Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Varun Sethi <V.Sethi@nxp.com>
To:     Herbert Xu <herbert@gondor.apana.org.au>
CC:     Pankaj Gupta <pankaj.gupta@nxp.com>,
        "jarkko@kernel.org" <jarkko@kernel.org>,
        "a.fatoum@pengutronix.de" <a.fatoum@pengutronix.de>,
        "Jason@zx2c4.com" <Jason@zx2c4.com>,
        "jejb@linux.ibm.com" <jejb@linux.ibm.com>,
        "zohar@linux.ibm.com" <zohar@linux.ibm.com>,
        "dhowells@redhat.com" <dhowells@redhat.com>,
        "sumit.garg@linaro.org" <sumit.garg@linaro.org>,
        "david@sigma-star.at" <david@sigma-star.at>,
        "michael@walle.cc" <michael@walle.cc>,
        "john.ernberg@actia.se" <john.ernberg@actia.se>,
        "jmorris@namei.org" <jmorris@namei.org>,
        "serge@hallyn.com" <serge@hallyn.com>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "j.luebbe@pengutronix.de" <j.luebbe@pengutronix.de>,
        "ebiggers@kernel.org" <ebiggers@kernel.org>,
        "richard@nod.at" <richard@nod.at>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>,
        Sahil Malhotra <sahil.malhotra@nxp.com>,
        Kshitiz Varshney <kshitiz.varshney@nxp.com>,
        Horia Geanta <horia.geanta@nxp.com>
Subject: RE: [EXT] Re: [RFC PATCH HBK: 2/8] hw-bound-key: flag-is_hbk added to
 the tfm
Thread-Topic: [EXT] Re: [RFC PATCH HBK: 2/8] hw-bound-key: flag-is_hbk added
 to the tfm
Thread-Index: AQHYwbSVJxssHkcinkOJLgRDaMQm8K3R9HsAgAGdVwCAAAD6gIAAKqCAgAADO4CAAgk08IAG3V+AgABPatA=
Date:   Tue, 13 Sep 2022 10:01:13 +0000
Message-ID: <AM9PR04MB82112828E21FDA2043073216E8479@AM9PR04MB8211.eurprd04.prod.outlook.com>
References: <20220906065157.10662-1-pankaj.gupta@nxp.com>
 <20220906065157.10662-3-pankaj.gupta@nxp.com>
 <YxbsBiCrIQT/0xz6@gondor.apana.org.au>
 <DU2PR04MB86308036FB517BF8CAD3D32795419@DU2PR04MB8630.eurprd04.prod.outlook.com>
 <YxhHkz+UlE9XAG/Z@gondor.apana.org.au>
 <DU2PR04MB86308DB7CFBC7A31CEB612D295419@DU2PR04MB8630.eurprd04.prod.outlook.com>
 <YxhuC3QlurfSgdXG@gondor.apana.org.au>
 <AM9PR04MB8211C7D59379D4C9F877D20EE8449@AM9PR04MB8211.eurprd04.prod.outlook.com>
 <Yx/lc1YjWm9+df1r@gondor.apana.org.au>
In-Reply-To: <Yx/lc1YjWm9+df1r@gondor.apana.org.au>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?l8MGHONMaIcIPzIfljHcFty3nk82lJ1w6kYLS46XhxK8D5TvdWBcUAlwEuqc?=
 =?us-ascii?Q?agolXzeY1+4+/Jria8OZTr6V1aeMlxyNlkWhi0/uDiV+TpA0VxYzHhCgwlHx?=
