Under Lock & Key: Using Hardware Protected Keys with the Linux Crypto API
Talkat Open Source Summit Europe + Embedded Linux Conference Europe 2019 · on Wednesday, 2019-10-30· at 11:30· Forum 1·
summary
Linux now supports keys locked in hardware via the Crypto API: IBM added an implementation in 2016 and an Arm CryptoCell driver implements the same mechanism so kernel crypto ops can use a PAES-style protected transform by passing a small tag/blob or slot index instead of the raw key. Example: dm-crypt can be configured to use crypto-cell slot 1 and the kernel delegates encrypt/decrypt to hardware. Caveats: tag formats vary, provisioning is device-specific, and there are no user-space permission checks by default.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 4:10Usage Example
- 5:55Reservation Provider Priority
- 8:28Pointer to Memory
- 8:59Key Copy
- 9:46Hardware Protected Keys
- 12:57IBM
- 16:19How it works
- 18:41Security
- 21:18More details
- 27:45Conclusion
- 30:25QA
related talks
43mTPMs and the Linux Kernel: unlocking a better path to hardware security
47mTPMs and the Linux Kernel: unlocking a better path to hardware security
27mCoupling Key-Ring and Linux Crypto-API Framework(LCF) via Crypto-Transformation(tfm)
41mWhat Is Linux Kernel Keystore and Why You Should Use It in Your Next...
45mTPMs & The Linux Kernel: Unlocking A Better Path To Hardware Security
54mTPMs and the Linux Kernel: unlocking a better path to hardware security
55mWhat is Linux kernel keystore and why you should use it in your next application
30mKernel Hardening With Protection Keys