2 * QEMU Crypto block device encryption LUKS format
4 * Copyright (c) 2015-2016 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/bswap.h"
25 #include "block-luks.h"
27 #include "crypto/hash.h"
28 #include "crypto/afsplit.h"
29 #include "crypto/pbkdf.h"
30 #include "crypto/secret.h"
31 #include "crypto/random.h"
32 #include "qemu/uuid.h"
34 #include "qemu/coroutine.h"
37 * Reference for the LUKS format implemented here is
39 * docs/on-disk-format.pdf
41 * in 'cryptsetup' package source code
43 * This file implements the 1.2.1 specification, dated
47 typedef struct QCryptoBlockLUKS QCryptoBlockLUKS
;
48 typedef struct QCryptoBlockLUKSHeader QCryptoBlockLUKSHeader
;
49 typedef struct QCryptoBlockLUKSKeySlot QCryptoBlockLUKSKeySlot
;
52 /* The following constants are all defined by the LUKS spec */
53 #define QCRYPTO_BLOCK_LUKS_VERSION 1
55 #define QCRYPTO_BLOCK_LUKS_MAGIC_LEN 6
56 #define QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN 32
57 #define QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN 32
58 #define QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN 32
59 #define QCRYPTO_BLOCK_LUKS_DIGEST_LEN 20
60 #define QCRYPTO_BLOCK_LUKS_SALT_LEN 32
61 #define QCRYPTO_BLOCK_LUKS_UUID_LEN 40
62 #define QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS 8
63 #define QCRYPTO_BLOCK_LUKS_STRIPES 4000
64 #define QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS 1000
65 #define QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS 1000
66 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET 4096
68 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED 0x0000DEAD
69 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED 0x00AC71F3
71 #define QCRYPTO_BLOCK_LUKS_SECTOR_SIZE 512LL
73 static const char qcrypto_block_luks_magic
[QCRYPTO_BLOCK_LUKS_MAGIC_LEN
] = {
74 'L', 'U', 'K', 'S', 0xBA, 0xBE
77 typedef struct QCryptoBlockLUKSNameMap QCryptoBlockLUKSNameMap
;
78 struct QCryptoBlockLUKSNameMap
{
83 typedef struct QCryptoBlockLUKSCipherSizeMap QCryptoBlockLUKSCipherSizeMap
;
84 struct QCryptoBlockLUKSCipherSizeMap
{
88 typedef struct QCryptoBlockLUKSCipherNameMap QCryptoBlockLUKSCipherNameMap
;
89 struct QCryptoBlockLUKSCipherNameMap
{
91 const QCryptoBlockLUKSCipherSizeMap
*sizes
;
95 static const QCryptoBlockLUKSCipherSizeMap
96 qcrypto_block_luks_cipher_size_map_aes
[] = {
97 { 16, QCRYPTO_CIPHER_ALG_AES_128
},
98 { 24, QCRYPTO_CIPHER_ALG_AES_192
},
99 { 32, QCRYPTO_CIPHER_ALG_AES_256
},
103 static const QCryptoBlockLUKSCipherSizeMap
104 qcrypto_block_luks_cipher_size_map_cast5
[] = {
105 { 16, QCRYPTO_CIPHER_ALG_CAST5_128
},
109 static const QCryptoBlockLUKSCipherSizeMap
110 qcrypto_block_luks_cipher_size_map_serpent
[] = {
111 { 16, QCRYPTO_CIPHER_ALG_SERPENT_128
},
112 { 24, QCRYPTO_CIPHER_ALG_SERPENT_192
},
113 { 32, QCRYPTO_CIPHER_ALG_SERPENT_256
},
117 static const QCryptoBlockLUKSCipherSizeMap
118 qcrypto_block_luks_cipher_size_map_twofish
[] = {
119 { 16, QCRYPTO_CIPHER_ALG_TWOFISH_128
},
120 { 24, QCRYPTO_CIPHER_ALG_TWOFISH_192
},
121 { 32, QCRYPTO_CIPHER_ALG_TWOFISH_256
},
125 static const QCryptoBlockLUKSCipherNameMap
126 qcrypto_block_luks_cipher_name_map
[] = {
127 { "aes", qcrypto_block_luks_cipher_size_map_aes
},
128 { "cast5", qcrypto_block_luks_cipher_size_map_cast5
},
129 { "serpent", qcrypto_block_luks_cipher_size_map_serpent
},
130 { "twofish", qcrypto_block_luks_cipher_size_map_twofish
},
135 * This struct is written to disk in big-endian format,
136 * but operated upon in native-endian format.
138 struct QCryptoBlockLUKSKeySlot
{
139 /* state of keyslot, enabled/disable */
141 /* iterations for PBKDF2 */
143 /* salt for PBKDF2 */
144 uint8_t salt
[QCRYPTO_BLOCK_LUKS_SALT_LEN
];
145 /* start sector of key material */
146 uint32_t key_offset_sector
;
147 /* number of anti-forensic stripes */
151 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSKeySlot
) != 48);
155 * This struct is written to disk in big-endian format,
156 * but operated upon in native-endian format.
