2 * QEMU Crypto block device encryption LUKS format
4 * Copyright (c) 2015-2016 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/bswap.h"
25 #include "block-luks.h"
27 #include "crypto/hash.h"
28 #include "crypto/afsplit.h"
29 #include "crypto/pbkdf.h"
30 #include "crypto/secret.h"
31 #include "crypto/random.h"
32 #include "qemu/uuid.h"
34 #include "qemu/coroutine.h"
37 * Reference for the LUKS format implemented here is
39 * docs/on-disk-format.pdf
41 * in 'cryptsetup' package source code
43 * This file implements the 1.2.1 specification, dated
47 typedef struct QCryptoBlockLUKS QCryptoBlockLUKS
;
48 typedef struct QCryptoBlockLUKSHeader QCryptoBlockLUKSHeader
;
49 typedef struct QCryptoBlockLUKSKeySlot QCryptoBlockLUKSKeySlot
;
52 /* The following constants are all defined by the LUKS spec */
53 #define QCRYPTO_BLOCK_LUKS_VERSION 1
55 #define QCRYPTO_BLOCK_LUKS_MAGIC_LEN 6
56 #define QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN 32
57 #define QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN 32
58 #define QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN 32
59 #define QCRYPTO_BLOCK_LUKS_DIGEST_LEN 20
60 #define QCRYPTO_BLOCK_LUKS_SALT_LEN 32
61 #define QCRYPTO_BLOCK_LUKS_UUID_LEN 40
62 #define QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS 8
63 #define QCRYPTO_BLOCK_LUKS_STRIPES 4000
64 #define QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS 1000
65 #define QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS 1000
66 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET 4096
68 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED 0x0000DEAD
69 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED 0x00AC71F3
71 #define QCRYPTO_BLOCK_LUKS_SECTOR_SIZE 512LL
73 static const char qcrypto_block_luks_magic
[QCRYPTO_BLOCK_LUKS_MAGIC_LEN
] = {
74 'L', 'U', 'K', 'S', 0xBA, 0xBE
77 typedef struct QCryptoBlockLUKSNameMap QCryptoBlockLUKSNameMap
;
78 struct QCryptoBlockLUKSNameMap
{
83 typedef struct QCryptoBlockLUKSCipherSizeMap QCryptoBlockLUKSCipherSizeMap
;
84 struct QCryptoBlockLUKSCipherSizeMap
{
88 typedef struct QCryptoBlockLUKSCipherNameMap QCryptoBlockLUKSCipherNameMap
;
89 struct QCryptoBlockLUKSCipherNameMap
{
91 const QCryptoBlockLUKSCipherSizeMap
*sizes
;
95 static const QCryptoBlockLUKSCipherSizeMap
96 qcrypto_block_luks_cipher_size_map_aes
[] = {
97 { 16, QCRYPTO_CIPHER_ALG_AES_128
},
98 { 24, QCRYPTO_CIPHER_ALG_AES_192
},
99 { 32, QCRYPTO_CIPHER_ALG_AES_256
},
103 static const QCryptoBlockLUKSCipherSizeMap
104 qcrypto_block_luks_cipher_size_map_cast5
[] = {
105 { 16, QCRYPTO_CIPHER_ALG_CAST5_128
},
109 static const QCryptoBlockLUKSCipherSizeMap
110 qcrypto_block_luks_cipher_size_map_serpent
[] = {
111 { 16, QCRYPTO_CIPHER_ALG_SERPENT_128
},
112 { 24, QCRYPTO_CIPHER_ALG_SERPENT_192
},
113 { 32, QCRYPTO_CIPHER_ALG_SERPENT_256
},
117 static const QCryptoBlockLUKSCipherSizeMap
118 qcrypto_block_luks_cipher_size_map_twofish
[] = {
119 { 16, QCRYPTO_CIPHER_ALG_TWOFISH_128
},
120 { 24, QCRYPTO_CIPHER_ALG_TWOFISH_192
},
121 { 32, QCRYPTO_CIPHER_ALG_TWOFISH_256
},
125 static const QCryptoBlockLUKSCipherNameMap
126 qcrypto_block_luks_cipher_name_map
[] = {
127 { "aes", qcrypto_block_luks_cipher_size_map_aes
},
128 { "cast5", qcrypto_block_luks_cipher_size_map_cast5
},
129 { "serpent", qcrypto_block_luks_cipher_size_map_serpent
},
130 { "twofish", qcrypto_block_luks_cipher_size_map_twofish
},
135 * This struct is written to disk in big-endian format,
136 * but operated upon in native-endian format.
