From 3d16af0b4cfac4b2c3b238e2ec37b38c2f316978 Mon Sep 17 00:00:00 2001 From: David Gstir Date: Wed, 3 Apr 2024 09:21:17 +0200 Subject: crypto: mxs-dcp: Add support for hardware-bound keys DCP (Data Co-Processor) is able to derive private keys for a fused random seed, which can be referenced by handle but not accessed by the CPU. Similarly, DCP is able to store arbitrary keys in four dedicated key slots located in its secure memory area (internal SRAM). These keys can be used to perform AES encryption. Expose these derived keys and key slots through the crypto API via their handle. The main purpose is to add DCP-backed trusted keys. Other use cases are possible too (see similar existing paes implementations), but these should carefully be evaluated as e.g. enabling AF_ALG will give userspace full access to use keys. In scenarios with untrustworthy userspace, this will enable en-/decryption oracles. Co-developed-by: Richard Weinberger Signed-off-by: Richard Weinberger Co-developed-by: David Oberhollenzer Signed-off-by: David Oberhollenzer Signed-off-by: David Gstir Acked-by: Herbert Xu Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen --- include/soc/fsl/dcp.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 include/soc/fsl/dcp.h (limited to 'include/soc/fsl') diff --git a/include/soc/fsl/dcp.h b/include/soc/fsl/dcp.h new file mode 100644 index 000000000000..3ec335d8ca8b --- /dev/null +++ b/include/soc/fsl/dcp.h @@ -0,0 +1,20 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2021 sigma star gmbh + * + * Specifies paes key slot handles for NXP's DCP (Data Co-Processor) to be used + * with the crypto_skcipher_setkey(). + */ + +#ifndef MXS_DCP_H +#define MXS_DCP_H + +#define DCP_PAES_KEYSIZE 1 +#define DCP_PAES_KEY_SLOT0 0x00 +#define DCP_PAES_KEY_SLOT1 0x01 +#define DCP_PAES_KEY_SLOT2 0x02 +#define DCP_PAES_KEY_SLOT3 0x03 +#define DCP_PAES_KEY_UNIQUE 0xfe +#define DCP_PAES_KEY_OTP 0xff + +#endif /* MXS_DCP_H */ -- cgit v1.2.3