 =?us-ascii?Q?GOx7I8Xw1/n6TRbAKAGlN4xV5qp/DCO4G5pcbdLzioSqNivcBPChbs3uljBO?=
 =?us-ascii?Q?EYq6TixLtCuT/gmwG3ilAD7JZ8NiK5HrN4cTHnZPyckfDhXpW1cJUXY/MjjO?=
 =?us-ascii?Q?duZaB5q7aZpeg9WUESBLdkwm/nx/loU31WmcCMsc2aVgNvz1CX0Jiq/8mGqB?=
 =?us-ascii?Q?QXr+XMiRoJ044dyisQMnGKTpkhxRUQUvfpsSyVZquLDNGty2wawdsHyDwuZp?=
 =?us-ascii?Q?u+7tsubHAz1QoxEwqM8qIB3PPGWvzn0XvaSZk/ujM7SB8XAEtlHKc+193+D1?=
 =?us-ascii?Q?M5wwycwc8j/QWWqtDLDWYEBmKE9v0R0ndUyxnnVN/I8v0/E6OB7PIqQ18a7k?=
 =?us-ascii?Q?699fMtcyXcuVfsu8nNjA3XMZYFMvUViIVazCQChFLonByU4elJRXBWbLJojN?=
 =?us-ascii?Q?isn0b9cZYlC/l8JKx8r82uGi1o7DoEAwOggFGd9tCuJzYkpFJUdpQiJH0EL2?=
 =?us-ascii?Q?YuHJxgvFkEdZVWoQUuAvPn41+6ND9N5wziU97SGww2Udnr7Ktk+SOLnbh0dm?=
 =?us-ascii?Q?T+PaphAyC5cZDkKepXdXB9d2RxQK1vIhlsGI5wBSvHAYDaH9pdFe48kE6J0M?=
 =?us-ascii?Q?ts+igWubKWtKKcamasbuTJjDPLdP82iBu8R+ZuvYnovUzye4xHTbQJQ6JSMX?=
 =?us-ascii?Q?sUWRTGCCzFFfPQacGQ8QNd+ew95H/cFdItlmTbGFzqS6JU9Gc54n+oZZplHS?=
 =?us-ascii?Q?hoIgyuJoMVHQPDP2Hd8UaI17eQ8jOQP75+YL3nESxN8V3Sqb7VuODq7AURIr?=
 =?us-ascii?Q?gkNvCH/gAZKxScba8m5giuRT9PcP/rWQZYX18qOFfaGBhB2D1RK2h6Ab+TP9?=
 =?us-ascii?Q?YO+i+ynpL+cgKKRvv1TSquLrgy6/NAik0E0x+DYWkML3mtz1LzLNmlXO+UMi?=
 =?us-ascii?Q?X5A6UCcCZnr0q2MdS3ax+QcWNfSD5u4x5Me0ZzEAF4gRvKmuzfL0gv0i3GVh?=
 =?us-ascii?Q?Ub2QKIAE6odMSVaMrxgms6Ha8DfBLh4QHaQEETOF4FfE03R6ajPreWS0Hn5q?=
 =?us-ascii?Q?xHEKaZY3j1f1PQNe5FyENIdzBgevxkJHD9U7FLmN1J9fV3k/egzVBa0aup2I?=
 =?us-ascii?Q?+33uNqckxS6qv3Z5/TGYLXKl9jVtiaQWnwRmBud2pqMMlL5/RhIK+GjGSGB8?=
 =?us-ascii?Q?NuJAMWNf/w9wxMYS2gg0rLmRCNXrn0y7nnIAABu1iqoa8HOAv36mUshiSDJk?=
 =?us-ascii?Q?zlhU6qY+lKG7vAG/Z43UCwoY784uWAuDAwSoXH9nsJI5FlPcZ04DGFSj3zwm?=
 =?us-ascii?Q?dKHnhl+a7qjnXTNMUiLiu9PDHBc+Il+a0kLRMxiCwyiLWpWn4HBzBmPEMZCk?=
 =?us-ascii?Q?y+YaAKzDvM/4yjuqfXk9A0gWM8BN4z3COU9Zv7RMIUcaFho9A+HC1KHYac4C?=
 =?us-ascii?Q?L+41AG/EFvuAATHjg0y888iqmzskh+lHdxIQef7zem7HIRrCJ3aS4gf1UB6S?=
 =?us-ascii?Q?EbaIq0QfjmF94y1WRow=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: AM9PR04MB8211.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d9aed664-5798-4f5f-03c2-08da956ee411
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Sep 2022 10:01:13.1295
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: dqcUlzyr25d9W5EmAZJNBxwt5tHIBtIZ6h68ODTGzufGNolNc6jWDsdYr5jiCxL7
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM8PR04MB7460
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Hi Herbert,
Please find response inline.