138 struct QCryptoBlockLUKSKeySlot
{
139 /* state of keyslot, enabled/disable */
141 /* iterations for PBKDF2 */
143 /* salt for PBKDF2 */
144 uint8_t salt
[QCRYPTO_BLOCK_LUKS_SALT_LEN
];
145 /* start sector of key material */
146 uint32_t key_offset_sector
;
147 /* number of anti-forensic stripes */
151 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSKeySlot
) != 48);
155 * This struct is written to disk in big-endian format,
156 * but operated upon in native-endian format.
158 struct QCryptoBlockLUKSHeader
{
159 /* 'L', 'U', 'K', 'S', '0xBA', '0xBE' */
160 char magic
[QCRYPTO_BLOCK_LUKS_MAGIC_LEN
];
162 /* LUKS version, currently 1 */
165 /* cipher name specification (aes, etc) */
166 char cipher_name
[QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN
];
168 /* cipher mode specification (cbc-plain, xts-essiv:sha256, etc) */
169 char cipher_mode
[QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN
];
171 /* hash specification (sha256, etc) */
172 char hash_spec
[QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN
];
174 /* start offset of the volume data (in 512 byte sectors) */
175 uint32_t payload_offset_sector
;
177 /* Number of key bytes */
178 uint32_t master_key_len
;
180 /* master key checksum after PBKDF2 */
181 uint8_t master_key_digest
[QCRYPTO_BLOCK_LUKS_DIGEST_LEN
];
183 /* salt for master key PBKDF2 */
184 uint8_t master_key_salt
[QCRYPTO_BLOCK_LUKS_SALT_LEN
];
186 /* iterations for master key PBKDF2 */
187 uint32_t master_key_iterations
;
189 /* UUID of the partition in standard ASCII representation */
190 uint8_t uuid
[QCRYPTO_BLOCK_LUKS_UUID_LEN
];
193 QCryptoBlockLUKSKeySlot key_slots
[QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
];
196 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSHeader
) != 592);
199 struct QCryptoBlockLUKS
{
200 QCryptoBlockLUKSHeader header
;
202 /* Cache parsed versions of what's in header fields,
203 * as we can't rely on QCryptoBlock.cipher being
205 QCryptoCipherAlgorithm cipher_alg
;
206 QCryptoCipherMode cipher_mode
;
207 QCryptoIVGenAlgorithm ivgen_alg
;
208 QCryptoHashAlgorithm ivgen_hash_alg
;
209 QCryptoHashAlgorithm hash_alg
;
213 static int qcrypto_block_luks_cipher_name_lookup(const char *name
,
214 QCryptoCipherMode mode
,
218 const QCryptoBlockLUKSCipherNameMap
*map
=
219 qcrypto_block_luks_cipher_name_map
;
220 size_t maplen
= G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map
);
223 if (mode
== QCRYPTO_CIPHER_MODE_XTS
) {
227 for (i
= 0; i
< maplen
; i
++) {
228 if (!g_str_equal(map
[i
].name
, name
)) {
231 for (j
= 0; j
< map
[i
].sizes
[j
].key_bytes
; j
++) {
232 if (map
[i
].sizes
[j
].key_bytes
== key_bytes
) {
233 return map
[i
].sizes
[j
].id
;
238 error_setg(errp
, "Algorithm %s with key size %d bytes not supported",
244 qcrypto_block_luks_cipher_alg_lookup(QCryptoCipherAlgorithm alg
,
247 const QCryptoBlockLUKSCipherNameMap
*map
=
248 qcrypto_block_luks_cipher_name_map
;
249 size_t maplen
= G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map
);
251 for (i
= 0; i
< maplen
; i
++) {
252 for (j
= 0; j
< map
[i
].sizes
[j
].key_bytes
; j
++) {
253 if (map
[i
].sizes
[j
].id
== alg
) {
259 error_setg(errp
, "Algorithm '%s' not supported",
260 QCryptoCipherAlgorithm_str(alg
));
264 /* XXX replace with qapi_enum_parse() in future, when we can
265 * make that function emit a more friendly error message */
266 static int qcrypto_block_luks_name_lookup(const char *name
,
267 const QEnumLookup
*map
,
271 int ret
= qapi_enum_parse(map
, name
, -1, NULL
);
274 error_setg(errp
, "%s %s not supported", type
, name
);