158 struct QCryptoBlockLUKSHeader
{
159 /* 'L', 'U', 'K', 'S', '0xBA', '0xBE' */
160 char magic
[QCRYPTO_BLOCK_LUKS_MAGIC_LEN
];
162 /* LUKS version, currently 1 */
165 /* cipher name specification (aes, etc) */
166 char cipher_name
[QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN
];
168 /* cipher mode specification (cbc-plain, xts-essiv:sha256, etc) */
169 char cipher_mode
[QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN
];
171 /* hash specification (sha256, etc) */
172 char hash_spec
[QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN
];
174 /* start offset of the volume data (in 512 byte sectors) */
175 uint32_t payload_offset_sector
;
177 /* Number of key bytes */
178 uint32_t master_key_len
;
180 /* master key checksum after PBKDF2 */
181 uint8_t master_key_digest
[QCRYPTO_BLOCK_LUKS_DIGEST_LEN
];
183 /* salt for master key PBKDF2 */
184 uint8_t master_key_salt
[QCRYPTO_BLOCK_LUKS_SALT_LEN
];
186 /* iterations for master key PBKDF2 */
187 uint32_t master_key_iterations
;
189 /* UUID of the partition in standard ASCII representation */
190 uint8_t uuid
[QCRYPTO_BLOCK_LUKS_UUID_LEN
];
193 QCryptoBlockLUKSKeySlot key_slots
[QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
];
196 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSHeader
) != 592);
199 struct QCryptoBlockLUKS
{
200 QCryptoBlockLUKSHeader header
;
202 /* Main encryption algorithm used for encryption*/
203 QCryptoCipherAlgorithm cipher_alg
;
205 /* Mode of encryption for the selected encryption algorithm */
206 QCryptoCipherMode cipher_mode
;
208 /* Initialization vector generation algorithm */
209 QCryptoIVGenAlgorithm ivgen_alg
;
211 /* Hash algorithm used for IV generation*/
212 QCryptoHashAlgorithm ivgen_hash_alg
;
215 * Encryption algorithm used for IV generation.
216 * Usually the same as main encryption algorithm
218 QCryptoCipherAlgorithm ivgen_cipher_alg
;
220 /* Hash algorithm used in pbkdf2 function */
221 QCryptoHashAlgorithm hash_alg
;
225 static int qcrypto_block_luks_cipher_name_lookup(const char *name
,
226 QCryptoCipherMode mode
,
230 const QCryptoBlockLUKSCipherNameMap
*map
=
231 qcrypto_block_luks_cipher_name_map
;
232 size_t maplen
= G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map
);
235 if (mode
== QCRYPTO_CIPHER_MODE_XTS
) {
239 for (i
= 0; i
< maplen
; i
++) {
240 if (!g_str_equal(map
[i
].name
, name
)) {
243 for (j
= 0; j
< map
[i
].sizes
[j
].key_bytes
; j
++) {
244 if (map
[i
].sizes
[j
].key_bytes
== key_bytes
) {
245 return map
[i
].sizes
[j
].id
;
250 error_setg(errp
, "Algorithm %s with key size %d bytes not supported",
256 qcrypto_block_luks_cipher_alg_lookup(QCryptoCipherAlgorithm alg
,
259 const QCryptoBlockLUKSCipherNameMap
*map
=
260 qcrypto_block_luks_cipher_name_map
;
261 size_t maplen
= G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map
);
263 for (i
= 0; i
< maplen
; i
++) {
264 for (j
= 0; j
< map
[i
].sizes
[j
].key_bytes
; j
++) {
265 if (map
[i
].sizes
[j
].id
== alg
) {
271 error_setg(errp
, "Algorithm '%s' not supported",
272 QCryptoCipherAlgorithm_str(alg
));
276 /* XXX replace with qapi_enum_parse() in future, when we can
277 * make that function emit a more friendly error message */
278 static int qcrypto_block_luks_name_lookup(const char *name
,
279 const QEnumLookup
*map
,
283 int ret
= qapi_enum_parse(map
, name
, -1, NULL
);
286 error_setg(errp
, "%s %s not supported", type
, name
);
292 #define qcrypto_block_luks_cipher_mode_lookup(name, errp) \
293 qcrypto_block_luks_name_lookup(name, \
294 &QCryptoCipherMode_lookup, \
298 #define qcrypto_block_luks_hash_name_lookup(name, errp) \
299 qcrypto_block_luks_name_lookup(name, \
300 &QCryptoHashAlgorithm_lookup, \
304 #define qcrypto_block_luks_ivgen_name_lookup(name, errp) \
305 qcrypto_block_luks_name_lookup(name, \
306 &QCryptoIVGenAlgorithm_lookup, \
312 qcrypto_block_luks_has_format(const uint8_t *buf
,
315 const QCryptoBlockLUKSHeader
*luks_header
= (const void *)buf
;
317 if (buf_size
>= offsetof(QCryptoBlockLUKSHeader
, cipher_name
) &&
318 memcmp(luks_header
->magic
, qcrypto_block_luks_magic
,
319 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
) == 0 &&
320 be16_to_cpu(luks_header
->version
) == QCRYPTO_BLOCK_LUKS_VERSION
) {
329 * Deal with a quirk of dm-crypt usage of ESSIV.