Regards
Varun

> -----Original Message-----
> From: Herbert Xu <herbert@gondor.apana.org.au>
> Sent: Tuesday, September 13, 2022 7:36 AM
> To: Varun Sethi <V.Sethi@nxp.com>
> Cc: Pankaj Gupta <pankaj.gupta@nxp.com>; jarkko@kernel.org;
> a.fatoum@pengutronix.de; Jason@zx2c4.com; jejb@linux.ibm.com;
> zohar@linux.ibm.com; dhowells@redhat.com; sumit.garg@linaro.org;
> david@sigma-star.at; michael@walle.cc; john.ernberg@actia.se;
> jmorris@namei.org; serge@hallyn.com; davem@davemloft.net;
> j.luebbe@pengutronix.de; ebiggers@kernel.org; richard@nod.at;
> keyrings@vger.kernel.org; linux-crypto@vger.kernel.org; linux-
> integrity@vger.kernel.org; linux-kernel@vger.kernel.org; linux-security-
> module@vger.kernel.org; Sahil Malhotra <sahil.malhotra@nxp.com>; Kshitiz
> Varshney <kshitiz.varshney@nxp.com>; Horia Geanta <horia.geanta@nxp.com>
> Subject: Re: [EXT] Re: [RFC PATCH HBK: 2/8] hw-bound-key: flag-is_hbk add=
ed
> to the tfm
>=20
> Caution: EXT Email
>=20
> On Mon, Sep 12, 2022 at 05:19:44PM +0000, Varun Sethi wrote:
> >
> > > On Wed, Sep 07, 2022 at 09:58:45AM +0000, Pankaj Gupta wrote:
> > > >
> > > > There are 3rd party IP(s), which uses kernel for crypto-algorithm's
> operations.
> > > > Modifying the algorithm name in these IP(s), is not always allowed
> > > > or easy to
> > > maintain.
> > >
> > > So the objective is to support out-of-tree modules?
> > [Varun] No, the intention is not to use out of tree modules but to allo=
w
> seamless use of crytpo ciphers with keys backed by security co-processors=
 (keys
> only visible to security co-processors), by Linux kernel and userspace
> components. Hardware backed keys are being introduced as a variant of exi=
sting
> Trusted keys, with the difference that these are not un-sealed and releas=
ed in
> plain to the kernel memory. With the current patchset, the existing set o=
f ciphers
> can be used along with newly introduced hardware backed flag. The securit=
y co-
> processor driver is able to interpret the flag and subsequently program t=
he
> hardware, to interpret the supplied key as a hardware backed key.
>=20
> Well I asked why isn't the existing arrangement for hardware key algorith=
ms
> sufficient, and I was given the response that you needed this for compati=
bility
> with third-party IP(s).
>=20
> Now are you saying this is not the case? So the existing framework should=
 work
> then?
>=20
[Varun] The proposed patchset makes things more scalable. With the hardware=
 backed key flag, there's no need for the security co-processor driver to r=
egister separate set of algorithms. This makes things simpler and more scal=
able for the consumers (OpenSSL, AF_ALG, KTLS etc), as they can continue to=
 use standard set of algorithms and leave the key specific complexity to th=
e driver.

> Cheers,
> --
> Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page:
> https://eur01.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fgondor=
.ap
> ana.org.au%2F~herbert%2F&amp;data=3D05%7C01%7CV.Sethi%40nxp.com%7C6
> 51bdc5f5da249c7f23408da952c9980%7C686ea1d3bc2b4c6fa92cd99c5c301635
> %7C0%7C0%7C637986316034004134%7CUnknown%7CTWFpbGZsb3d8eyJWIjoi
> MC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000
> %7C%7C%7C&amp;sdata=3Db%2BjXwEqMEomgvSpLVnNzuWRNbmfQF4pX5hitrFh
> Frww%3D&amp;reserved=3D0
> PGP Key:
> https://eur01.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fgondor=
.ap
> ana.org.au%2F~herbert%2Fpubkey.txt&amp;data=3D05%7C01%7CV.Sethi%40nxp.
> com%7C651bdc5f5da249c7f23408da952c9980%7C686ea1d3bc2b4c6fa92cd99c
> 5c301635%7C0%7C0%7C637986316034004134%7CUnknown%7CTWFpbGZsb3d
> 8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D
> %7C3000%7C%7C%7C&amp;sdata=3D6VRL5smACsEevXL8HKs2ADlni9G%2F9J0q7E
> 3Q2emxVzU%3D&amp;reserved=3D0