280 #define qcrypto_block_luks_cipher_mode_lookup(name, errp) \
281 qcrypto_block_luks_name_lookup(name, \
282 &QCryptoCipherMode_lookup, \
286 #define qcrypto_block_luks_hash_name_lookup(name, errp) \
287 qcrypto_block_luks_name_lookup(name, \
288 &QCryptoHashAlgorithm_lookup, \
292 #define qcrypto_block_luks_ivgen_name_lookup(name, errp) \
293 qcrypto_block_luks_name_lookup(name, \
294 &QCryptoIVGenAlgorithm_lookup, \
300 qcrypto_block_luks_has_format(const uint8_t *buf
,
303 const QCryptoBlockLUKSHeader
*luks_header
= (const void *)buf
;
305 if (buf_size
>= offsetof(QCryptoBlockLUKSHeader
, cipher_name
) &&
306 memcmp(luks_header
->magic
, qcrypto_block_luks_magic
,
307 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
) == 0 &&
308 be16_to_cpu(luks_header
->version
) == QCRYPTO_BLOCK_LUKS_VERSION
) {
317 * Deal with a quirk of dm-crypt usage of ESSIV.
319 * When calculating ESSIV IVs, the cipher length used by ESSIV
320 * may be different from the cipher length used for the block
321 * encryption, becauses dm-crypt uses the hash digest length
322 * as the key size. ie, if you have AES 128 as the block cipher
323 * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as
324 * the cipher since that gets a key length matching the digest
325 * size, not AES 128 with truncated digest as might be imagined
327 static QCryptoCipherAlgorithm
328 qcrypto_block_luks_essiv_cipher(QCryptoCipherAlgorithm cipher
,
329 QCryptoHashAlgorithm hash
,
332 size_t digestlen
= qcrypto_hash_digest_len(hash
);
333 size_t keylen
= qcrypto_cipher_get_key_len(cipher
);
334 if (digestlen
== keylen
) {
339 case QCRYPTO_CIPHER_ALG_AES_128
:
340 case QCRYPTO_CIPHER_ALG_AES_192
:
341 case QCRYPTO_CIPHER_ALG_AES_256
:
342 if (digestlen
== qcrypto_cipher_get_key_len(
343 QCRYPTO_CIPHER_ALG_AES_128
)) {
344 return QCRYPTO_CIPHER_ALG_AES_128
;
345 } else if (digestlen
== qcrypto_cipher_get_key_len(
346 QCRYPTO_CIPHER_ALG_AES_192
)) {
347 return QCRYPTO_CIPHER_ALG_AES_192
;
348 } else if (digestlen
== qcrypto_cipher_get_key_len(
349 QCRYPTO_CIPHER_ALG_AES_256
)) {
350 return QCRYPTO_CIPHER_ALG_AES_256
;
352 error_setg(errp
, "No AES cipher with key size %zu available",
357 case QCRYPTO_CIPHER_ALG_SERPENT_128
:
358 case QCRYPTO_CIPHER_ALG_SERPENT_192
:
359 case QCRYPTO_CIPHER_ALG_SERPENT_256
:
360 if (digestlen
== qcrypto_cipher_get_key_len(
361 QCRYPTO_CIPHER_ALG_SERPENT_128
)) {
362 return QCRYPTO_CIPHER_ALG_SERPENT_128
;
363 } else if (digestlen
== qcrypto_cipher_get_key_len(
364 QCRYPTO_CIPHER_ALG_SERPENT_192
)) {
365 return QCRYPTO_CIPHER_ALG_SERPENT_192
;
366 } else if (digestlen
== qcrypto_cipher_get_key_len(
367 QCRYPTO_CIPHER_ALG_SERPENT_256
)) {
368 return QCRYPTO_CIPHER_ALG_SERPENT_256
;
370 error_setg(errp
, "No Serpent cipher with key size %zu available",
375 case QCRYPTO_CIPHER_ALG_TWOFISH_128
:
376 case QCRYPTO_CIPHER_ALG_TWOFISH_192
:
377 case QCRYPTO_CIPHER_ALG_TWOFISH_256
:
378 if (digestlen
== qcrypto_cipher_get_key_len(
379 QCRYPTO_CIPHER_ALG_TWOFISH_128
)) {
380 return QCRYPTO_CIPHER_ALG_TWOFISH_128
;
381 } else if (digestlen
== qcrypto_cipher_get_key_len(
382 QCRYPTO_CIPHER_ALG_TWOFISH_192
)) {
383 return QCRYPTO_CIPHER_ALG_TWOFISH_192
;
384 } else if (digestlen
== qcrypto_cipher_get_key_len(
385 QCRYPTO_CIPHER_ALG_TWOFISH_256
)) {
386 return QCRYPTO_CIPHER_ALG_TWOFISH_256
;
388 error_setg(errp
, "No Twofish cipher with key size %zu available",
394 error_setg(errp
, "Cipher %s not supported with essiv",
395 QCryptoCipherAlgorithm_str(cipher
));
401 * Given a key slot, and user password, this will attempt to unlock
402 * the master encryption key from the key slot.