331 * When calculating ESSIV IVs, the cipher length used by ESSIV
332 * may be different from the cipher length used for the block
333 * encryption, becauses dm-crypt uses the hash digest length
334 * as the key size. ie, if you have AES 128 as the block cipher
335 * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as
336 * the cipher since that gets a key length matching the digest
337 * size, not AES 128 with truncated digest as might be imagined
339 static QCryptoCipherAlgorithm
340 qcrypto_block_luks_essiv_cipher(QCryptoCipherAlgorithm cipher
,
341 QCryptoHashAlgorithm hash
,
344 size_t digestlen
= qcrypto_hash_digest_len(hash
);
345 size_t keylen
= qcrypto_cipher_get_key_len(cipher
);
346 if (digestlen
== keylen
) {
351 case QCRYPTO_CIPHER_ALG_AES_128
:
352 case QCRYPTO_CIPHER_ALG_AES_192
:
353 case QCRYPTO_CIPHER_ALG_AES_256
:
354 if (digestlen
== qcrypto_cipher_get_key_len(
355 QCRYPTO_CIPHER_ALG_AES_128
)) {
356 return QCRYPTO_CIPHER_ALG_AES_128
;
357 } else if (digestlen
== qcrypto_cipher_get_key_len(
358 QCRYPTO_CIPHER_ALG_AES_192
)) {
359 return QCRYPTO_CIPHER_ALG_AES_192
;
360 } else if (digestlen
== qcrypto_cipher_get_key_len(
361 QCRYPTO_CIPHER_ALG_AES_256
)) {
362 return QCRYPTO_CIPHER_ALG_AES_256
;
364 error_setg(errp
, "No AES cipher with key size %zu available",
369 case QCRYPTO_CIPHER_ALG_SERPENT_128
:
370 case QCRYPTO_CIPHER_ALG_SERPENT_192
:
371 case QCRYPTO_CIPHER_ALG_SERPENT_256
:
372 if (digestlen
== qcrypto_cipher_get_key_len(
373 QCRYPTO_CIPHER_ALG_SERPENT_128
)) {
374 return QCRYPTO_CIPHER_ALG_SERPENT_128
;
375 } else if (digestlen
== qcrypto_cipher_get_key_len(
376 QCRYPTO_CIPHER_ALG_SERPENT_192
)) {
377 return QCRYPTO_CIPHER_ALG_SERPENT_192
;
378 } else if (digestlen
== qcrypto_cipher_get_key_len(
379 QCRYPTO_CIPHER_ALG_SERPENT_256
)) {
380 return QCRYPTO_CIPHER_ALG_SERPENT_256
;
382 error_setg(errp
, "No Serpent cipher with key size %zu available",
387 case QCRYPTO_CIPHER_ALG_TWOFISH_128
:
388 case QCRYPTO_CIPHER_ALG_TWOFISH_192
:
389 case QCRYPTO_CIPHER_ALG_TWOFISH_256
:
390 if (digestlen
== qcrypto_cipher_get_key_len(
391 QCRYPTO_CIPHER_ALG_TWOFISH_128
)) {
392 return QCRYPTO_CIPHER_ALG_TWOFISH_128
;
393 } else if (digestlen
== qcrypto_cipher_get_key_len(
394 QCRYPTO_CIPHER_ALG_TWOFISH_192
)) {
395 return QCRYPTO_CIPHER_ALG_TWOFISH_192
;
396 } else if (digestlen
== qcrypto_cipher_get_key_len(
397 QCRYPTO_CIPHER_ALG_TWOFISH_256
)) {
398 return QCRYPTO_CIPHER_ALG_TWOFISH_256
;
400 error_setg(errp
, "No Twofish cipher with key size %zu available",
406 error_setg(errp
, "Cipher %s not supported with essiv",
407 QCryptoCipherAlgorithm_str(cipher
));
413 * Given a key slot, and user password, this will attempt to unlock
414 * the master encryption key from the key slot.
417 * 0 if the key slot is disabled, or key could not be decrypted
418 * with the provided password
419 * 1 if the key slot is enabled, and key decrypted successfully
420 * with the provided password
421 * -1 if a fatal error occurred loading the key
424 qcrypto_block_luks_load_key(QCryptoBlock
*block
,
426 const char *password
,
428 QCryptoBlockReadFunc readfunc
,
432 QCryptoBlockLUKS
*luks
= block
->opaque
;
433 const QCryptoBlockLUKSKeySlot
*slot
= &luks
->header
.key_slots
[slot_idx
];
434 g_autofree
uint8_t *splitkey
= NULL
;
436 g_autofree
uint8_t *possiblekey
= NULL
;
438 g_autoptr(QCryptoCipher
) cipher
= NULL
;
439 uint8_t keydigest
[QCRYPTO_BLOCK_LUKS_DIGEST_LEN
];
440 g_autoptr(QCryptoIVGen
) ivgen
= NULL
;
443 if (slot
->active
!= QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
) {
447 splitkeylen
= luks
->header
.master_key_len
* slot
->stripes
;
448 splitkey
= g_new0(uint8_t, splitkeylen
);
449 possiblekey
= g_new0(uint8_t, luks
->header
.master_key_len
);
452 * The user password is used to generate a (possible)
453 * decryption key. This may or may not successfully
454 * decrypt the master key - we just blindly assume
455 * the key is correct and validate the results of
458 if (qcrypto_pbkdf2(luks
->hash_alg
,
459 (const uint8_t *)password
, strlen(password
),
460 slot
->salt
, QCRYPTO_BLOCK_LUKS_SALT_LEN
,
462 possiblekey
, luks
->header
.master_key_len
,
468 * We need to read the master key material from the
469 * LUKS key material header. What we're reading is
470 * not the raw master key, but rather the data after
471 * it has been passed through AFSplit and the result
475 slot
->key_offset_sector
* QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
476 splitkey
, splitkeylen
,
484 /* Setup the cipher/ivgen that we'll use to try to decrypt
485 * the split master key material */
486 cipher
= qcrypto_cipher_new(luks
->cipher_alg
,
489 luks
->header
.master_key_len
,
495 niv
= qcrypto_cipher_get_iv_len(luks
->cipher_alg
,
498 ivgen
= qcrypto_ivgen_new(luks
->ivgen_alg
,
499 luks
->ivgen_cipher_alg
,
500 luks
->ivgen_hash_alg
,
502 luks
->header
.master_key_len
,
510 * The master key needs to be decrypted in the same
511 * way that the block device payload will be decrypted
512 * later. In particular we'll be using the IV generator
513 * to reset the encryption cipher every time the master
514 * key crosses a sector boundary.
