Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Varun Sethi <V.Sethi@nxp.com>
To:     Herbert Xu <herbert@gondor.apana.org.au>
CC:     Pankaj Gupta <pankaj.gupta@nxp.com>,
        "jarkko@kernel.org" <jarkko@kernel.org>,
        "a.fatoum@pengutronix.de" <a.fatoum@pengutronix.de>,
        "Jason@zx2c4.com" <Jason@zx2c4.com>,
        "jejb@linux.ibm.com" <jejb@linux.ibm.com>,
        "zohar@linux.ibm.com" <zohar@linux.ibm.com>,
        "dhowells@redhat.com" <dhowells@redhat.com>,
        "sumit.garg@linaro.org" <sumit.garg@linaro.org>,
        "david@sigma-star.at" <david@sigma-star.at>,
        "michael@walle.cc" <michael@walle.cc>,
        "john.ernberg@actia.se" <john.ernberg@actia.se>,
        "jmorris@namei.org" <jmorris@namei.org>,
        "serge@hallyn.com" <serge@hallyn.com>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "j.luebbe@pengutronix.de" <j.luebbe@pengutronix.de>,
        "ebiggers@kernel.org" <ebiggers@kernel.org>,
        "richard@nod.at" <richard@nod.at>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>,
        Sahil Malhotra <sahil.malhotra@nxp.com>,
        Kshitiz Varshney <kshitiz.varshney@nxp.com>,
        Horia Geanta <horia.geanta@nxp.com>
Subject: RE: [EXT] Re: [RFC PATCH HBK: 2/8] hw-bound-key: flag-is_hbk added to
 the tfm
Thread-Topic: [EXT] Re: [RFC PATCH HBK: 2/8] hw-bound-key: flag-is_hbk added
 to the tfm
Thread-Index: AQHYwbSVJxssHkcinkOJLgRDaMQm8K3R9HsAgAGdVwCAAAD6gIAAKqCAgAADO4CAAgk08IAG3V+AgABPatCAAD0bgIAMfEPw
Date:   Wed, 21 Sep 2022 11:07:07 +0000
Message-ID: <AM9PR04MB821120DC26BFDD907A1229B0E84F9@AM9PR04MB8211.eurprd04.prod.outlook.com>
References: <20220906065157.10662-1-pankaj.gupta@nxp.com>
 <20220906065157.10662-3-pankaj.gupta@nxp.com>
 <YxbsBiCrIQT/0xz6@gondor.apana.org.au>
 <DU2PR04MB86308036FB517BF8CAD3D32795419@DU2PR04MB8630.eurprd04.prod.outlook.com>
 <YxhHkz+UlE9XAG/Z@gondor.apana.org.au>
 <DU2PR04MB86308DB7CFBC7A31CEB612D295419@DU2PR04MB8630.eurprd04.prod.outlook.com>
 <YxhuC3QlurfSgdXG@gondor.apana.org.au>
 <AM9PR04MB8211C7D59379D4C9F877D20EE8449@AM9PR04MB8211.eurprd04.prod.outlook.com>
 <Yx/lc1YjWm9+df1r@gondor.apana.org.au>
 <AM9PR04MB82112828E21FDA2043073216E8479@AM9PR04MB8211.eurprd04.prod.outlook.com>
 <YyBbU9sNC88EXFJs@gondor.apana.org.au>
In-Reply-To: <YyBbU9sNC88EXFJs@gondor.apana.org.au>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?pyDyl2JVBSCy2GydL8cyKB38JC82YO6zbhfa7pPi4qRRxlJ8dEi6s69ZEMJ/?=
