요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
===============
NVDIMM Security
===============
1. Introduction
---------------
With the introduction of Intel Device Specific Methods (DSM) v1.8
specification [1], security DSMs are introduced. The spec added the following
security DSMs: "get security state", "set passphrase", "disable passphrase",
"unlock unit", "freeze lock", "secure erase", and "overwrite". A security_ops
data structure has been added to struct dimm in order to support the security
operations and generic APIs are exposed to allow vendor neutral operations.
2. Sysfs Interface
------------------
The "security" sysfs attribute is provided in the nvdimm sysfs directory. For
example:
/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0012:00/ndbus0/nmem0/security
The "show" attribute of that attribute will display the security state for
that DIMM. The following states are available: disabled, unlocked, locked,
frozen, and overwrite. If security is not supported, the sysfs attribute
will not be visible.
The "store" attribute takes several commands when it is being written to
in order to support some of the security functionalities:
update <old_keyid> <new_keyid> - enable or update passphrase.
disable <keyid> - disable enabled security and remove key.
freeze - freeze changing of security states.
erase <keyid> - delete existing user encryption key.
overwrite <keyid> - wipe the entire nvdimm.
master_update <keyid> <new_keyid> - enable or update master passphrase.
master_erase <keyid> - delete existing user encryption key.
3. Key Management
-----------------
The key is associated to the payload by the DIMM id. For example:
# cat /sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0012:00/ndbus0/nmem0/nfit/id
8089-a2-1740-00000133
The DIMM id would be provided along with the key payload (passphrase) to
the kernel.
The security keys are managed on the basis of a single key per DIMM. The
key "passphrase" is expected to be 32bytes long. This is similar to the ATA
security specification [2]. A key is initially acquired via the request_key()
kernel API call during nvdimm unlock. It is up to the user to make sure that
all the keys are in the kernel user keyring for unlock.
A nvdimm encrypted-key of format enc32 has the description format of:
nvdimm:<bus-provider-specific-unique-id>
See file ``Documentation/security/keys/trusted-encrypted.rst`` for creating
encrypted-keys of enc32 format. TPM usage with a master trusted key is
preferred for sealing the encrypted-keys.
4. Unlocking
------------
When the DIMMs are being enumerated by the kernel, the kernel will attempt to
retrieve the key from the kernel user keyring. This is the only time
a locked DIMM can be unlocked. Once unlocked, the DIMM will remain unlocked
until reboot. Typically an entity (i.e. shell script) will inject all the
relevant encrypted-keys into the kernel user keyring during the initramfs phase.
This provides the unlock function access to all the related keys that contain
the passphrase for the respective nvdimms. It is also recommended that the
keys are injected before libnvdimm is loaded by modprobe.
5. Update
---------
When doing an update, it is expected that the existing key is removed from
the kernel user keyring and reinjected as different (old) key. It's irrelevant
what the key description is for the old key since we are only interested in the
keyid when doing the update operation. It is also expected that the new key
is injected with the description format described from earlier in this
document. The update command written to the sysfs attribute will be with
the format:
update <old keyid> <new keyid>
If there is no old keyid due to a security enabling, then a 0 should be
passed in.
6. Freeze
---------
The freeze operation does not require any keys. The security config can be
frozen by a user with root privilege.
7. Disable
----------
The security disable command format is:
disable <keyid>
An key with the current passphrase payload that is tied to the nvdimm should be
in the kernel user keyring.
8. Secure Erase
---------------
The command format for doing a secure erase is:
erase <keyid>
An key with the current passphrase payload that is tied to the nvdimm should be
in the kernel user keyring.
9. Overwrite
------------
The command format for doing an overwrite is:
overwrite <keyid>
Overwrite can be done without a key if security is not enabled. A key serial
of 0 can be passed in to indicate no key.
The sysfs attribute "security" can be polled to wait on overwrite completion.
Overwrite can last tens of minutes or more depending on nvdimm size.
An encrypted-key with the current user passphrase that is tied to the nvdimm
should be injected and its keyid should be passed in via sysfs.
10. Master Update
-----------------
The command format for doing a master update is:
update <old keyid> <new keyid>
The operating mechanism for master update is identical to update except the
master passphrase key is passed to the kernel. The master passphrase key
is just another encrypted-key.
This command is only available when security is disabled.
11. Master Erase
----------------
The command format for doing a master erase is:
master_erase <current keyid>
This command has the same operating mechanism as erase except the master
passphrase key is passed to the kernel. The master passphrase key is just
another encrypted-key.
This command is only available when the master security is enabled, indicated
by the extended security status.
[1]: https://pmem.io/documents/NVDIMM_DSM_Interface-V1.8.pdf
[2]: http://www.t13.org/documents/UploadedDocuments/docs2006/e05179r4-ACS-SecurityClarifications.pdf
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
Security DSM과 generic API
1-14Intel Device Specific Methods, DSM v1.8 specification은 NVDIMM security DSM을 도입했습니다.
추가된 동작은 `get security state`, `set passphrase`, `disable passphrase`, `unlock unit`, `freeze lock`, `secure erase`, `overwrite`입니다.
이 보안 동작을 지원하기 위해 `struct dimm`에 `security_ops` 자료 구조를 추가했고, vendor와 무관한 방식으로 사용할 수 있도록 generic API를 노출합니다.
Vendor DSM 구현을 generic security operation으로 추상화합니다.
===============
NVDIMM Security
===============
1. Introduction
---------------
With the introduction of Intel Device Specific Methods (DSM) v1.8
specification [1], security DSMs are introduced. The spec added the following
security DSMs: "get security state", "set passphrase", "disable passphrase",
"unlock unit", "freeze lock", "secure erase", and "overwrite". A security_ops
data structure has been added to struct dimm in order to support the security
operations and generic APIs are exposed to allow vendor neutral operations.
security sysfs 상태와 명령
15-35NVDIMM sysfs directory에는 `security` 속성이 제공됩니다. 예제 경로는 `/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0012:00/ndbus0/nmem0/security`입니다.
이 속성을 읽으면 DIMM의 security state가 `disabled`, `unlocked`, `locked`, `frozen`, `overwrite` 중 하나로 표시됩니다. Security를 지원하지 않으면 sysfs 속성 자체가 보이지 않습니다.
속성에 쓸 수 있는 명령은 여러 보안 기능을 제어합니다. `update <old_keyid> <new_keyid>`는 passphrase를 enable하거나 update하고, `disable <keyid>`는 활성화된 security를 끄고 key를 제거합니다.
`freeze`는 security state 변경을 동결합니다. `erase <keyid>`는 기존 user encryption key를 삭제하고, `overwrite <keyid>`는 NVDIMM 전체를 지웁니다.
`master_update <keyid> <new_keyid>`는 master passphrase를 enable하거나 update하고, `master_erase <keyid>`는 문서 표현상 기존 user encryption key를 삭제합니다.
2. Sysfs Interface
------------------
The "security" sysfs attribute is provided in the nvdimm sysfs directory. For
example:
/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0012:00/ndbus0/nmem0/security
The "show" attribute of that attribute will display the security state for
that DIMM. The following states are available: disabled, unlocked, locked,
frozen, and overwrite. If security is not supported, the sysfs attribute
will not be visible.
The "store" attribute takes several commands when it is being written to
in order to support some of the security functionalities:
update <old_keyid> <new_keyid> - enable or update passphrase.
disable <keyid> - disable enabled security and remove key.
freeze - freeze changing of security states.
erase <keyid> - delete existing user encryption key.
overwrite <keyid> - wipe the entire nvdimm.
master_update <keyid> <new_keyid> - enable or update master passphrase.
master_erase <keyid> - delete existing user encryption key.
DIMM별 encrypted-key 관리
36-57Key는 DIMM ID로 payload와 연결됩니다. 예제 DIMM ID는 `8089-a2-1740-00000133`이며, kernel에는 이 ID와 key payload인 passphrase를 함께 제공합니다.
Security key는 DIMM 하나당 key 하나를 기준으로 관리합니다. `passphrase`는 32 bytes 길이여야 하며 ATA security specification과 비슷합니다.
NVDIMM unlock 중 kernel은 `request_key()` API로 처음 key를 얻습니다. Unlock에 필요한 모든 key가 kernel user keyring에 들어 있도록 준비하는 책임은 사용자에게 있습니다.
Format이 `enc32`인 NVDIMM encrypted-key의 description은 `nvdimm:<bus-provider-specific-unique-id>` 형식입니다.
`enc32` encrypted-key 생성 방법은 `Documentation/security/keys/trusted-encrypted.rst`를 참고합니다. Encrypted-key를 sealing할 때는 master trusted key와 TPM을 사용하는 방식을 권장합니다.
3. Key Management
-----------------
The key is associated to the payload by the DIMM id. For example:
# cat /sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0012:00/ndbus0/nmem0/nfit/id
8089-a2-1740-00000133
The DIMM id would be provided along with the key payload (passphrase) to
the kernel.
The security keys are managed on the basis of a single key per DIMM. The
key "passphrase" is expected to be 32bytes long. This is similar to the ATA
security specification [2]. A key is initially acquired via the request_key()
kernel API call during nvdimm unlock. It is up to the user to make sure that
all the keys are in the kernel user keyring for unlock.
A nvdimm encrypted-key of format enc32 has the description format of:
nvdimm:<bus-provider-specific-unique-id>
See file ``Documentation/security/keys/trusted-encrypted.rst`` for creating
encrypted-keys of enc32 format. TPM usage with a master trusted key is
preferred for sealing the encrypted-keys.
부팅 시 unlock과 passphrase update
58-81Kernel은 DIMM을 enumerate할 때 kernel user keyring에서 key를 가져와 unlock을 시도합니다. Locked DIMM을 unlock할 수 있는 시점은 이때뿐이며, 한 번 unlock되면 reboot할 때까지 unlocked 상태를 유지합니다.
보통 shell script 같은 구성 요소가 initramfs 단계에서 관련 encrypted-key를 모두 kernel user keyring에 주입합니다. 그러면 각 NVDIMM의 passphrase를 담은 key에 unlock function이 접근할 수 있습니다. `modprobe`가 libnvdimm을 load하기 전에 key를 주입하는 방식도 권장합니다.
Passphrase를 update할 때는 기존 key를 kernel user keyring에서 제거한 뒤 별도의 old key로 다시 주입해야 합니다. Update에서는 key description보다 key ID만 중요합니다.
새 key는 앞에서 설명한 NVDIMM description 형식으로 주입해야 하며 sysfs에는 `update <old keyid> <new keyid>`를 씁니다. Security를 처음 enable해 old key ID가 없으면 0을 전달합니다.
Enumeration 전에 key를 준비하며, 갱신 시 old/new key ID를 명시합니다.
4. Unlocking
------------
When the DIMMs are being enumerated by the kernel, the kernel will attempt to
retrieve the key from the kernel user keyring. This is the only time
a locked DIMM can be unlocked. Once unlocked, the DIMM will remain unlocked
until reboot. Typically an entity (i.e. shell script) will inject all the
relevant encrypted-keys into the kernel user keyring during the initramfs phase.
This provides the unlock function access to all the related keys that contain
the passphrase for the respective nvdimms. It is also recommended that the
keys are injected before libnvdimm is loaded by modprobe.
5. Update
---------
When doing an update, it is expected that the existing key is removed from
the kernel user keyring and reinjected as different (old) key. It's irrelevant
what the key description is for the old key since we are only interested in the
keyid when doing the update operation. It is also expected that the new key
is injected with the description format described from earlier in this
document. The update command written to the sysfs attribute will be with
the format:
update <old keyid> <new keyid>
If there is no old keyid due to a security enabling, then a 0 should be
passed in.Freeze, disable, erase와 overwrite
82-117`freeze`는 key 없이 실행할 수 있으며 root privilege 사용자가 security configuration의 변경을 동결합니다.
