Re: [PATCH 0/3] trusted-keys: Add support for protected keys using CAAM

[Horia Geanta <horia.geanta@nxp.com>]

On Mon, 2025-10-06 at 09:17 +0200, meenakshi.aggarwal@nxp.com wrote:
> From: Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com>
> 
> Overview:
> This patch set adds:
> - Support for creating and loading protected keys via `keyctl`
> interface.
> - Documentation updates to describe protected key usage and options.
> - CAAM-specific implementation for protected key encryption
> algorithms.
> 
> User can create protected/encrypted key using keyctl interface:
> 
> KEYNAME=dm_trust_key_hw
> KEY="$(keyctl add trusted $KEYNAME 'new 32 pk key_enc_algo=1' @s)"
> keyctl pipe $KEY >~/$KEYNAME.blob
> keyctl list @s
> 
> dm-crypt can load the protected key buffer from the keyring and use
> it to
> initialize encrypted volumes, ensuring that key material is never
> exposed in plaintext.
> 
> The Protected key buffer is passed to the CAAM driver via the kernel
> crypto API.
> CAAM driver will decapsulate the protected key buffer and perform
> cipher operation.
> 
AFAICS, the algorithms implemented in caam driver are still marked with
CRYPTO_ALG_ALLOCATES_MEMORY.

Thus, I am wondering if currently dm-crypt is really a use case for
"protected keys" having CAAM as backend.

Thanks,
Horia