516 if (qcrypto_block_cipher_decrypt_helper(cipher
,
519 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
528 * Now we've decrypted the split master key, join
529 * it back together to get the actual master key.
531 if (qcrypto_afsplit_decode(luks
->hash_alg
,
532 luks
->header
.master_key_len
,
542 * We still don't know that the masterkey we got is valid,
543 * because we just blindly assumed the user's password
544 * was correct. This is where we now verify it. We are
545 * creating a hash of the master key using PBKDF and
546 * then comparing that to the hash stored in the key slot
549 if (qcrypto_pbkdf2(luks
->hash_alg
,
551 luks
->header
.master_key_len
,
552 luks
->header
.master_key_salt
,
553 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
554 luks
->header
.master_key_iterations
,
556 G_N_ELEMENTS(keydigest
),
561 if (memcmp(keydigest
, luks
->header
.master_key_digest
,
562 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
) == 0) {
563 /* Success, we got the right master key */
567 /* Fail, user's password was not valid for this key slot,
568 * tell caller to try another slot */
574 * Given a user password, this will iterate over all key
575 * slots and try to unlock each active key slot using the
576 * password until it successfully obtains a master key.
578 * Returns 0 if a key was loaded, -1 if no keys could be loaded
581 qcrypto_block_luks_find_key(QCryptoBlock
*block
,
582 const char *password
,
584 QCryptoBlockReadFunc readfunc
,
591 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
592 rv
= qcrypto_block_luks_load_key(block
,
607 error_setg(errp
, "Invalid password, cannot unlock any keyslot");
614 qcrypto_block_luks_open(QCryptoBlock
*block
,
615 QCryptoBlockOpenOptions
*options
,
616 const char *optprefix
,
617 QCryptoBlockReadFunc readfunc
,
623 QCryptoBlockLUKS
*luks
= NULL
;
624 Error
*local_err
= NULL
;
626 g_autofree
uint8_t *masterkey
= NULL
;
627 char *ivgen_name
, *ivhash_name
;
628 g_autofree
char *password
= NULL
;
629 g_autofree
char *cipher_mode
= NULL
;
631 if (!(flags
& QCRYPTO_BLOCK_OPEN_NO_IO
)) {
632 if (!options
->u
.luks
.key_secret
) {
633 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
634 optprefix
? optprefix
: "");
637 password
= qcrypto_secret_lookup_as_utf8(
638 options
->u
.luks
.key_secret
, errp
);
644 luks
= g_new0(QCryptoBlockLUKS
, 1);
645 block
->opaque
= luks
;
647 /* Read the entire LUKS header, minus the key material from
648 * the underlying device */
649 if (readfunc(block
, 0,
650 (uint8_t *)&luks
->header
,
651 sizeof(luks
->header
),
657 /* The header is always stored in big-endian format, so
658 * convert everything to native */
659 be16_to_cpus(&luks
->header
.version
);
660 be32_to_cpus(&luks
->header
.payload_offset_sector
);
661 be32_to_cpus(&luks
->header
.master_key_len
);
662 be32_to_cpus(&luks
->header
.master_key_iterations
);
664 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
665 be32_to_cpus(&luks
->header
.key_slots
[i
].active
);
666 be32_to_cpus(&luks
->header
.key_slots
[i
].iterations
);
667 be32_to_cpus(&luks
->header
.key_slots
[i
].key_offset_sector
);
668 be32_to_cpus(&luks
->header
.key_slots
[i
].stripes
);
671 if (memcmp(luks
->header
.magic
, qcrypto_block_luks_magic
,
672 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
) != 0) {
673 error_setg(errp
, "Volume is not in LUKS format");
676 if (luks
->header
.version
!= QCRYPTO_BLOCK_LUKS_VERSION
) {
677 error_setg(errp
, "LUKS version %" PRIu32
" is not supported",
678 luks
->header
.version
);
682 cipher_mode
= g_strdup(luks
->header
.cipher_mode
);
685 * The cipher_mode header contains a string that we have
686 * to further parse, of the format
688 * <cipher-mode>-<iv-generator>[:<iv-hash>]
690 * eg cbc-essiv:sha256, cbc-plain64
692 ivgen_name
= strchr(cipher_mode
, '-');
694 error_setg(errp
, "Unexpected cipher mode string format %s",
701 ivhash_name
= strchr(ivgen_name
, ':');
703 luks
->ivgen_hash_alg
= 0;
708 luks
->ivgen_hash_alg
= qcrypto_block_luks_hash_name_lookup(ivhash_name
,
711 error_propagate(errp
, local_err
);
716 luks
->cipher_mode
= qcrypto_block_luks_cipher_mode_lookup(cipher_mode
,
719 error_propagate(errp
, local_err
);
724 qcrypto_block_luks_cipher_name_lookup(luks
->header
.cipher_name
,
726 luks
->header
.master_key_len
,
729 error_propagate(errp
, local_err
);
734 qcrypto_block_luks_hash_name_lookup(luks
->header
.hash_spec
,
737 error_propagate(errp
, local_err
);
741 luks
->ivgen_alg
= qcrypto_block_luks_ivgen_name_lookup(ivgen_name
,
744 error_propagate(errp
, local_err
);
748 if (luks
->ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
750 error_setg(errp
, "Missing IV generator hash specification");
753 luks
->ivgen_cipher_alg
=
754 qcrypto_block_luks_essiv_cipher(luks
->cipher_alg
,
755 luks
->ivgen_hash_alg
,
758 error_propagate(errp
, local_err
);
762 /* Note we parsed the ivhash_name earlier in the cipher_mode
763 * spec string even with plain/plain64 ivgens, but we
764 * will ignore it, since it is irrelevant for these ivgens.
