Lubancat2/kernel
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

crypto: ccree - enable support for hardware keys

Browse Source 
Enable CryptoCell support for hardware keys.

Hardware keys are regular AES keys loaded into CryptoCell internal memory
via firmware, often from secure boot ROM or hardware fuses at boot time.

As such, they can be used for enc/dec purposes like any other key but
cannot (read: extremely hard to) be extracted since since they are not
available anywhere in RAM during runtime.

The mechanism has some similarities to s390 secure keys although the keys
are not wrapped or sealed, but simply loaded offline. The interface was
therefore modeled based on the s390 secure keys support.

Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This commit is contained in:
Gilad Ben-Yossef
2018-04-23 08:25:14 +01:00
committed by Herbert Xu
parent 658c9d2b9f
commit a794d8d876
3 changed files with 362 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
crypto/testmgr.c
View File

@ -2581,6 +2581,13 @@ static const struct alg_test_desc alg_test_descs[] = {
.dec = __VECS(des3_ede_cbc_dec_tv_template)
}
}
}, {
/* Same as cbc(aes) except the key is stored in
* hardware secure memory which we reference by index
*/
.alg = "cbc(paes)",
.test = alg_test_null,
.fips_allowed = 1,
}, {
.alg = "cbc(serpent)",
.test = alg_test_skcipher,
@ -2727,6 +2734,13 @@ static const struct alg_test_desc alg_test_descs[] = {
.dec = __VECS(des3_ede_ctr_dec_tv_template)
}
}
}, {
/* Same as ctr(aes) except the key is stored in
* hardware secure memory which we reference by index
*/
.alg = "ctr(paes)",
.test = alg_test_null,
.fips_allowed = 1,
}, {
.alg = "ctr(serpent)",
.test = alg_test_skcipher,
@ -2997,6 +3011,13 @@ static const struct alg_test_desc alg_test_descs[] = {
}
}
}
}, {
/* Same as ecb(aes) except the key is stored in
* hardware secure memory which we reference by index
*/
.alg = "ecb(paes)",
.test = alg_test_null,
.fips_allowed = 1,
}, {
.alg = "ecb(khazad)",
.test = alg_test_skcipher,
@ -3324,6 +3345,13 @@ static const struct alg_test_desc alg_test_descs[] = {
.dec = __VECS(aes_ofb_dec_tv_template)
}
}
}, {
/* Same as ofb(aes) except the key is stored in
* hardware secure memory which we reference by index
*/
.alg = "ofb(paes)",
.test = alg_test_null,
.fips_allowed = 1,
}, {
.alg = "pcbc(fcrypt)",
.test = alg_test_skcipher,
@ -3581,6 +3609,21 @@ static const struct alg_test_desc alg_test_descs[] = {
.dec = __VECS(aes_xts_dec_tv_template)
}
}
}, {
/* Same as xts(aes) except the key is stored in
* hardware secure memory which we reference by index
*/
.alg = "xts(paes)",
.test = alg_test_null,
.fips_allowed = 1,
}, {
.alg = "xts4096(paes)",
.test = alg_test_null,
.fips_allowed = 1,
}, {
.alg = "xts512(paes)",
.test = alg_test_null,
.fips_allowed = 1,
}, {
.alg = "xts(camellia)",
.test = alg_test_skcipher,