Re: [PATCH v0 6/8] KEYS: trusted: caam based black key

From: James Bottomley
Date: Thu Oct 06 2022 - 08:55:05 EST

On Thu, 2022-10-06 at 08:42 -0400, Ben Boeckel wrote:
> On Thu, Oct 06, 2022 at 18:38:35 +0530, Pankaj Gupta wrote:
> > - CAAM supports two types of black keys:
> > -- Plain key encrypted with ECB
> > -- Plain key encrypted with CCM
> What is a "black key"? Is this described in the documentation or
> local comments at all? (I know I'm unfamiliar with CAAM, but maybe
> this should be mentioned somewhere?).
> > Note: Due to robustness, default encytption used for black key is
> > CCM.
> ^^^^^^^^^^ encryption
> What "robustness"? Surely there's some more technical details
> involved here?

The crypto advice for the past decade or more has been never use ECB
it's insecure, so anything could be regarded as robust compared to it
... however that does beg the question of why ECB is even offered in a
modern system? Surely it's nothing more than a user trap (choose this
secure option only if you don't want security).