405 * 0 if the key slot is disabled, or key could not be decrypted
406 * with the provided password
407 * 1 if the key slot is enabled, and key decrypted successfully
408 * with the provided password
409 * -1 if a fatal error occurred loading the key
412 qcrypto_block_luks_load_key(QCryptoBlock
*block
,
413 QCryptoBlockLUKSKeySlot
*slot
,
414 const char *password
,
415 QCryptoCipherAlgorithm cipheralg
,
416 QCryptoCipherMode ciphermode
,
417 QCryptoHashAlgorithm hash
,
418 QCryptoIVGenAlgorithm ivalg
,
419 QCryptoCipherAlgorithm ivcipheralg
,
420 QCryptoHashAlgorithm ivhash
,
423 QCryptoBlockReadFunc readfunc
,
427 QCryptoBlockLUKS
*luks
= block
->opaque
;
428 g_autofree
uint8_t *splitkey
= NULL
;
430 g_autofree
uint8_t *possiblekey
= NULL
;
432 g_autoptr(QCryptoCipher
) cipher
= NULL
;
433 uint8_t keydigest
[QCRYPTO_BLOCK_LUKS_DIGEST_LEN
];
434 g_autoptr(QCryptoIVGen
) ivgen
= NULL
;
437 if (slot
->active
!= QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
) {
441 splitkeylen
= masterkeylen
* slot
->stripes
;
442 splitkey
= g_new0(uint8_t, splitkeylen
);
443 possiblekey
= g_new0(uint8_t, masterkeylen
);
446 * The user password is used to generate a (possible)
447 * decryption key. This may or may not successfully
448 * decrypt the master key - we just blindly assume
449 * the key is correct and validate the results of
452 if (qcrypto_pbkdf2(hash
,
453 (const uint8_t *)password
, strlen(password
),
454 slot
->salt
, QCRYPTO_BLOCK_LUKS_SALT_LEN
,
456 possiblekey
, masterkeylen
,
462 * We need to read the master key material from the
463 * LUKS key material header. What we're reading is
464 * not the raw master key, but rather the data after
465 * it has been passed through AFSplit and the result
469 slot
->key_offset_sector
* QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
470 splitkey
, splitkeylen
,
478 /* Setup the cipher/ivgen that we'll use to try to decrypt
479 * the split master key material */
480 cipher
= qcrypto_cipher_new(cipheralg
, ciphermode
,
481 possiblekey
, masterkeylen
,
487 niv
= qcrypto_cipher_get_iv_len(cipheralg
,
489 ivgen
= qcrypto_ivgen_new(ivalg
,
492 possiblekey
, masterkeylen
,
500 * The master key needs to be decrypted in the same
501 * way that the block device payload will be decrypted
502 * later. In particular we'll be using the IV generator
503 * to reset the encryption cipher every time the master
504 * key crosses a sector boundary.
506 if (qcrypto_block_cipher_decrypt_helper(cipher
,
509 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
518 * Now we've decrypted the split master key, join
519 * it back together to get the actual master key.
