Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Pankaj Gupta <pankaj.gupta@nxp.com>
To:     jarkko@kernel.org, a.fatoum@pengutronix.de, Jason@zx2c4.com,
        jejb@linux.ibm.com, zohar@linux.ibm.com, dhowells@redhat.com,
        sumit.garg@linaro.org, david@sigma-star.at, michael@walle.cc,
        john.ernberg@actia.se, jmorris@namei.org, serge@hallyn.com,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        j.luebbe@pengutronix.de, ebiggers@kernel.org, richard@nod.at,
        keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org, sahil.malhotra@nxp.com,
        kshitiz.varshney@nxp.com, horia.geanta@nxp.com,
        pankaj.gupta@nxp.com, V.Sethi@nxp.com
Subject: [RFC PATCH HBK: 0/8] HW BOUND KEY as TRUSTED KEY
Date:   Tue,  6 Sep 2022 12:21:49 +0530
Message-Id: <20220906065157.10662-1-pankaj.gupta@nxp.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?8bjqRj4JrnnwTFNOsC1CoGy5h/BBzndA8iOxPbV8eSkRzWeuw1OlKX5vubqV?=
 =?us-ascii?Q?fxVPzJwl7Q/LaghF9URNzHEFF4o4oKMp2dcOSl7iEV8cW4ycW4frzxyt1bn2?=
 =?us-ascii?Q?6zWAt1SL9Qnp94SxxFY8R2EjGdCGcW7so36ej4L+0wRAnde2NUzht9OpuMwh?=
 =?us-ascii?Q?eGrI2ognrAkBu+j9lP9a6mnppHyFgPqlWSCv8BBnm+7u6+yOmJw6tTU8hVd0?=
 =?us-ascii?Q?HcPR8xpeqdsWp8gvyMbZRmqUCO4WdsAuLl0pfEURBOToRUIXjMrvNgfJAYFY?=
 =?us-ascii?Q?YpT78yH2LHgcnjMUAT0euNMqyYBiLVwWR/qQO64Ht2/eHJLtXR7chMCD0cha?=
 =?us-ascii?Q?2POAMPpgDtRf+ARpklO5M+2DkIsCyeTUT2xKAj75u2UlvzhE2RKdfUIMcA24?=
 =?us-ascii?Q?e0g73z9WwW47OxJA2mVCiO0iYv5b/Prn9xXZlrjhsF3v8Kyjl1KOywhB9Fva?=
 =?us-ascii?Q?MymXWspf4DnTMcpPZRU1i9+QcKULqZc0OtkmcNkBldgNt2rxsvSbZWKfU3xW?=
 =?us-ascii?Q?kh/BxTjZJx/HqO1D8pfXaqAqlJsjCJ8lCeQPVSiYcSTE4pq5zCH4YxzeXYTF?=
 =?us-ascii?Q?96gRZ1tqF5DuoTcx+m3V2spnyp8IO8hRUzh77IxCv33o8T0zDP7VUxfuKwdX?=
 =?us-ascii?Q?Muqxg79YnosFeTvUE+0HzuVWMpiUNGvtSHgx5TCfWgwnaAr68onmDZYOZjQI?=
 =?us-ascii?Q?xyQPmysuAYvYqHhYNE9WjsQCZBQIvn+SlxhFL5mq2kxnOUMSgOcbD3+s7Pz1?=
 =?us-ascii?Q?/xc/I5KKqqVJT0fjT+CB5KLIGILkMLY/5S6Y8rheQtGgd6QFds7/A3rb6g6V?=
 =?us-ascii?Q?CJvdy+vmXEPU5IG9EUsXJABDEMgq/FlmauCNdBTuboPB12hq64EDpyfNfZ+B?=
 =?us-ascii?Q?scQpPySi59d+NTdrlsDCIqXwaDP8jxRW4NhN+oUKO5HZlUj6zaRvIoOAs16G?=
 =?us-ascii?Q?aKEVZ1r7F834PLYaZRn8yO0Z9zHYrnvBD52T22hEIVMwpco6BSSx1ywbN56d?=
 =?us-ascii?Q?x0pRnkZBmZFhoghdAKzos7K+ai+NGlaiRvMmxognjg8N3yZWiqoR7gB0XnhL?=
 =?us-ascii?Q?2OrOD5/JDc8ZOAROMwVRI80bZjlf0DiluB0V6u8qdB+SiP7pUfJY5mO5qGdM?=
 =?us-ascii?Q?i+Co6jqI6mLiSxnfYPQg5rRgmNBvVG6ZeqvXaI2ICEY7z0RZZ9C/lqG52PY+?=
 =?us-ascii?Q?My2oGnJBHNMuIimafEx4vpxWNYvTHtrYzfq2k+9aorypb8xQcpd52FZ8nzU0?=
 =?us-ascii?Q?lxyXhWHoo/NhtS48Jq07bo04oAp+P6OA0kR1paNVFeT0Q9t+SGJiKf9FjfjA?=
 =?us-ascii?Q?TnWyLnq4h3Qjap8dXuvgFISdk6Jdx+u11DGVrIfPcKa9/IC6grm3aKGKZuM0?=
 =?us-ascii?Q?98TBr4IpEdF+Vpr3dNItmMsU3mkT3CKQkmaa6f4063naiuYceT2DhwTJTy0f?=
 =?us-ascii?Q?09QGk56BGlzSiCqWyop3xdPIwxTppBPvyxuRx3XDcweeYSJWnpGAm0veHEv5?=
 =?us-ascii?Q?c9qmPW2JwUgcTwxfkZRuNUe5OdZ6dX3CXRCQxIv+/wwOo+bX4nhvIhIa/2Zj?=
 =?us-ascii?Q?cKgoWS5t6XKFBBU0tRYHy/cVmvF4PAyOYMsr67NK?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 565cf064-7ba7-447f-7971-08da8fcbab3d
X-MS-Exchange-CrossTenant-AuthSource: DU2PR04MB8630.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Sep 2022 05:50:14.4464
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: rjtCCEAmuxht0Rv57mbFl8fwDRM/W0VsY3Qt9jCAgQ5zWkIZ0HAs6Bv4+rZuQ1ld+B3QY8ciqR2ve/iPTRnrOw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR04MB6657
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Hardware Bound key(HBK), is never acessible as plain key outside of the
hardware boundary. Thus, it is un-usable, even if somehow fetched
from kernel memory. It ensures run-time security.

