-
Iuliana Prodan authored
CAAM's Black Key mechanism is intended for protection of user keys against bus snooping. This automatically encapsulates and decapsulates cryptographic keys ''on-the-fly'' in an encrypted data structure called a Black Key. Before a value is copied from a Key Register to memory, CAAM will automatically encrypt the key as a Black Key (encrypted key) using the current value in the JDKEKR or TDKEKR as the encryption key. CAAM's built-in Blob Protocol provides a method for protecting user-defined data across system power cycles. CAAM protects data in a data structure called a Blob, which provides both confidentiality and integrity protection. The data to be protected is encrypted so that it can be safely placed into non-volatile storage before the SoC is powered down. This patch includes the support to generate a black key from random or from a plaintext. Also one can encapsulate it into a blob or decapsulate a black key from a blob. The key and blob generation descriptors are exported into a separate file, such that they could be shared with other interfaces (qi, qi2). This feature has support only for black keys, encapsulated in black blobs in General Memory. In caamkeyblob_test.c file is a test that validates the above operations: create a black key from plaintext or from random, encapsulate and decapsulate a blob and compare the obtained black key. This test is configured as a kernel module. Signed-off-by:
Franck LENORMAND <franck.lenormand@nxp.com> Signed-off-by:
Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by:
Horia Geantă <horia.geanta@nxp.com> (cherry picked from commit 84287c5d) Squashed fixes: 9c24012e ("MLK-24496 crypto: caam - fix blob encapsulation/decapsulation") cd078fac ("MLK-24517-1 crypto: caam - removed unnecessary validation of black key for blob decapsulation") 8888926c ("MLK-24517-2 crypto: caam - removed unnecessary validation of black key for blob encapsulation") e4b484ce ("MLK-24497 crypto: caam - update job descriptor with inline commands") Signed-off-by:
Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by:
Horia Geantă <horia.geanta@nxp.com> Squashed LF commit (rebase-v5.10-rc2/crypto/caam): 035f5933cc45 ("crypto: caam: change kzfree to kfree_sensitive") Signed-off-by:
Horia Geantă <horia.geanta@nxp.com>
Iuliana Prodan authoredCAAM's Black Key mechanism is intended for protection of user keys against bus snooping. This automatically encapsulates and decapsulates cryptographic keys ''on-the-fly'' in an encrypted data structure called a Black Key. Before a value is copied from a Key Register to memory, CAAM will automatically encrypt the key as a Black Key (encrypted key) using the current value in the JDKEKR or TDKEKR as the encryption key. CAAM's built-in Blob Protocol provides a method for protecting user-defined data across system power cycles. CAAM protects data in a data structure called a Blob, which provides both confidentiality and integrity protection. The data to be protected is encrypted so that it can be safely placed into non-volatile storage before the SoC is powered down. This patch includes the support to generate a black key from random or from a plaintext. Also one can encapsulate it into a blob or decapsulate a black key from a blob. The key and blob generation descriptors are exported into a separate file, such that they could be shared with other interfaces (qi, qi2). This feature has support only for black keys, encapsulated in black blobs in General Memory. In caamkeyblob_test.c file is a test that validates the above operations: create a black key from plaintext or from random, encapsulate and decapsulate a blob and compare the obtained black key. This test is configured as a kernel module. Signed-off-by:
Franck LENORMAND <franck.lenormand@nxp.com> Signed-off-by:
Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by:
Horia Geantă <horia.geanta@nxp.com> (cherry picked from commit 84287c5d) Squashed fixes: 9c24012e ("MLK-24496 crypto: caam - fix blob encapsulation/decapsulation") cd078fac ("MLK-24517-1 crypto: caam - removed unnecessary validation of black key for blob decapsulation") 8888926c ("MLK-24517-2 crypto: caam - removed unnecessary validation of black key for blob encapsulation") e4b484ce ("MLK-24497 crypto: caam - update job descriptor with inline commands") Signed-off-by:
Iuliana Prodan <iuliana.prodan@nxp.com> Reviewed-by:
Horia Geantă <horia.geanta@nxp.com> Squashed LF commit (rebase-v5.10-rc2/crypto/caam): 035f5933cc45 ("crypto: caam: change kzfree to kfree_sensitive") Signed-off-by:
Horia Geantă <horia.geanta@nxp.com>
Loading