Linux Security Summit North America 2023

Apart from the traditional cryptographic key attributes i.e. key length & key buffer, there are additional key attributes that can be provided by the user, for dictating the proper usage of the keys. The cryptographic keys must not be used if the associated conditions are not met. In the case of Linux, the “keyctl” command provides an interface to supply these attributes. . Since currently there is no connection between Kernel’s Crypto-API and keyring, the information regarding the proper key usage is unavailable to the crypto API. As a result, the proper usage of the key can't be enforced, thus potentially compromising the system state. After coupling the Crypto-API with keyring, the driver will get the additional key attributes, which can be validated by the Crypto-API driver. Once validated, only the permitted crypto operation will be performed. In this presentation we present a mechanism for linking crypto api with the keyring, such that the additional key attributes can be made available to the api. We will be covering this method in great detail during the presentation.