All ops work now so time to submit despite there's stuff to clean up. But it is better send before breaking it by cleaning it up :-)

Also decrypt works:

# echo "abcdefg" > plaintext.txt
#
keyctl pkey_encrypt $serial 0 plaintext.txt enc=pkcs1 > encrypted.dat
# keyctl pkey_decrypt $serial 0 encrypted.dat enc=pkcs1 > decrypted.dat
keyctl pkey_decrypt $serial 0 encrypted.dat enc=pkcs1 > decrypted.dat
tpm2_key_rsa: parent: 0x81000001
tpm2_key_rsa: key: 0x80000001
# cat decrypted.dat
cat decrypted.dat
abcdefg

Great pkey_encrypt full pass!

v3: https://lists.buildroot.org/pipermail/buildroot/2024-May/753709.html

Basic smoke test that TPM2 RSA asymmetric must pass to be usable:

tpm2_createprimary --hierarchy o -G rsa2048 -c owner.txt
tpm2_evictcontrol -c owner.txt 0x81000001
tpm2_getcap handles-persistent
openssl genrsa -out private.pem 2048
tpm2_import -C 0x81000001 -G rsa -i private.pem -u key.pub -r key.priv
tpm2_encodeobject -C 0x81000001 -u key.pub -r key.priv -o key.priv.pem
openssl asn1parse -inform pem -in key.priv.pem -noout -out key.priv.der
serial=`cat key.priv.der | keyctl padd asymmetric tpm @u`
echo "abcdefg" > plaintext.txt
keyctl pkey_encrypt $serial 0 plaintext.txt enc=pkcs1 > encrypted.dat
keyctl pkey_decrypt $serial 0 encrypted.dat enc=pkcs1 > decrypted.dat
keyctl pkey_sign $serial 0 plaintext.txt enc=pkcs1 hash=sha256 > signed.dat
keyctl pkey_verify $serial 0 plaintext.txt signed.dat enc=pkcs1 hash=sha256

#tpm #linux #kernel

Found the reason for -EINVAL in parsing: tpm2_key: OID is "2.23.133.10.1.3" which is not TPMSealedData

https://lore.kernel.org/linux-integrity/D1DMTJYL7TFC.3J3FM36K06ECD@kernel.org/

Failed to have everything in the commits so this just fixed compilation errors: https://lore.kernel.org/linux-integrity/20240519002616.4432-1-jarkko@kernel.org/T/#t

asymmetric #TPM2 key type RFC: https://lore.kernel.org/linux-crypto/20240518213700.5960-1-jarkko@kernel.org/T/#t #linux #kernel

for tpm2_encodeobject: https://lists.buildroot.org/pipermail/buildroot/2024-May/753689.html

Key creation (not yet fully tested):

tpm2_createprimary --hierarchy o -G rsa2048 -c owner.txt
tpm2_evictcontrol -c owner.txt 0x81000001
tpm2_getcap handles-persistent
openssl genrsa -out private.pem 2048
tpm2_import -C 0x81000001 -G rsa -i private.pem -u key.pub -r key.priv
tpm2_encodeobject -C 0x81000001 -u key.pub -r key.priv -o key.priv.pem
openssl asn1parse -inform pem -in key.priv.pem -noout -out key.priv.der
key_serial=`cat key.priv.der | keyctl padd asymmetric tpm @u`

The asymmetric key should be then available as subcommands of keyctl pkey_encrypt $key_serial.

Now it has also asymmetric_key_parser implementation "tpm2_key_rsa_parser".

A new asymmetric key type tpm2_key_rsa: https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/log/?h=tpm2_key

Missing still integration to the pre-existing ASN.1 parser but can already sign with the null seed (default if parent is not defined).

I though this would be most logical way to define asymmetric key. Later on tpm2_key_ecdsa can be added. Also for RSA we should use TPM2_RSA_Decrypt for decryption and signing, whereas ECDSA requires potentially more expensive TPM2_Sign and TPM2_EncryptDecrypt.

It is still experimental. Testing the key type itself without parser first with the help of null seed, and then adding bits to call the ASN.1 parser by implementing asymmetric_key_parser. This derived work from James Prestwood’s earlier work from 2020.

when saving kconfig files with nvim for some reason all text paragraphs show diff in all lines of the paragraph. no configuration changes in nvim, suddenly appeared issue, maybe because some update dunno.

never happens anywhere else (tested e.g. with Sublime Text with NeoVintageous).

Highly recommended, actually almost mandatory, for anyone using TPM2 encrypted boot but in that case this problem does not exist in the first place.

rc1 will have this slowdown issue because the patch will go to my rc2 PR. for most part on desktop you still want this so not a big deal.

... pushed already to master/next w/o review comments, it is just making upcoming feature opt-in. Turning default later off is much more tedious than turning it on so it is the right thing to do.

So soon available in linux-next...

IMHO, a rational choice. Distributors know how to enable this for workstation/server, and for devices that are not fast enough have always e.g. fTPM in TrustZone option.

https://lore.kernel.org/linux-integrity/20240518113424.13486-1-jarkko@kernel.org/T/#u

v2: https://lists.buildroot.org/pipermail/buildroot/2024-May/753662.html

#Rust crate for #zmodem: https://crates.io/crates/zmodem2 #rustlang

checkpoint: https://lists.buildroot.org/pipermail/buildroot/2024-May/753633.html

looks like it is working now: