Hi,

I'm wondering if somebody knows how I can generate a protected key with the DES wrapping key on a Linux host?

For the AES wrapping key, with pkey kernel module, I can get key tokens from /sys/devices/virtual/misc/pkey/protkey attributes; I confirmed, when I disable availability of AES wrapping key those attributes contain no data.

However, no such attribute is available for the DES wrapping key, documented in the Principles of Operation, "Protection of cryptographic keys".

The actual problem is that I want to observe any condition in a KVM guest when dea-wrapping-key=off is passed at start.

Any suggestion appreciated. Thanks.

------------------------------
Sebastian Mitterle
------------------------------

In case somebody stumbles over same thing:

• I could not confirm that any kernel driver or openssl-ibmca were using the wrapping key specific for DES, only AES.
• I confirmed the support can be toggled with a custom kernel module - https://github.com/smitterl/keywrap. 

------------------------------
Sebastian Mitterle
------------------------------

Reinhard Buendgen (Product Owner Security Linux on Z) confirmed to me that protected DES keys on Linux are not supported. (Triple) DES is considered legacy and no new projects should be started for it.

------------------------------
Sebastian Mitterle
------------------------------

Original Message:
Sent: Fri July 24, 2020 03:08 AM
From: Sebastian Mitterle
Subject: Protected key generation with DES wrapping key?

In case somebody stumbles over same thing:

• I could not confirm that any kernel driver or openssl-ibmca were using the wrapping key specific for DES, only AES.
• I confirmed the support can be toggled with a custom kernel module - https://github.com/smitterl/keywrap. 

------------------------------
Sebastian Mitterle
------------------------------