Security를 disable하려면 `disable <keyid>`를 쓰고, 현재 passphrase payload를 담아 해당 NVDIMM에 연결한 key가 kernel user keyring에 있어야 합니다.
Secure erase 명령은 `erase <keyid>`이며 마찬가지로 현재 passphrase payload를 가진 NVDIMM key가 user keyring에 있어야 합니다.
NVDIMM 전체 overwrite 명령은 `overwrite <keyid>`입니다. Security가 enable되지 않았다면 key 없이 overwrite할 수 있고, key가 없음을 나타내려면 key serial 0을 전달합니다.
Sysfs `security` 속성을 poll해 overwrite 완료를 기다릴 수 있습니다. Overwrite는 NVDIMM 크기에 따라 수십 분 이상 걸릴 수 있습니다.
Security가 활성화된 overwrite에는 현재 user passphrase를 담아 NVDIMM에 연결한 encrypted-key를 주입하고 그 key ID를 sysfs로 전달해야 합니다.
6. Freeze
---------
The freeze operation does not require any keys. The security config can be
frozen by a user with root privilege.
7. Disable
----------
The security disable command format is:
disable <keyid>
An key with the current passphrase payload that is tied to the nvdimm should be
in the kernel user keyring.
8. Secure Erase
---------------
The command format for doing a secure erase is:
erase <keyid>
An key with the current passphrase payload that is tied to the nvdimm should be
in the kernel user keyring.
9. Overwrite
------------
The command format for doing an overwrite is:
overwrite <keyid>
Overwrite can be done without a key if security is not enabled. A key serial
of 0 can be passed in to indicate no key.
The sysfs attribute "security" can be polled to wait on overwrite completion.
Overwrite can last tens of minutes or more depending on nvdimm size.
An encrypted-key with the current user passphrase that is tied to the nvdimm
should be injected and its keyid should be passed in via sysfs.
Master passphrase update와 erase
118-143Master update 절에서 제시한 command format은 `update <old keyid> <new keyid>`입니다. 문서 앞의 전체 sysfs 명령 목록에서는 같은 작업을 `master_update <keyid> <new_keyid>`로 표기합니다.
Master update의 동작 방식은 일반 update와 같지만 kernel에 master passphrase key를 전달합니다. Master passphrase key도 다른 key와 같은 encrypted-key입니다.
Master update 명령은 security가 disabled 상태일 때만 사용할 수 있습니다.
Master erase 명령 형식은 `master_erase <current keyid>`입니다. 일반 erase와 같은 방식이지만 kernel에 master passphrase key를 전달하며 이 key 역시 encrypted-key입니다.
Master erase는 extended security status가 master security enabled임을 나타낼 때만 사용할 수 있습니다. 문서는 Intel NVDIMM DSM Interface v1.8과 ATA Security Clarifications를 참조합니다.
10. Master Update
-----------------
The command format for doing a master update is:
update <old keyid> <new keyid>
The operating mechanism for master update is identical to update except the
master passphrase key is passed to the kernel. The master passphrase key
is just another encrypted-key.
This command is only available when security is disabled.
11. Master Erase
----------------
The command format for doing a master erase is:
master_erase <current keyid>
This command has the same operating mechanism as erase except the master
passphrase key is passed to the kernel. The master passphrase key is just
another encrypted-key.
This command is only available when the master security is enabled, indicated
by the extended security status.
[1]: https://pmem.io/documents/NVDIMM_DSM_Interface-V1.8.pdf
[2]: http://www.t13.org/documents/UploadedDocuments/docs2006/e05179r4-ACS-SecurityClarifications.pdf
요약과 해설
security.rst:1-143NVDIMM security는 vendor DSM을 generic `security_ops`와 sysfs 명령으로 노출합니다. DIMM별 32-byte passphrase encrypted-key를 부팅 초기 keyring에 준비해야 하며, freeze·disable·erase·overwrite와 master-key 작업은 상태와 key 조건이 서로 다릅니다.