521 if (qcrypto_afsplit_decode(hash
,
532 * We still don't know that the masterkey we got is valid,
533 * because we just blindly assumed the user's password
534 * was correct. This is where we now verify it. We are
535 * creating a hash of the master key using PBKDF and
536 * then comparing that to the hash stored in the key slot
539 if (qcrypto_pbkdf2(hash
,
540 masterkey
, masterkeylen
,
541 luks
->header
.master_key_salt
,
542 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
543 luks
->header
.master_key_iterations
,
544 keydigest
, G_N_ELEMENTS(keydigest
),
549 if (memcmp(keydigest
, luks
->header
.master_key_digest
,
550 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
) == 0) {
551 /* Success, we got the right master key */
555 /* Fail, user's password was not valid for this key slot,
556 * tell caller to try another slot */
562 * Given a user password, this will iterate over all key
563 * slots and try to unlock each active key slot using the
564 * password until it successfully obtains a master key.
566 * Returns 0 if a key was loaded, -1 if no keys could be loaded
569 qcrypto_block_luks_find_key(QCryptoBlock
*block
,
570 const char *password
,
571 QCryptoCipherAlgorithm cipheralg
,
572 QCryptoCipherMode ciphermode
,
573 QCryptoHashAlgorithm hash
,
574 QCryptoIVGenAlgorithm ivalg
,
575 QCryptoCipherAlgorithm ivcipheralg
,
576 QCryptoHashAlgorithm ivhash
,
578 size_t *masterkeylen
,
579 QCryptoBlockReadFunc readfunc
,
583 QCryptoBlockLUKS
*luks
= block
->opaque
;
587 *masterkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
588 *masterkeylen
= luks
->header
.master_key_len
;
590 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
591 rv
= qcrypto_block_luks_load_key(block
,
592 &luks
->header
.key_slots
[i
],
613 error_setg(errp
, "Invalid password, cannot unlock any keyslot");
624 qcrypto_block_luks_open(QCryptoBlock
*block
,
625 QCryptoBlockOpenOptions
*options
,
626 const char *optprefix
,
627 QCryptoBlockReadFunc readfunc
,
633 QCryptoBlockLUKS
*luks
;
634 Error
*local_err
= NULL
;
638 g_autofree
uint8_t *masterkey
= NULL
;
640 char *ivgen_name
, *ivhash_name
;
641 QCryptoCipherMode ciphermode
;
642 QCryptoCipherAlgorithm cipheralg
;
643 QCryptoIVGenAlgorithm ivalg
;
644 QCryptoCipherAlgorithm ivcipheralg
;
645 QCryptoHashAlgorithm hash
;
646 QCryptoHashAlgorithm ivhash
;
647 g_autofree
char *password
= NULL
;
648 g_autofree
char *cipher_mode
= NULL
;
650 if (!(flags
& QCRYPTO_BLOCK_OPEN_NO_IO
)) {
651 if (!options
->u
.luks
.key_secret
) {
652 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
653 optprefix
? optprefix
: "");
656 password
= qcrypto_secret_lookup_as_utf8(
657 options
->u
.luks
.key_secret
, errp
);
663 luks
= g_new0(QCryptoBlockLUKS
, 1);
664 block
->opaque
= luks
;
666 /* Read the entire LUKS header, minus the key material from
667 * the underlying device */
668 rv
= readfunc(block
, 0,
669 (uint8_t *)&luks
->header
,
670 sizeof(luks
->header
),
678 /* The header is always stored in big-endian format, so
679 * convert everything to native */
680 be16_to_cpus(&luks
->header
.version
);
681 be32_to_cpus(&luks
->header
.payload_offset_sector
);
682 be32_to_cpus(&luks
->header
.master_key_len
);
683 be32_to_cpus(&luks
->header
.master_key_iterations
);
685 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
686 be32_to_cpus(&luks
->header
.key_slots
[i
].active
);
687 be32_to_cpus(&luks
->header
.key_slots
[i
].iterations
);
688 be32_to_cpus(&luks
->header
.key_slots
[i
].key_offset_sector
);