 =?us-ascii?Q?t3f1lnEo92JWOeIpUj8bFsbKn6tUI/k5js4tnWXwyhCAraSfZDxHG51QlUOi?=
 =?us-ascii?Q?oIh/mbnTkTOxBtxRXGz/hmIWPWU4pzNG3jouuHYw8nzq85VuOvNflPTOetvX?=
 =?us-ascii?Q?2kpM9a6l26MqgsPI2Oo4mIjztwRWRn6iTJ0gR2JJFmrKUBQIpcRqegprs3Vn?=
 =?us-ascii?Q?4ibgpFq4p7C10km2kVor3gmGEc3npdRXFK+TCwSj7Ei1tb/vs/z9MfLvjRZk?=
 =?us-ascii?Q?F+GK2WBkHNG04Z2Y/AFQ5zZF96xssPNsYaVdeuhefpXjs0eRAqt+/zpw8g5/?=
 =?us-ascii?Q?Nvcbpg1BUQYViot/oK990MVW9pRsQXGXDpoQFnwzx3S4nueLX99boJlcmuI0?=
 =?us-ascii?Q?uy0BgbLGgkbW1hEiW5ii2f2os/pEZtVGO3+Q+6r++p/lMdX5ED1DsXBFl0Lb?=
 =?us-ascii?Q?jDVo5c3ZA7cyaZXRMTP6n5/6oGeo7c7sx+BLaQ1B2jXFy5kq7QW2Zv3rbmlI?=
 =?us-ascii?Q?YKJRrkttx1RkDYbBRwagT9U+9BDeZkMXYsqZCG670VfJeyLhgacArdfA6pgE?=
 =?us-ascii?Q?M+UHumKYJzmLFwZEGmOPOkI1qAaLRstAbPsgJNHG03wzvTeTdLDRl0dKIu8Y?=
 =?us-ascii?Q?VCntvV1Z/4e+5X1hWKHMZILhi+KzaBO0C2kCK/vC0jXpTlpMzg1UJ/vcq7+j?=
 =?us-ascii?Q?0FvWYzgUeSUv1RjAzZcHlFUgbjSGOVhiZBWlDRvHhyIDNZPXX3oDf4fLTAa7?=
 =?us-ascii?Q?kAx6XgJFNTUk9XO1YssX1SVpOr+Bxd2baJI65g5Yrzqe8IYJdnH3OJxSpCYr?=
 =?us-ascii?Q?N+y/FAxPtDkxEGjzf/PzoQZUF1e4MarqtYM66tN+6e0PCqmfUWcYvvcvotPN?=
 =?us-ascii?Q?ZE8+czXlsW2VykDtloIkfWHJf1R2jj9v0DAE7XugZXECA13gwFSOcePZL8WO?=
 =?us-ascii?Q?qyoTvHIfS94sSd8Gqzd3TVbprzGYOlRW92pDPhxdIsX2h7jKuNWtZ9BpOA4u?=
 =?us-ascii?Q?m6oq5baKrQ9Mo3diq06LgX+NhoLJQY8BmGeSyMSFkhuHCM3Mlw9b86fdzkb8?=
 =?us-ascii?Q?CIXIFRMTrS6z1zGJYSsCF668sczTczRpLfMqfyvFYRow6jEIW00ce5+/NWpf?=
 =?us-ascii?Q?2KLEaa6dOH+G+FQp7n4sGwgragqYosQmJYpMtSC2SK3ZKqut7jIt0yHJcVqi?=
 =?us-ascii?Q?23L4R1RFcbG02tIcsqMhFfsn/ewCWQQ43EqEZSSdTOGXfgYdHnY6tRgJQdJ9?=
 =?us-ascii?Q?IPLdsqWPng/GK5V+3DP+hC6rQIVPAEKWuhuMdIP48SEUr7horUwXtwcIQJG3?=
 =?us-ascii?Q?1UHmX681NJN23LOrWlfeRA0rj1BX8nbOEoBuuZaqiNPJFChowyva2D6FJn1Y?=
 =?us-ascii?Q?T9M8booT4oj86Io91Z2JdEkf6c2BdcxIB/KZZHeEg9P3WM9QTPOMfB9naFTh?=
 =?us-ascii?Q?CGFopAMYAjPQQHYLQ7cZt9RfBz5JRG9WmE8yR2HIqqP+BCz15iUrFVyj47x1?=
 =?us-ascii?Q?0MWJiuHrcjRY48SC31p/Tl7zNQ/TcEpgzDvmMoZmqgwoUG54SEZY9JuZI6DR?=
 =?us-ascii?Q?WKlZIuK2vP9Cd40iSk0=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: AM9PR04MB8211.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 40d6fbba-25a2-4062-a4a8-08da9bc16c5f
X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Sep 2022 11:07:07.4922
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: CYvlWNSQZe7Px7BJ48n6PTgz5gO9Je4s3J1JJmvgFYGDQkOlAxw9IhGgSj3Trr9c
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU2PR04MB8887
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Hi Herbert,
Please find comments inline.


