Skip to content
  • Iuliana Prodan's avatar
    1f585456
    MLK-24420-2 crypto: caam - add support for black keys and blobs · 1f585456
    Iuliana Prodan authored
    
    
    CAAM's Black Key mechanism is intended for protection
    of user keys against bus snooping. This automatically
    encapsulates and decapsulates cryptographic keys ''on-the-fly''
    in an encrypted data structure called a Black Key.
    Before a value is copied from a Key Register to memory,
    CAAM will automatically encrypt the key as a Black Key
    (encrypted key) using the current value in the JDKEKR or
    TDKEKR as the encryption key.
    
    CAAM's built-in Blob Protocol provides a method for protecting
    user-defined data across system power cycles. CAAM protects data
    in a data structure called a Blob, which provides both confidentiality
    and integrity protection. The data to be protected is encrypted so that
    it can be safely placed into non-volatile storage before the SoC is
    powered down.
    
    This patch includes the support to generate a black key from random or
    from a plaintext. Also one can encapsulate it into a blob or decapsulate
    a black key from a blob.
    The key and blob generation descriptors are exported into a separate file,
    such that they could be shared with other interfaces (qi, qi2).
    
    This feature has support only for black keys, encapsulated in
    black blobs in General Memory.
    
    In caamkeyblob_test.c file is a test that validates the above
    operations: create a black key from plaintext or from random,
    encapsulate and decapsulate a blob and compare the obtained black key.
    This test is configured as a kernel module.
    
    Signed-off-by: default avatarFranck LENORMAND <franck.lenormand@nxp.com>
    Signed-off-by: default avatarIuliana Prodan <iuliana.prodan@nxp.com>
    Reviewed-by: default avatarHoria Geantă <horia.geanta@nxp.com>
    (cherry picked from commit 84287c5d)
    
    Squashed fixes:
    9c24012e ("MLK-24496 crypto: caam - fix blob encapsulation/decapsulation")
    cd078fac ("MLK-24517-1 crypto: caam - removed unnecessary validation of black key for blob decapsulation")
    8888926c ("MLK-24517-2 crypto: caam - removed unnecessary validation of black key for blob encapsulation")
    e4b484ce ("MLK-24497 crypto: caam - update job descriptor with inline commands")
    
    Signed-off-by: default avatarIuliana Prodan <iuliana.prodan@nxp.com>
    Reviewed-by: default avatarHoria Geantă <horia.geanta@nxp.com>
    
    Squashed LF commit (rebase-v5.10-rc2/crypto/caam):
    035f5933cc45 ("crypto: caam: change kzfree to kfree_sensitive")
    
    Signed-off-by: default avatarHoria Geantă <horia.geanta@nxp.com>
    1f585456
    MLK-24420-2 crypto: caam - add support for black keys and blobs
    Iuliana Prodan authored
    
    
    CAAM's Black Key mechanism is intended for protection
    of user keys against bus snooping. This automatically
    encapsulates and decapsulates cryptographic keys ''on-the-fly''
    in an encrypted data structure called a Black Key.
    Before a value is copied from a Key Register to memory,
    CAAM will automatically encrypt the key as a Black Key
    (encrypted key) using the current value in the JDKEKR or
    TDKEKR as the encryption key.
    
    CAAM's built-in Blob Protocol provides a method for protecting
    user-defined data across system power cycles. CAAM protects data
    in a data structure called a Blob, which provides both confidentiality
    and integrity protection. The data to be protected is encrypted so that
    it can be safely placed into non-volatile storage before the SoC is
    powered down.
    
    This patch includes the support to generate a black key from random or
    from a plaintext. Also one can encapsulate it into a blob or decapsulate
    a black key from a blob.
    The key and blob generation descriptors are exported into a separate file,
    such that they could be shared with other interfaces (qi, qi2).
    
    This feature has support only for black keys, encapsulated in
    black blobs in General Memory.
    
    In caamkeyblob_test.c file is a test that validates the above
    operations: create a black key from plaintext or from random,
    encapsulate and decapsulate a blob and compare the obtained black key.
    This test is configured as a kernel module.
    
    Signed-off-by: default avatarFranck LENORMAND <franck.lenormand@nxp.com>
    Signed-off-by: default avatarIuliana Prodan <iuliana.prodan@nxp.com>
    Reviewed-by: default avatarHoria Geantă <horia.geanta@nxp.com>
    (cherry picked from commit 84287c5d)
    
    Squashed fixes:
    9c24012e ("MLK-24496 crypto: caam - fix blob encapsulation/decapsulation")
    cd078fac ("MLK-24517-1 crypto: caam - removed unnecessary validation of black key for blob decapsulation")
    8888926c ("MLK-24517-2 crypto: caam - removed unnecessary validation of black key for blob encapsulation")
    e4b484ce ("MLK-24497 crypto: caam - update job descriptor with inline commands")
    
    Signed-off-by: default avatarIuliana Prodan <iuliana.prodan@nxp.com>
    Reviewed-by: default avatarHoria Geantă <horia.geanta@nxp.com>
    
    Squashed LF commit (rebase-v5.10-rc2/crypto/caam):
    035f5933cc45 ("crypto: caam: change kzfree to kfree_sensitive")
    
    Signed-off-by: default avatarHoria Geantă <horia.geanta@nxp.com>
Loading