765 * This is for compat with dm-crypt which will silently
766 * ignore hash names with these ivgens rather than report
767 * an error about the invalid usage
769 luks
->ivgen_cipher_alg
= luks
->cipher_alg
;
772 if (!(flags
& QCRYPTO_BLOCK_OPEN_NO_IO
)) {
773 /* Try to find which key slot our password is valid for
774 * and unlock the master key from that slot.
777 masterkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
779 if (qcrypto_block_luks_find_key(block
,
787 /* We have a valid master key now, so can setup the
788 * block device payload decryption objects
790 block
->kdfhash
= luks
->hash_alg
;
791 block
->niv
= qcrypto_cipher_get_iv_len(luks
->cipher_alg
,
794 block
->ivgen
= qcrypto_ivgen_new(luks
->ivgen_alg
,
795 luks
->ivgen_cipher_alg
,
796 luks
->ivgen_hash_alg
,
798 luks
->header
.master_key_len
,
804 if (qcrypto_block_init_cipher(block
,
808 luks
->header
.master_key_len
,
815 block
->sector_size
= QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
816 block
->payload_offset
= luks
->header
.payload_offset_sector
*
822 qcrypto_block_free_cipher(block
);
823 qcrypto_ivgen_free(block
->ivgen
);
830 qcrypto_block_luks_uuid_gen(uint8_t *uuidstr
)
833 qemu_uuid_generate(&uuid
);
834 qemu_uuid_unparse(&uuid
, (char *)uuidstr
);
838 qcrypto_block_luks_create(QCryptoBlock
*block
,
839 QCryptoBlockCreateOptions
*options
,
840 const char *optprefix
,
841 QCryptoBlockInitFunc initfunc
,
842 QCryptoBlockWriteFunc writefunc
,
846 QCryptoBlockLUKS
*luks
;
847 QCryptoBlockCreateOptionsLUKS luks_opts
;
848 Error
*local_err
= NULL
;
849 g_autofree
uint8_t *masterkey
= NULL
;
850 g_autofree
uint8_t *slotkey
= NULL
;
851 g_autofree
uint8_t *splitkey
= NULL
;
852 size_t splitkeylen
= 0;
854 g_autoptr(QCryptoCipher
) cipher
= NULL
;
855 g_autoptr(QCryptoIVGen
) ivgen
= NULL
;
856 g_autofree
char *password
= NULL
;
857 const char *cipher_alg
;
858 const char *cipher_mode
;
859 const char *ivgen_alg
;
860 const char *ivgen_hash_alg
= NULL
;
861 const char *hash_alg
;
862 g_autofree
char *cipher_mode_spec
= NULL
;
865 memcpy(&luks_opts
, &options
->u
.luks
, sizeof(luks_opts
));
866 if (!luks_opts
.has_iter_time
) {
867 luks_opts
.iter_time
= 2000;
869 if (!luks_opts
.has_cipher_alg
) {
870 luks_opts
.cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
;
872 if (!luks_opts
.has_cipher_mode
) {
873 luks_opts
.cipher_mode
= QCRYPTO_CIPHER_MODE_XTS
;
875 if (!luks_opts
.has_ivgen_alg
) {
876 luks_opts
.ivgen_alg
= QCRYPTO_IVGEN_ALG_PLAIN64
;
878 if (!luks_opts
.has_hash_alg
) {
879 luks_opts
.hash_alg
= QCRYPTO_HASH_ALG_SHA256
;
881 if (luks_opts
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
882 if (!luks_opts
.has_ivgen_hash_alg
) {
883 luks_opts
.ivgen_hash_alg
= QCRYPTO_HASH_ALG_SHA256
;
884 luks_opts
.has_ivgen_hash_alg
= true;
888 luks
= g_new0(QCryptoBlockLUKS
, 1);
889 block
->opaque
= luks
;
891 luks
->cipher_alg
= luks_opts
.cipher_alg
;
892 luks
->cipher_mode
= luks_opts
.cipher_mode
;
893 luks
->ivgen_alg
= luks_opts
.ivgen_alg
;
894 luks
->ivgen_hash_alg
= luks_opts
.ivgen_hash_alg
;
895 luks
->hash_alg
= luks_opts
.hash_alg
;
898 /* Note we're allowing ivgen_hash_alg to be set even for
899 * non-essiv iv generators that don't need a hash. It will
900 * be silently ignored, for compatibility with dm-crypt */
902 if (!options
->u
.luks
.key_secret
) {
903 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
904 optprefix
? optprefix
: "");
907 password
= qcrypto_secret_lookup_as_utf8(luks_opts
.key_secret
, errp
);
913 memcpy(luks
->header
.magic
, qcrypto_block_luks_magic
,
914 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
);
916 /* We populate the header in native endianness initially and
917 * then convert everything to big endian just before writing
920 luks
->header
.version
= QCRYPTO_BLOCK_LUKS_VERSION
;
921 qcrypto_block_luks_uuid_gen(luks
->header
.uuid
);
923 cipher_alg
= qcrypto_block_luks_cipher_alg_lookup(luks_opts
.cipher_alg
,
929 cipher_mode
= QCryptoCipherMode_str(luks_opts
.cipher_mode
);
930 ivgen_alg
= QCryptoIVGenAlgorithm_str(luks_opts
.ivgen_alg
);
931 if (luks_opts
.has_ivgen_hash_alg
) {
932 ivgen_hash_alg
= QCryptoHashAlgorithm_str(luks_opts
.ivgen_hash_alg
);
933 cipher_mode_spec
= g_strdup_printf("%s-%s:%s", cipher_mode
, ivgen_alg
