Files
linux/fs
Eric Biggers ebc4176551 blk-crypto: add basic hardware-wrapped key support
To prevent keys from being compromised if an attacker acquires read
access to kernel memory, some inline encryption hardware can accept keys
which are wrapped by a per-boot hardware-internal key.  This avoids
needing to keep the raw keys in kernel memory, without limiting the
number of keys that can be used.  Such hardware also supports deriving a
"software secret" for cryptographic tasks that can't be handled by
inline encryption; this is needed for fscrypt to work properly.

To support this hardware, allow struct blk_crypto_key to represent a
hardware-wrapped key as an alternative to a raw key, and make drivers
set flags in struct blk_crypto_profile to indicate which types of keys
they support.  Also add the ->derive_sw_secret() low-level operation,
which drivers supporting wrapped keys must implement.

For more information, see the detailed documentation which this patch
adds to Documentation/block/inline-encryption.rst.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Tested-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> # sm8650
Link: https://lore.kernel.org/r/20250204060041.409950-2-ebiggers@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-02-10 09:54:19 -07:00
..
2024-12-05 12:31:40 +01:00
2024-12-03 10:40:36 +01:00
2024-08-21 22:32:58 +02:00
2025-02-07 10:27:24 +01:00
2025-01-27 19:25:45 -05:00
2024-11-03 01:28:06 -05:00
2024-12-09 11:34:29 +01:00
2024-12-17 09:16:11 +01:00
2024-11-03 01:28:06 -05:00
2024-11-03 01:28:06 -05:00
2024-10-21 16:29:38 +02:00
2024-10-21 16:29:38 +02:00
2025-01-09 16:58:54 +01:00
2025-01-09 16:58:52 +01:00
2025-02-07 10:27:28 +01:00
2024-11-03 01:28:07 -05:00
2024-11-03 01:28:06 -05:00
2025-01-25 20:22:31 -08:00
2024-11-03 01:28:06 -05:00
2024-11-03 01:28:06 -05:00