[PATCH v1 0/3] KEYS: trusted: Introduce support for NXP CAAM-based trusted keys
richard at nod.at
Thu Apr 1 11:16:54 UTC 2021
----- Ursprüngliche Mail -----
> Von: "Ahmad Fatoum" <a.fatoum at pengutronix.de>
>> But using LUKS would mean that cryptsetup has access to the plain disc
>> encryption key material?
>> This would be a no-go for many systems out there, key material must not
>> accessible to userspace.
>> I know, distrusting userspace root is not easy, but doable. :)
> The LUKS2 format supports tokens. I see no reason why the encrypted blob
> couldn't be stored there along with the usual metadata. cryptsetup would
> then load it as kernel trusted key and use it for dmcrypt decryption.
> This will mean we have to part ways with features such as having multiple
> keys, but I think it's worth it to have a plug and play solution for
> trusted keys.
Ah, now I can follow your thoughts!
Yes, that would be nice to have. :)
I kind of assumed you want to use LUKS with passphrases and CAAM blobs.
More information about the Linux-security-module-archive