lkml.org 
[lkml]   [2014]   [Mar]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: RFC: 'ioctl' for keyrings
From
Date
On Fri, 2014-03-14 at 17:14 +0000, David Howells wrote: 
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>
> > > As I understand the code, I think operations being performed from ->update()
> > > are:
> > >
> > > (a) Resealing a key with a new pcrs (trusted).
> > >
> > > (b) Changing the master key (encrypted).
> > >
> > > Mimi, Dmitry: is this list right?
> >
> > In addition to resealing trusted keys to a new TPM PCR value, there are
> > a few other options that can be modified (eg. keyauth, blobauth,
> > pcrlock). Encrypted keys can be encrypted/decrypted with a new master
> > key (trusted or user key type).
>
> Can (re)sealing a key be viewed as encrypting it? Is the difference between
> sealing a key and encrypting a key the use of hardware support?

Yes, 'resealing/sealing' is TPM terminology for encrypting/decrypting.
The sealing is RSA encryption by a TPM chip, which can only be decrypted
by the same chip.

Mimi



\
 
 \ /
  Last update: 2014-03-14 19:41    [W:0.049 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site