| # Copyright 2019 The Fuchsia Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| declare_args() { |
| # This argument specifies from where the system should obtain the zxcrypt |
| # master key to the system data partition. |
| # |
| # This value be reified as /boot/config/zxcrypt in both the zircon boot image |
| # and the zedboot boot image, for consumption by fshost and the paver, |
| # respectively. |
| # |
| # Acceptable values are: |
| # * "null": the device should use an all-0's master key, as we lack support |
| # for any secure on-device storage. |
| # * "tee": the device is required to have a Trusted Execution Environment |
| # (TEE) which includes the "keysafe" Trusted Application (associated with the |
| # KMS service). The zxcrypt master key should be derived from a per-device |
| # key accessible only to trusted apps running in the TEE. |
| # |
| # In the future, we may consider adding support for TPMs, or additional logic |
| # to explicitly support fallback behavior. |
| zxcrypt_key_source = "null" |
| } |
