMLZ06oyZg/URe+yn7MvspgoL6B++Hl/qpLErcAkOeq0AFudNj4Wv3a3t?=
 =?us-ascii?Q?sINKyI3YKoHzgQ9osZ2QLEFwWnLYVMxnl7sDvK9f3joChkC/0DzoV5l0zHpn?=
 =?us-ascii?Q?1rTyXEaPMWZnkPYPDrbisampTl9nh99UNsMoLDLbKxRBx+vxCbBd2zw8Md1f?=
 =?us-ascii?Q?wqRYHpRS0APu845lVXyyXlxeMPtvDQgi3lORRXJhP3Idfo+Odkh3CRm5pF9x?=
 =?us-ascii?Q?iiBYiYxf2c7BWN9R+QNS2fN/h1zr3pakfT3DB77sZFL6FcBYQRwnEmJQ1+8Q?=
 =?us-ascii?Q?Q1VA1I5YAQOx2JEVW5LReIPAlV8DFCkyO2mvpl1f7dhvXcmd17pCrXSWMI25?=
 =?us-ascii?Q?WnkHh+kltVPACD8hPmFesoN71J0jPEn9V0e/nvfApGyzgDC/CxkDZ+e4eAt6?=
 =?us-ascii?Q?2J+pEIpTjREqIPXyhYgQOlwJNgzzwWF3ddidnYZj?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 40b9e2c5-2709-44f0-8a37-08da8f436593
X-MS-Exchange-CrossTenant-AuthSource: DU2PR04MB8630.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Sep 2022 13:34:45.7969
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: zgL9QgmUlAKduT6DiLUzYuDhIgLsET7r98DTigPBHpsD51RoBdwhIfdhF0PubaTa1eE6OW2QwxwvQ7Cs1AFLsw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB5585
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hardware Bound key(HBK), is never acessible as plain key outside of the
hardware boundary. Thus, it is un-usable, even if somehow fetched
from kernel memory. It ensures run-time security.

This patchset adds generic support for classing the Hardware Bound Key,
based on:

- Newly added flag-'is_hbk', added to the tfm.

  Consumer of the kernel crypto api, after allocating
  the transformation, sets this flag based on the basis
  of the type of key consumer has.

- This helps to influence the core processing logic
  for the encapsulated algorithm.

- This flag is set by the consumer after allocating
  the tfm and before calling the function crypto_xxx_setkey().

First implementation is based on CAAM.

NXP built CAAM IP is the Cryptographic Acceleration and Assurance Module.
This is contain by the i.MX and QorIQ SoCs by NXP.

CAAM is a suitable backend (source) for kernel trusted keys.
This backend source can be used for run-time security as well
by generating the hardware bound key.

Along with plain key, the CAAM generates black key. A black key is an
encrypted key, which can only be decrypted inside CAAM. Hence, CAAM's
black key can only be used by CAAM. Thus it is declared as a hardware bound key.

Pankaj Gupta (8):
  keys-trusted: new cmd line option added
  hw-bound-key: flag-is_hbk added to the tfm
  sk_cipher: checking for hw bound operation
  keys-trusted: re-factored caam based trusted key
  caam blob-gen: moving blob_priv to caam_drv_private
  KEYS: trusted: caam based black key
  caam alg: symmetric key ciphers are updated
  dm-crypt: consumer-app setting the flag-is_hbk

 crypto/skcipher.c                         |   3 +-
 drivers/crypto/caam/blob_gen.c            | 242 ++++++++++++++++++++--
 drivers/crypto/caam/caamalg.c             |  37 +++-
 drivers/crypto/caam/caamalg_desc.c        |   8 +-
 drivers/crypto/caam/desc.h                |   8 +-
 drivers/crypto/caam/desc_constr.h         |   6 +-
 drivers/crypto/caam/intern.h              |   6 +-
 drivers/md/dm-crypt.c                     |   6 +-
 include/keys/trusted-type.h               |   2 +
 include/linux/crypto.h                    |   2 +
 include/soc/fsl/caam-blob.h               |  44 ++--
 security/keys/trusted-keys/trusted_caam.c |   6 +
 security/keys/trusted-keys/trusted_core.c |  14 ++
 13 files changed, 333 insertions(+), 51 deletions(-)

-- 
2.17.1