[Bug 1990520] [NEW] [Ubuntu 22.04] zkey: Fix re-enciphering of EP11 identity key of KMIP plugin

[Launchpad Bug Tracker]

You have been subscribed to a public bug by Julian Andres Klode (juliank):

SRU Justification:
------------------

[ Impact ]

 * When re-enciphering the identity key
   and/or wrapping key of the zkey KMIP plugin via 'zkey kms reencipher',
   the operation completes without an error,
   but the secure keys are left un-reenciphered.

 * A subsequent connection attempt with the KMIP server will fail
   because the identity key is no longer valid.

 * The re-enciphered secure key is not copied back into the key token
buffer.

 * Also, the the public key part,
   i.e. the MACed SubjectPublicKeyInfo (SPKI) structure
   must also be re-enciphered (i.e. re-MACed),
   since the MAC is calculated with the EP11 master key.

[ Fix ]

 * 4e2ebe03 4e2ebe0370d9fb036b7554d5ac5df4418dbe0397 "libseckey: Fix re-
enciphering of EP11 secure key"

[ Test Plan ]

 * An Ubuntu Server 22.04 for s390x installation with a CryptoExpress
   adapter in EP11 mode and at least one available/online domain is needed.

 * Perform a master key change on the EP11 APQNs used with the KMIP
plugin.

 * The is done indirectly, via libkmipclient, a shared library that
   provides the KMIP client to communicate with an KMIP server.

 * Test will be done by IBM.

[ Where problems could occur ]

 * The memcpy, at the beginning and/or at the end or the inserted code
   could be wrong, and copy wrong contents.

 * The newly introduced 're-encipher MACed SPKI' code can be erroneous,
   which may lead to a non working fix.

 * The calculation and handling of the length which could lead to a
broken cmdblock.

 * Problems could occur in case the re-encryption is done with a different
   master key compared to the initial encryption,
   even though if this should be caught as 'CKR_IBM_WKID_MISMATCH'.

[ Other Info ]
 
 * The s390-tools version v2.23 in kinetic already incl. this fix,
   hence it's not affected,
   nor versions for Ubuntu releases (in service) older than jammy
   are affected.

__________

Description:
zkey: Fix re-enciphering of EP11 identity key of KMIP plugin

Symptom:
When re-enciphering the identity key and/or wrapping key of the zkey KMIP plugin via 'zkey kms reencipher', the operation completes without an error, but the secure keys are left un-reenciphered. A subsequent connection attempt with the KMIP server will fail because the identity key is no longer valid.

Problem:
The re-enciphered secure key is not copied back into the key token buffer. Also, the the public key part, i.e. the MACed SubjectPublicKeyInfo (SPKI) structure must also be re-enciphered (i.e. re-MACed), since the MAC is calculated with the EP11 master key.

Solution:
Copy the re-enciphered secure key back into the key token buffer, and also re-encipher the public key part.

Reproduction:  Perform a master key change on the EP11 APQNs used with the
               KMIP plugin.

Problem-ID:    197605

Upstream-ID:   4e2ebe0370d9fb036b7554d5ac5df4418dbe0397

Preventive:    yes

Date:          2022-04-08
Author:        Ingo Franzki <ifranzki at linux.ibm.com>
Component:     s390-tools

== Comment: #1 - Ingo Franzki <ifranzki at de.ibm.com> - 2022-04-08 09:57:45 ==
Upstream commit:
https://github.com/ibm-s390-linux/s390-tools/commit/4e2ebe0370d9fb036b7554d5ac5df4418dbe0397

** Affects: ubuntu-z-systems
     Importance: High
     Assignee: Skipper Bug Screeners (skipper-screen-team)
         Status: In Progress

** Affects: s390-tools (Ubuntu)
     Importance: Undecided
     Assignee: Skipper Bug Screeners (skipper-screen-team)
         Status: In Progress

** Affects: s390-tools-signed (Ubuntu)
     Importance: Undecided
         Status: In Progress


** Tags: architecture-s39064 bugnameltc-197607 foundations-triage-discuss patch severity-high targetmilestone-inin---
-- 
[Ubuntu 22.04] zkey: Fix re-enciphering of EP11 identity key of KMIP plugin
https://bugs.launchpad.net/bugs/1990520
You received this bug notification because you are a member of Ubuntu Foundations Bugs, which is subscribed to the bug report.