Received-SPF: pass (google.com: domain of linux-kernel+bounces-178211-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Precedence: bulk
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Date: Tue, 14 May 2024 03:28:32 +0300
Message-Id: <D18XXJ373C2V.2M6AOMKD1B89W@kernel.org>
Cc: <kernel-team@cloudflare.com>
Subject: Re: [RFC PATCH 0/2] TPM derived keys
From: "Jarkko Sakkinen" <jarkko@kernel.org>
To: "Ignat Korchagin" <ignat@cloudflare.com>, "James Bottomley"
 <James.Bottomley@hansenpartnership.com>, "Mimi Zohar"
 <zohar@linux.ibm.com>, "David Howells" <dhowells@redhat.com>, "Paul Moore"
 <paul@paul-moore.com>, "James Morris" <jmorris@namei.org>,
 <serge@hallyn.com>, <linux-integrity@vger.kernel.org>,
 <keyrings@vger.kernel.org>, <linux-kernel@vger.kernel.org>
References: <20240503221634.44274-1-ignat@cloudflare.com>
 <CALrw=nGhgRrhJ5mWWC6sV2WYWoijvD9WgFzMfOe6mHmqnza-Hw@mail.gmail.com>
In-Reply-To: <CALrw=nGhgRrhJ5mWWC6sV2WYWoijvD9WgFzMfOe6mHmqnza-Hw@mail.gmail.com>

On Mon May 13, 2024 at 8:11 PM EEST, Ignat Korchagin wrote:
> On Fri, May 3, 2024 at 11:16=E2=80=AFPM Ignat Korchagin <ignat@cloudflare=
com> wrote:
> I would like to point out to myself I was wrong: it is possible to ask
> the kernel to generate a trusted key inside the kernel locally with
> "keyctl add trusted kmk "new 32" @u"

Not in a full-time kernel position ATM as I'm working as contract
researcher up until beginning of Oct (took some industry break after
a startup went down of business), so please, politely asking, write
a bit more compact descriptions ;-) I'm trying to find a new position by
the beginning of Oct but right now I'd appreciate a bit more thought out
text descriptions.

I'm working out a small patch set with James Prestwood to add asymmetric
TPM2 keys based on his old patch set [1] but laid out on top of the
existing baseline.

I did already the key type shenanigans etc. for it and James P is laying
his pre-existing RSA code and new ECDSA on top of that. So this will
give x.509 compatibility [2]. This patch set will be out soon and likely
part of 6.11 (or almost guaranteed as most of it is done).

So by plain guess this might be along the lines what you might want?

[1] https://lore.kernel.org/all/20200518172704.29608-1-prestwoj@gmail.com/
[2] https://datatracker.ietf.org/doc/draft-woodhouse-cert-best-practice/

BR, Jarkko