keys, trusted: seal with a TPM2 authorization policy

Browse source

TPM2 supports authorization policies, which are essentially
combinational logic statements repsenting the conditions where the data
can be unsealed based on the TPM state. This patch enables to use
authorization policies to seal trusted keys.

Two following new options have been added for trusted keys:

* 'policydigest=': provide an auth policy digest for sealing.
* 'policyhandle=': provide a policy session handle for unsealing.

If 'hash=' option is supplied after 'policydigest=' option, this
will result an error because the state of the option would become
mixed.

Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: Peter Huewe <peterhuewe@gmx.de>

...

This commit is contained in:

Jarkko Sakkinen 2015-10-31 17:53:44 +02:00

parent 5ca4c20cfd

commit 5beb0c435b

4 changed files with 70 additions and 18 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

34

Documentation/security/keys-trusted-encrypted.txt

View file

24

drivers/char/tpm/tpm2-cmd.c

View file

4

include/keys/trusted-type.h

View file

26

security/keys/trusted.c

View file