,
936 cipher_mode_spec
= g_strdup_printf("%s-%s", cipher_mode
, ivgen_alg
);
938 hash_alg
= QCryptoHashAlgorithm_str(luks_opts
.hash_alg
);
941 if (strlen(cipher_alg
) >= QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN
) {
942 error_setg(errp
, "Cipher name '%s' is too long for LUKS header",
946 if (strlen(cipher_mode_spec
) >= QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN
) {
947 error_setg(errp
, "Cipher mode '%s' is too long for LUKS header",
951 if (strlen(hash_alg
) >= QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN
) {
952 error_setg(errp
, "Hash name '%s' is too long for LUKS header",
957 if (luks_opts
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
958 luks
->ivgen_cipher_alg
=
959 qcrypto_block_luks_essiv_cipher(luks_opts
.cipher_alg
,
960 luks_opts
.ivgen_hash_alg
,
963 error_propagate(errp
, local_err
);
967 luks
->ivgen_cipher_alg
= luks_opts
.cipher_alg
;
970 strcpy(luks
->header
.cipher_name
, cipher_alg
);
971 strcpy(luks
->header
.cipher_mode
, cipher_mode_spec
);
972 strcpy(luks
->header
.hash_spec
, hash_alg
);
974 luks
->header
.master_key_len
=
975 qcrypto_cipher_get_key_len(luks_opts
.cipher_alg
);
977 if (luks_opts
.cipher_mode
== QCRYPTO_CIPHER_MODE_XTS
) {
978 luks
->header
.master_key_len
*= 2;
981 /* Generate the salt used for hashing the master key
984 if (qcrypto_random_bytes(luks
->header
.master_key_salt
,
985 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
990 /* Generate random master key */
991 masterkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
992 if (qcrypto_random_bytes(masterkey
,
993 luks
->header
.master_key_len
, errp
) < 0) {
998 /* Setup the block device payload encryption objects */
999 if (qcrypto_block_init_cipher(block
, luks_opts
.cipher_alg
,
1000 luks_opts
.cipher_mode
, masterkey
,
1001 luks
->header
.master_key_len
, 1, errp
) < 0) {
1005 block
->kdfhash
= luks_opts
.hash_alg
;
1006 block
->niv
= qcrypto_cipher_get_iv_len(luks_opts
.cipher_alg
,
1007 luks_opts
.cipher_mode
);
1008 block
->ivgen
= qcrypto_ivgen_new(luks_opts
.ivgen_alg
,
1009 luks
->ivgen_cipher_alg
,
1010 luks_opts
.ivgen_hash_alg
,
1011 masterkey
, luks
->header
.master_key_len
,
1014 if (!block
->ivgen
) {
1019 /* Determine how many iterations we need to hash the master
1020 * key, in order to have 1 second of compute time used
1022 iters
= qcrypto_pbkdf2_count_iters(luks_opts
.hash_alg
,
1023 masterkey
, luks
->header
.master_key_len
,
1024 luks
->header
.master_key_salt
,
1025 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1026 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
,
1029 error_propagate(errp
, local_err
);
1033 if (iters
> (ULLONG_MAX
/ luks_opts
.iter_time
)) {
1034 error_setg_errno(errp
, ERANGE
,
1035 "PBKDF iterations %llu too large to scale",
1036 (unsigned long long)iters
);
1040 /* iter_time was in millis, but count_iters reported for secs */
1041 iters
= iters
* luks_opts
.iter_time
/ 1000;
1043 /* Why /= 8 ? That matches cryptsetup, but there's no
1044 * explanation why they chose /= 8... Probably so that
1045 * if all 8 keyslots are active we only spend 1 second
1046 * in total time to check all keys */
1048 if (iters
> UINT32_MAX
) {
1049 error_setg_errno(errp
, ERANGE
,
1050 "PBKDF iterations %llu larger than %u",
1051 (unsigned long long)iters
, UINT32_MAX
);
1054 iters
= MAX(iters
, QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS
);
1055 luks
->header
.master_key_iterations
= iters
;
1057 /* Hash the master key, saving the result in the LUKS
1058 * header. This hash is used when opening the encrypted
1059 * device to verify that the user password unlocked a
1062 if (qcrypto_pbkdf2(luks_opts
.hash_alg
,
1063 masterkey
, luks
->header
.master_key_len
,
1064 luks
->header
.master_key_salt
,
1065 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1066 luks
->header
.master_key_iterations
,
1067 luks
->header
.master_key_digest
,
1068 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
,
1074 /* Although LUKS has multiple key slots, we're just going
1075 * to use the first key slot */
1076 splitkeylen
= luks
->header
.master_key_len
* QCRYPTO_BLOCK_LUKS_STRIPES
;
1077 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1078 luks
->header
.key_slots
[i
].active
= i
== 0 ?
