@Foxboron not a big surprise. I guess [1] would be relevant for me but since I don't have a employer to pay it for me I'll pass :-) Maybe next year. I'll read the summaries from LWN.

[1] https://lpc.events/event/18/page/232-proposed-microconferences#sysboot

My #CI hack can do kernel CI in any possible runner: https://gitlab.com/jarkkojs/linux-tpmdd-test

It builds #BuildRoot environment and runs tests inside it. Probably this something more infrastructural, dunno have not checked :-)

I.e.

git clone https://gitlab.com/jarkkojs/linux-tpmdd-test.git
cd linux-tpmdd-test
cmake -Bbuild && make -Cbuild buildroot-prepare
make -Cbuild/buildroot/build
build/buildroot/build/images/run-tests.sh

It uses TCL’s (in)famous expect to check the output and uses socat and UNIX socket for communications with appropriate QEMU options. And yeah it supports also TPM chips so can be made to boot up modern #systemd installation (have not done so but might in future).

Runner’s ISA does not matter as everything is built up from ground, including toolchain so supports both x86 and ARM although the build itself is x86 ATM. Essentially it can run tests exactly how I would run them on desktop.

https://lwn.net/Articles/972713/

#linux #kernel #gitlab

[$] What's next for the SLUB allocator https://lwn.net/Articles/974138/ #LWN

Sent a patch set that adds a new driver tpm2_key_rsa, which is asymmetric key type for the sake of interoperability with #x509. Also covers grounds for future drivers such as probably tpm2_key_ecdsa.

https://lore.kernel.org/linux-integrity/20240520184727.22038-1-jarkko@kernel.org/T/#t

#linux #kernel #tpm

All ops work now so time to submit despite there's stuff to clean up. But it is better send before breaking it by cleaning it up :-)

Also decrypt works:

# echo "abcdefg" > plaintext.txt
#
keyctl pkey_encrypt $serial 0 plaintext.txt enc=pkcs1 > encrypted.dat
# keyctl pkey_decrypt $serial 0 encrypted.dat enc=pkcs1 > decrypted.dat
keyctl pkey_decrypt $serial 0 encrypted.dat enc=pkcs1 > decrypted.dat
tpm2_key_rsa: parent: 0x81000001
tpm2_key_rsa: key: 0x80000001
# cat decrypted.dat
cat decrypted.dat
abcdefg

Great pkey_encrypt full pass!

v3: https://lists.buildroot.org/pipermail/buildroot/2024-May/753709.html

Basic smoke test that TPM2 RSA asymmetric must pass to be usable:

tpm2_createprimary --hierarchy o -G rsa2048 -c owner.txt
tpm2_evictcontrol -c owner.txt 0x81000001
tpm2_getcap handles-persistent
openssl genrsa -out private.pem 2048
tpm2_import -C 0x81000001 -G rsa -i private.pem -u key.pub -r key.priv
tpm2_encodeobject -C 0x81000001 -u key.pub -r key.priv -o key.priv.pem
openssl asn1parse -inform pem -in key.priv.pem -noout -out key.priv.der
serial=`cat key.priv.der | keyctl padd asymmetric tpm @u`
echo "abcdefg" > plaintext.txt
keyctl pkey_encrypt $serial 0 plaintext.txt enc=pkcs1 > encrypted.dat
keyctl pkey_decrypt $serial 0 encrypted.dat enc=pkcs1 > decrypted.dat
keyctl pkey_sign $serial 0 plaintext.txt enc=pkcs1 hash=sha256 > signed.dat
keyctl pkey_verify $serial 0 plaintext.txt signed.dat enc=pkcs1 hash=sha256

#tpm #linux #kernel

Found the reason for -EINVAL in parsing: tpm2_key: OID is "2.23.133.10.1.3" which is not TPMSealedData

https://lore.kernel.org/linux-integrity/D1DMTJYL7TFC.3J3FM36K06ECD@kernel.org/

Failed to have everything in the commits so this just fixed compilation errors: https://lore.kernel.org/linux-integrity/20240519002616.4432-1-jarkko@kernel.org/T/#t

asymmetric #TPM2 key type RFC: https://lore.kernel.org/linux-crypto/20240518213700.5960-1-jarkko@kernel.org/T/#t #linux #kernel

for tpm2_encodeobject: https://lists.buildroot.org/pipermail/buildroot/2024-May/753689.html

Key creation (not yet fully tested):

tpm2_createprimary --hierarchy o -G rsa2048 -c owner.txt
tpm2_evictcontrol -c owner.txt 0x81000001
tpm2_getcap handles-persistent
openssl genrsa -out private.pem 2048
tpm2_import -C 0x81000001 -G rsa -i private.pem -u key.pub -r key.priv
tpm2_encodeobject -C 0x81000001 -u key.pub -r key.priv -o key.priv.pem
openssl asn1parse -inform pem -in key.priv.pem -noout -out key.priv.der
key_serial=`cat key.priv.der | keyctl padd asymmetric tpm @u`

The asymmetric key should be then available as subcommands of keyctl pkey_encrypt $key_serial.

Now it has also asymmetric_key_parser implementation "tpm2_key_rsa_parser".

A new asymmetric key type tpm2_key_rsa: https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/log/?h=tpm2_key

Missing still integration to the pre-existing ASN.1 parser but can already sign with the null seed (default if parent is not defined).

I though this would be most logical way to define asymmetric key. Later on tpm2_key_ecdsa can be added. Also for RSA we should use TPM2_RSA_Decrypt for decryption and signing, whereas ECDSA requires potentially more expensive TPM2_Sign and TPM2_EncryptDecrypt.

It is still experimental. Testing the key type itself without parser first with the help of null seed, and then adding bits to call the ASN.1 parser by implementing asymmetric_key_parser. This derived work from James Prestwood’s earlier work from 2020.

when saving kconfig files with nvim for some reason all text paragraphs show diff in all lines of the paragraph. no configuration changes in nvim, suddenly appeared issue, maybe because some update dunno.

never happens anywhere else (tested e.g. with Sublime Text with NeoVintageous).

Highly recommended, actually almost mandatory, for anyone using TPM2 encrypted boot but in that case this problem does not exist in the first place.

rc1 will have this slowdown issue because the patch will go to my rc2 PR. for most part on desktop you still want this so not a big deal.

... pushed already to master/next w/o review comments, it is just making upcoming feature opt-in. Turning default later off is much more tedious than turning it on so it is the right thing to do.

So soon available in linux-next...

IMHO, a rational choice. Distributors know how to enable this for workstation/server, and for devices that are not fast enough have always e.g. fTPM in TrustZone option.

https://lore.kernel.org/linux-integrity/20240518113424.13486-1-jarkko@kernel.org/T/#u