Posts
4417
Following
315
Followers
471
Linux kernel hacker and maintainer etc.

OpenPGP: 3AB05486C7752FE1

Jarkko Sakkinen

Edited 1 year ago

for tpm2_encodeobject: https://lists.buildroot.org/pipermail/buildroot/2024-May/753689.html

Key creation (not yet fully tested):

tpm2_createprimary --hierarchy o -G rsa2048 -c owner.txt
tpm2_evictcontrol -c owner.txt 0x81000001
tpm2_getcap handles-persistent
openssl genrsa -out private.pem 2048
tpm2_import -C 0x81000001 -G rsa -i private.pem -u key.pub -r key.priv
tpm2_encodeobject -C 0x81000001 -u key.pub -r key.priv -o key.priv.pem
openssl asn1parse -inform pem -in key.priv.pem -noout -out key.priv.der
key_serial=`cat key.priv.der | keyctl padd asymmetric tpm @u`

The asymmetric key should be then available as subcommands of keyctl pkey_encrypt $key_serial.

0
0
0
Now it has also asymmetric_key_parser implementation "tpm2_key_rsa_parser".
1
0
0

Jarkko Sakkinen

Edited 1 year ago

A new asymmetric key type tpm2_key_rsa: https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/log/?h=tpm2_key

Missing still integration to the pre-existing ASN.1 parser but can already sign with the null seed (default if parent is not defined).

I though this would be most logical way to define asymmetric key. Later on tpm2_key_ecdsa can be added. Also for RSA we should use TPM2_RSA_Decrypt for decryption and signing, whereas ECDSA requires potentially more expensive TPM2_Sign and TPM2_EncryptDecrypt.

It is still experimental. Testing the key type itself without parser first with the help of null seed, and then adding bits to call the ASN.1 parser by implementing asymmetric_key_parser. This derived work from James Prestwood’s earlier work from 2020.

1
0
0

Jarkko Sakkinen

when saving kconfig files with nvim for some reason all text paragraphs show diff in all lines of the paragraph. no configuration changes in nvim, suddenly appeared issue, maybe because some update dunno.

never happens anywhere else (tested e.g. with Sublime Text with NeoVintageous).
0
0
0
Highly recommended, actually almost mandatory, for anyone using TPM2 encrypted boot but in that case this problem does not exist in the first place.
0
0
0

Jarkko Sakkinen

Edited 1 year ago
rc1 will have this slowdown issue because the patch will go to my rc2 PR. for most part on desktop you still want this so not a big deal.
1
0
0
... pushed already to master/next w/o review comments, it is just making upcoming feature opt-in. Turning default later off is much more tedious than turning it on so it is the right thing to do.

So soon available in linux-next...
1
0
0

Jarkko Sakkinen

IMHO, a rational choice. Distributors know how to enable this for workstation/server, and for devices that are not fast enough have always e.g. fTPM in TrustZone option.

https://lore.kernel.org/linux-integrity/20240518113424.13486-1-jarkko@kernel.org/T/#u
1
0
0
looks like it is working now:
1
0
1

Jarkko Sakkinen

Edited 1 year ago
#buildroot is probably quite nice way to generate initramfs and kernel for systemd-ukify.

ukify build --linux=images/bzImage --initrd=images/roofs.cpio

Or along the lines.

I.e use Unified Kernel Image (UKI) in kernel testing.

#linux #kernel
1
0
0

Jarkko Sakkinen

Edited 1 year ago
In addition to "show me the code", there is always also "show me the payload".

The easiest way to move forward with a feature is not to have best possible code quality (at least when tagged as RFC). Instead, having a provable payload for the feature is essential.

https://lore.kernel.org/all/D1BC3VWXKTNC.2DB9JIIDOFIOQ@kernel.org/
0
0
0
@mikebabcock the single best way to use caps is to try avoid using them imho...
1
0
0

Jarkko Sakkinen

I had no idea that we have that many sets of capabilities, oh dear... https://lore.kernel.org/all/D1BBFWKGIA94.JP53QNURY3J4@kernel.org/
1
0
1
@ohmrun Mathematically (as per field of category theory which is sort of "superset" of set theory) Haskell is more "perfect" but as a practical hammer like tool OCaml is IMHO so much more useful ;-)
1
0
1
@ohmrun I've found for some reason OCaml to be much more digestible at least for my brains. I see it also more in the wild.
1
0
0
Show older