Regards
Varun

> -----Original Message-----
> From: Herbert Xu <herbert@gondor.apana.org.au>
> Sent: Tuesday, September 13, 2022 3:59 PM
> To: Varun Sethi <V.Sethi@nxp.com>
> Cc: Pankaj Gupta <pankaj.gupta@nxp.com>; jarkko@kernel.org;
> a.fatoum@pengutronix.de; Jason@zx2c4.com; jejb@linux.ibm.com;
> zohar@linux.ibm.com; dhowells@redhat.com; sumit.garg@linaro.org;
> david@sigma-star.at; michael@walle.cc; john.ernberg@actia.se;
> jmorris@namei.org; serge@hallyn.com; davem@davemloft.net;
> j.luebbe@pengutronix.de; ebiggers@kernel.org; richard@nod.at;
> keyrings@vger.kernel.org; linux-crypto@vger.kernel.org; linux-
> integrity@vger.kernel.org; linux-kernel@vger.kernel.org; linux-security-
> module@vger.kernel.org; Sahil Malhotra <sahil.malhotra@nxp.com>; Kshitiz
> Varshney <kshitiz.varshney@nxp.com>; Horia Geanta <horia.geanta@nxp.com>
> Subject: Re: [EXT] Re: [RFC PATCH HBK: 2/8] hw-bound-key: flag-is_hbk add=
ed
> to the tfm
>=20
> Caution: EXT Email
>=20
> On Tue, Sep 13, 2022 at 10:01:13AM +0000, Varun Sethi wrote:
> >
> > [Varun] The proposed patchset makes things more scalable. With the
> hardware backed key flag, there's no need for the security co-processor d=
river
> to register separate set of algorithms. This makes things simpler and mor=
e
> scalable for the consumers (OpenSSL, AF_ALG, KTLS etc), as they can conti=
nue to
> use standard set of algorithms and leave the key specific complexity to t=
he
> driver.
>=20
> Users already need to specify which driver they are going to use in order=
 to
> actually access the hardware keys instead of getting a software implement=
ation
> of the same algorithm.
>=20
> So I don't see what extra burdens are placed on them by the current regim=
e.
[Varun] Problem with the current approach is that it's completely disconnec=
ted from the kernel keyrings. We are using the trusted key rings for storin=
g the hardware backed keys. Now, for the hardware backed keys we can still =
continue to use the existing generic algorithms exposed by the crypto drive=
rs. With our approach the driver can distinguish between a hardware backed =
key and a plain key, thus perform the relevant operation.=20

As a part of our patchset we are also proposing modifications to the truste=
d keys, in order to store additional meta data associated with the key. =20

>=20
> Cheers,
> --
> Email: Herbert Xu <herbert@gondor.apana.org.au> Home Page:
> https://eur01.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fgondor=
.ap
> ana.org.au%2F~herbert%2F&amp;data=3D05%7C01%7CV.Sethi%40nxp.com%7C9
> df35ead51ad4143067e08da9572d5d5%7C686ea1d3bc2b4c6fa92cd99c5c301635
> %7C0%7C0%7C637986617695149505%7CUnknown%7CTWFpbGZsb3d8eyJWIjoi
> MC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000
> %7C%7C%7C&amp;sdata=3Dt5RXelrFDZZ7GdMyZeLcSR2hRN6O0Hs8uI2MpIwhCms
> %3D&amp;reserved=3D0
> PGP Key:
> https://eur01.safelinks.protection.outlook.com/?url=3Dhttp%3A%2F%2Fgondor=
.ap
> ana.org.au%2F~herbert%2Fpubkey.txt&amp;data=3D05%7C01%7CV.Sethi%40nxp.
> com%7C9df35ead51ad4143067e08da9572d5d5%7C686ea1d3bc2b4c6fa92cd99
> c5c301635%7C0%7C0%7C637986617695149505%7CUnknown%7CTWFpbGZsb3
> d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3
> D%7C3000%7C%7C%7C&amp;sdata=3DV7NXYx5pYPjte6jlw1gpYCBPftJBZGpHBN44
> e3pD0ps%3D&amp;reserved=3D0