1079 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
:
1080 QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED
;
1081 luks
->header
.key_slots
[i
].stripes
= QCRYPTO_BLOCK_LUKS_STRIPES
;
1083 /* This calculation doesn't match that shown in the spec,
1084 * but instead follows the cryptsetup implementation.
1086 luks
->header
.key_slots
[i
].key_offset_sector
=
1087 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1088 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
) +
1089 (ROUND_UP(DIV_ROUND_UP(splitkeylen
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
),
1090 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1091 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
)) * i
);
1094 if (qcrypto_random_bytes(luks
->header
.key_slots
[0].salt
,
1095 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1100 /* Again we determine how many iterations are required to
1101 * hash the user password while consuming 1 second of compute
1103 iters
= qcrypto_pbkdf2_count_iters(luks_opts
.hash_alg
,
1104 (uint8_t *)password
, strlen(password
),
1105 luks
->header
.key_slots
[0].salt
,
1106 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1107 luks
->header
.master_key_len
,
1110 error_propagate(errp
, local_err
);
1114 if (iters
> (ULLONG_MAX
/ luks_opts
.iter_time
)) {
1115 error_setg_errno(errp
, ERANGE
,
1116 "PBKDF iterations %llu too large to scale",
1117 (unsigned long long)iters
);
1121 /* iter_time was in millis, but count_iters reported for secs */
1122 iters
= iters
* luks_opts
.iter_time
/ 1000;
1124 if (iters
> UINT32_MAX
) {
1125 error_setg_errno(errp
, ERANGE
,
1126 "PBKDF iterations %llu larger than %u",
1127 (unsigned long long)iters
, UINT32_MAX
);
1131 luks
->header
.key_slots
[0].iterations
=
1132 MAX(iters
, QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS
);
1135 /* Generate a key that we'll use to encrypt the master
1136 * key, from the user's password
1138 slotkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
1139 if (qcrypto_pbkdf2(luks_opts
.hash_alg
,
1140 (uint8_t *)password
, strlen(password
),
1141 luks
->header
.key_slots
[0].salt
,
1142 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1143 luks
->header
.key_slots
[0].iterations
,
1144 slotkey
, luks
->header
.master_key_len
,
1150 /* Setup the encryption objects needed to encrypt the
1151 * master key material
1153 cipher
= qcrypto_cipher_new(luks_opts
.cipher_alg
,
1154 luks_opts
.cipher_mode
,
1155 slotkey
, luks
->header
.master_key_len
,
1161 ivgen
= qcrypto_ivgen_new(luks_opts
.ivgen_alg
,
1162 luks
->ivgen_cipher_alg
,
1163 luks_opts
.ivgen_hash_alg
,
1164 slotkey
, luks
->header
.master_key_len
,
1170 /* Before storing the master key, we need to vastly
1171 * increase its size, as protection against forensic
1172 * disk data recovery */
1173 splitkey
= g_new0(uint8_t, splitkeylen
);
1175 if (qcrypto_afsplit_encode(luks_opts
.hash_alg
,
1176 luks
->header
.master_key_len
,
1177 luks
->header
.key_slots
[0].stripes
,
1184 /* Now we encrypt the split master key with the key generated
1185 * from the user's password, before storing it */
1186 if (qcrypto_block_cipher_encrypt_helper(cipher
, block
->niv
, ivgen
,
1187 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1196 /* The total size of the LUKS headers is the partition header + key
1197 * slot headers, rounded up to the nearest sector, combined with
1198 * the size of each master key material region, also rounded up
1199 * to the nearest sector */
1200 luks
->header
.payload_offset_sector
=
1201 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1202 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
) +
1203 (ROUND_UP(DIV_ROUND_UP(splitkeylen
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
),
1204 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1205 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
)) *
1206 QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
);
1208 block
->sector_size
= QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
1209 block
->payload_offset
= luks
->header
.payload_offset_sector
*
1212 /* Reserve header space to match payload offset */
1213 initfunc(block
, block
->payload_offset
, opaque
, &local_err
);
1215 error_propagate(errp
, local_err
);
1219 /* Everything on disk uses Big Endian, so flip header fields
1220 * before writing them */
1221 cpu_to_be16s(&luks
->header
.version
);
1222 cpu_to_be32s(&luks
->header
.payload_offset_sector
);
1223 cpu_to_be32s(&luks
->header
.master_key_len
);