This patchset adds generic support for classing the Hardware Bound Key,
based on:

- Newly added flag-'is_hbk', added to the tfm.

  Consumer of the kernel crypto api, after allocating
  the transformation, sets this flag based on the basis
  of the type of key consumer has.

- This helps to influence the core processing logic
  for the encapsulated algorithm.

- This flag is set by the consumer after allocating
  the tfm and before calling the function crypto_xxx_setkey().

First implementation is based on CAAM.

NXP built CAAM IP is the Cryptographic Acceleration and Assurance Module.
This is contain by the i.MX and QorIQ SoCs by NXP.

CAAM is a suitable backend (source) for kernel trusted keys.
This backend source can be used for run-time security as well
by generating the hardware bound key.

Along with plain key, the CAAM generates black key. A black key is an
encrypted key, which can only be decrypted inside CAAM. Hence, CAAM's
black key can only be used by CAAM. Thus it is declared as a hardware bound key.

Pankaj Gupta (8):
  keys-trusted: new cmd line option added
  hw-bound-key: flag-is_hbk added to the tfm
  sk_cipher: checking for hw bound operation
  keys-trusted: re-factored caam based trusted key
  caam blob-gen: moving blob_priv to caam_drv_private
  KEYS: trusted: caam based black key
  caam alg: symmetric key ciphers are updated
  dm-crypt: consumer-app setting the flag-is_hbk

 crypto/skcipher.c                         |   3 +-
 drivers/crypto/caam/blob_gen.c            | 242 ++++++++++++++++++++--
 drivers/crypto/caam/caamalg.c             |  37 +++-
 drivers/crypto/caam/caamalg_desc.c        |   8 +-
 drivers/crypto/caam/desc.h                |   8 +-
 drivers/crypto/caam/desc_constr.h         |   6 +-
 drivers/crypto/caam/intern.h              |   6 +-
 drivers/md/dm-crypt.c                     |   6 +-
 include/keys/trusted-type.h               |   2 +
 include/linux/crypto.h                    |   2 +
 include/soc/fsl/caam-blob.h               |  44 ++--
 security/keys/trusted-keys/trusted_caam.c |   6 +
 security/keys/trusted-keys/trusted_core.c |  14 ++
 13 files changed, 333 insertions(+), 51 deletions(-)

-- 
2.17.1