driver-api/nvdimm/security.rst

6 ---------------
16 ------------------
28 update <old_keyid> <new_keyid> - enable or update passphrase.
29 disable <keyid> - disable enabled security and remove key.
30 freeze - freeze changing of security states.
31 erase <keyid> - delete existing user encryption key.
32 overwrite <keyid> - wipe the entire nvdimm.
33 master_update <keyid> <new_keyid> - enable or update master passphrase.
34 master_erase <keyid> - delete existing user encryption key.
36 3. Key Management
37 -----------------
39 The key is associated to the payload by the DIMM id. For example:
41 8089-a2-1740-00000133
42 The DIMM id would be provided along with the key payload (passphrase) to
45 The security keys are managed on the basis of a single key per DIMM. The
46 key "passphrase" is expected to be 32bytes long. This is similar to the ATA
47 security specification [2]. A key is initially acquired via the request_key()
51 A nvdimm encrypted-key of format enc32 has the description format of:
52 nvdimm:<bus-provider-specific-unique-id>
54 See file ``Documentation/security/keys/trusted-encrypted.rst`` for creating
55 encrypted-keys of enc32 format. TPM usage with a master trusted key is
56 preferred for sealing the encrypted-keys.
59 ------------
61 retrieve the key from the kernel user keyring. This is the only time
64 relevant encrypted-keys into the kernel user keyring during the initramfs phase.
70 ---------
71 When doing an update, it is expected that the existing key is removed from
72 the kernel user keyring and reinjected as different (old) key. It's irrelevant
73 what the key description is for the old key since we are only interested in the
74 keyid when doing the update operation. It is also expected that the new key
84 ---------
89 ----------
93 An key with the current passphrase payload that is tied to the nvdimm should be
97 ---------------
101 An key with the current passphrase payload that is tied to the nvdimm should be
105 ------------
109 Overwrite can be done without a key if security is not enabled. A key serial
110 of 0 can be passed in to indicate no key.
115 An encrypted-key with the current user passphrase that is tied to the nvdimm
119 -----------------
124 master passphrase key is passed to the kernel. The master passphrase key
125 is just another encrypted-key.
130 ----------------
135 passphrase key is passed to the kernel. The master passphrase key is just
136 another encrypted-key.
141 [1]: https://pmem.io/documents/NVDIMM_DSM_Interface-V1.8.pdf
143 [2]: http://www.t13.org/documents/UploadedDocuments/docs2006/e05179r4-ACS-SecurityClarifications.pdf