1224 cpu_to_be32s(&luks
->header
.master_key_iterations
);
1226 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1227 cpu_to_be32s(&luks
->header
.key_slots
[i
].active
);
1228 cpu_to_be32s(&luks
->header
.key_slots
[i
].iterations
);
1229 cpu_to_be32s(&luks
->header
.key_slots
[i
].key_offset_sector
);
1230 cpu_to_be32s(&luks
->header
.key_slots
[i
].stripes
);
1234 /* Write out the partition header and key slot headers */
1236 (const uint8_t *)&luks
->header
,
1237 sizeof(luks
->header
),
1241 /* Delay checking local_err until we've byte-swapped */
1243 /* Byte swap the header back to native, in case we need
1244 * to read it again later */
1245 be16_to_cpus(&luks
->header
.version
);
1246 be32_to_cpus(&luks
->header
.payload_offset_sector
);
1247 be32_to_cpus(&luks
->header
.master_key_len
);
1248 be32_to_cpus(&luks
->header
.master_key_iterations
);
1250 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1251 be32_to_cpus(&luks
->header
.key_slots
[i
].active
);
1252 be32_to_cpus(&luks
->header
.key_slots
[i
].iterations
);
1253 be32_to_cpus(&luks
->header
.key_slots
[i
].key_offset_sector
);
1254 be32_to_cpus(&luks
->header
.key_slots
[i
].stripes
);
1258 error_propagate(errp
, local_err
);
1262 /* Write out the master key material, starting at the
1263 * sector immediately following the partition header. */
1264 if (writefunc(block
,
1265 luks
->header
.key_slots
[0].key_offset_sector
*
1266 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1267 splitkey
, splitkeylen
,
1269 errp
) != splitkeylen
) {
1273 memset(masterkey
, 0, luks
->header
.master_key_len
);
1274 memset(slotkey
, 0, luks
->header
.master_key_len
);
1280 memset(masterkey
, 0, luks
->header
.master_key_len
);
1283 memset(slotkey
, 0, luks
->header
.master_key_len
);
1286 qcrypto_block_free_cipher(block
);
1287 qcrypto_ivgen_free(block
->ivgen
);
1294 static int qcrypto_block_luks_get_info(QCryptoBlock
*block
,
1295 QCryptoBlockInfo
*info
,
1298 QCryptoBlockLUKS
*luks
= block
->opaque
;
1299 QCryptoBlockInfoLUKSSlot
*slot
;
1300 QCryptoBlockInfoLUKSSlotList
*slots
= NULL
, **prev
= &info
->u
.luks
.slots
;
1303 info
->u
.luks
.cipher_alg
= luks
->cipher_alg
;
1304 info
->u
.luks
.cipher_mode
= luks
->cipher_mode
;
1305 info
->u
.luks
.ivgen_alg
= luks
->ivgen_alg
;
1306 if (info
->u
.luks
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
1307 info
->u
.luks
.has_ivgen_hash_alg
= true;
1308 info
->u
.luks
.ivgen_hash_alg
= luks
->ivgen_hash_alg
;
1310 info
->u
.luks
.hash_alg
= luks
->hash_alg
;
1311 info
->u
.luks
.payload_offset
= block
->payload_offset
;
1312 info
->u
.luks
.master_key_iters
= luks
->header
.master_key_iterations
;
1313 info
->u
.luks
.uuid
= g_strndup((const char *)luks
->header
.uuid
,
1314 sizeof(luks
->header
.uuid
));
1316 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1317 slots
= g_new0(QCryptoBlockInfoLUKSSlotList
, 1);
1320 slots
->value
= slot
= g_new0(QCryptoBlockInfoLUKSSlot
, 1);
1321 slot
->active
= luks
->header
.key_slots
[i
].active
==
1322 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
;
1323 slot
->key_offset
= luks
->header
.key_slots
[i
].key_offset_sector
1324 * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
1326 slot
->has_iters
= true;
1327 slot
->iters
= luks
->header
.key_slots
[i
].iterations
;
1328 slot
->has_stripes
= true;
1329 slot
->stripes
= luks
->header
.key_slots
[i
].stripes
;
1332 prev
= &slots
->next
;
1339 static void qcrypto_block_luks_cleanup(QCryptoBlock
*block
)
1341 g_free(block
->opaque
);
1346 qcrypto_block_luks_decrypt(QCryptoBlock
*block
,
1352 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1353 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1354 return qcrypto_block_decrypt_helper(block
,
1355 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1356 offset
, buf
, len
, errp
);
1361 qcrypto_block_luks_encrypt(QCryptoBlock
*block
,
1367 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1368 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1369 return qcrypto_block_encrypt_helper(block
,
1370 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1371 offset
, buf
, len
, errp
);
1375 const QCryptoBlockDriver qcrypto_block_driver_luks
= {
1376 .open
= qcrypto_block_luks_open
,
1377 .create
= qcrypto_block_luks_create
,
1378 .get_info
= qcrypto_block_luks_get_info
,
1379 .cleanup
= qcrypto_block_luks_cleanup
,
1380 .decrypt
= qcrypto_block_luks_decrypt
,
1381 .encrypt
= qcrypto_block_luks_encrypt
,
1382 .has_format
= qcrypto_block_luks_has_format
,