DCP BLOB FORMAT(9)

💅 dcp blob format(9) 💅

okay so bestie, welcome to the Kernel API Manual page for dcp blob format(9) — manual name folded in near the top, we're classy like that. 🎀 Today's main character is the Data Co-Processor (DCP), and it provides hardware-bound AES keys using its AES encryption engine only. It does not provide direct key sealing/unsealing, periodt. 😭

To make DCP hardware encryption keys usable as a trust source, we define our own custom format. That format uses a hardware-bound key to secure the sealing key stored in the key blob. slay, honestly. 🔐

Whenever a new trusted key using DCP is generated, we generate a random 128-bit blob encryption key (BEK) and a 128-bit nonce. The BEK and nonce are used to encrypt the trusted key payload using AES-128-GCM. 💖

The BEK itself is encrypted using the hardware-bound key, via the DCP's AES encryption engine, with AES-128-ECB. The encrypted BEK, the generated nonce, the BEK-encrypted payload, and the authentication tag make up the blob format, together with a version number, payload length, and authentication tag. 🦋 that's the whole blob vibe, no cap. 👑

🌈 SEE ALSO 🌈

• Kernel file ./security/keys/trusted-keys/trusted_dcp.c
• struct dcp_blob_fmt(9)

mwah 💋 that's the page, bestie — source/version: ./security/keys/trusted-keys, date: October 2026, manual page: dcp blob format(9). 🫶✨