Power Virtualization

Power Virtualization

Learn about the virtualization technologies designed specifically for IBM Power including #PowerVM, #PowerVC, #VM Recovery Manager#HCM/CMC, and more.


#Power
#TechXchangeConferenceLab

 View Only

PowerVM extends the Platform KeyStore with key wrapping services

By Daniel Frink posted Wed September 24, 2025 02:13 PM

  

Introduction

IBM Platform KeyStore (PKS) is a PowerVM feature that allows logical partitions to protect sensitive information with encrypted, non-volatile storage owned by the hypervisor. The current PKS model provides this protection by allowing consumers (i.e., the OS kernel) to read and write “objects” containing sensitive information directly into the key store. One limitation this comes with is the total storage space available - each partition has a maximum of 128KB of PKS storage available in Power11. While this is enough space to satisfy the requirements for various tasks done by the OS (such as storing keys for encrypted boot disks or public keys for secure boot), it may not be enough to allow the kernel to provide support for user-space applications to make use of keys stored in PKS. Each application may want to generate one or many large secrets, such as ML-KEM (Module-Lattice-Based Key Encapsulation Mechanism) or ML-DSA (Module-Lattice-Based Digital Signature Algorithm) private keys, which are each individually thousands of bytes in size, as shown in the table below.



Algorithm

Private Key Size (bytes)

ML-KEM-512

1,632

ML-KEM-768

2,400

ML-KEM-1024

3,168

ML-DSA-44

2,560

ML-DSA-65

4,032

ML-DSA-87

4,896



Using Key Wrapping to Enable User-Space Applications of PKS

To solve this problem, Power11 introduces a new feature to Platform KeyStore called “Key Wrapping”. With this new feature, partitions can now store hypervisor-protected secrets in their own partition-managed storage locations. These secrets are protected via an AES-GCM-256 symmetric key that is randomly generated by the hypervisor and stored as an object in PKS. This symmetric key object (referred to as a “wrapping key”) has additional policy-based protections that prevent it from ever being exposed directly to the partition. This secure wrapping key object can then be used by the OS to wrap and unwrap partition secrets via two new hypervisor calls. The metadata stored with a wrapped secret contains integrity data computed with AES-GMAC that gets validated during object unwrapping to ensure that the contents of the wrapped secret are not altered by the partition. The individual wrapped secrets also have policy options to enable enforcement of different OS secure boot or PKS states at the time the secret is unwrapped. There is no limit on the number of unique wrapping keys that can be generated by consumers (beyond the total size configured for PKS), and wrapping keys can be generated and removed by the consumer at will. With this new feature, operating systems on Power11 are now equipped to provide hypervisor-backed encryption solutions for customer applications.

Below are two diagrams that illustrate the benefit of using the PKS Wrapping Key mechanism to securely store multiple ML-DSA-87 private keys. Figure 1 shows the PKS storage footprint using direct PKS writes, while Figure 2 shows the PKS and partition managed storage footprints using PKS wrapping operations. Using direct PKS writes, 5 ML-DSA-87 private keys consume almost 20% of the maximum configurable Platform KeyStore storage size. Using PKS wrapping operations, the PKS storage footprint is significantly reduced, and the partition storage footprint equates to a fraction of a penny in enterprise hard drive costs.

Figure 1

Platform KeyStore Memory Footprint with Direct PKS Writes
Figure 2
PKS and Partition Memory Footprint using PKS Key Wrapping

Summary

PKS key wrapping enables operating systems to store hypervisor-wrapped secrets in partition-managed storage. This new mechanism significantly decreases the amount of Platform KeyStore space required to protect larger amounts of data, allowing client operating systems to bring hypervisor-backed security to a wider array of applications.

Contacting the PowerVM Team

Have questions for the PowerVM team or want to learn more?  Follow our discussion group on LinkedIn IBM PowerVM or IBM Community Discussions.

#PowerVM

0 comments
28 views

Permalink