689 be32_to_cpus(&luks
->header
.key_slots
[i
].stripes
);
692 if (memcmp(luks
->header
.magic
, qcrypto_block_luks_magic
,
693 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
) != 0) {
694 error_setg(errp
, "Volume is not in LUKS format");
698 if (luks
->header
.version
!= QCRYPTO_BLOCK_LUKS_VERSION
) {
699 error_setg(errp
, "LUKS version %" PRIu32
" is not supported",
700 luks
->header
.version
);
705 cipher_mode
= g_strdup(luks
->header
.cipher_mode
);
708 * The cipher_mode header contains a string that we have
709 * to further parse, of the format
711 * <cipher-mode>-<iv-generator>[:<iv-hash>]
713 * eg cbc-essiv:sha256, cbc-plain64
715 ivgen_name
= strchr(cipher_mode
, '-');
718 error_setg(errp
, "Unexpected cipher mode string format %s",
725 ivhash_name
= strchr(ivgen_name
, ':');
732 ivhash
= qcrypto_block_luks_hash_name_lookup(ivhash_name
,
736 error_propagate(errp
, local_err
);
741 ciphermode
= qcrypto_block_luks_cipher_mode_lookup(cipher_mode
,
745 error_propagate(errp
, local_err
);
750 qcrypto_block_luks_cipher_name_lookup(luks
->header
.cipher_name
,
752 luks
->header
.master_key_len
,
756 error_propagate(errp
, local_err
);
760 hash
= qcrypto_block_luks_hash_name_lookup(luks
->header
.hash_spec
,
764 error_propagate(errp
, local_err
);
768 ivalg
= qcrypto_block_luks_ivgen_name_lookup(ivgen_name
,
772 error_propagate(errp
, local_err
);
776 if (ivalg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
779 error_setg(errp
, "Missing IV generator hash specification");
782 ivcipheralg
= qcrypto_block_luks_essiv_cipher(cipheralg
,
787 error_propagate(errp
, local_err
);
791 /* Note we parsed the ivhash_name earlier in the cipher_mode
792 * spec string even with plain/plain64 ivgens, but we
793 * will ignore it, since it is irrelevant for these ivgens.
794 * This is for compat with dm-crypt which will silently
795 * ignore hash names with these ivgens rather than report
796 * an error about the invalid usage
798 ivcipheralg
= cipheralg
;
801 if (!(flags
& QCRYPTO_BLOCK_OPEN_NO_IO
)) {
802 /* Try to find which key slot our password is valid for
803 * and unlock the master key from that slot.
805 if (qcrypto_block_luks_find_key(block
,
807 cipheralg
, ciphermode
,
812 &masterkey
, &masterkeylen
,
819 /* We have a valid master key now, so can setup the
820 * block device payload decryption objects
822 block
->kdfhash
= hash
;
823 block
->niv
= qcrypto_cipher_get_iv_len(cipheralg
,
825 block
->ivgen
= qcrypto_ivgen_new(ivalg
,
828 masterkey
, masterkeylen
,
835 ret
= qcrypto_block_init_cipher(block
, cipheralg
, ciphermode
,
836 masterkey
, masterkeylen
, n_threads
,
844 block
->sector_size
= QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
845 block
->payload_offset
= luks
->header
.payload_offset_sector
*
848 luks
->cipher_alg
= cipheralg
;
849 luks
->cipher_mode
= ciphermode
;
850 luks
->ivgen_alg
= ivalg
;
851 luks
->ivgen_hash_alg
= ivhash
;
852 luks
->hash_alg
= hash
;
857 qcrypto_block_free_cipher(block
);
858 qcrypto_ivgen_free(block
->ivgen
);
865 qcrypto_block_luks_uuid_gen(uint8_t *uuidstr
)
868 qemu_uuid_generate(&uuid
);
869 qemu_uuid_unparse(&uuid
, (char *)uuidstr
);
873 qcrypto_block_luks_create(QCryptoBlock
*block
,
874 QCryptoBlockCreateOptions
*options
,
875 const char *optprefix
,
876 QCryptoBlockInitFunc initfunc
,
877 QCryptoBlockWriteFunc writefunc
,
881 QCryptoBlockLUKS
*luks
;
882 QCryptoBlockCreateOptionsLUKS luks_opts
;
883 Error
*local_err
= NULL
;
884 g_autofree
uint8_t *masterkey
= NULL
;
885 g_autofree
uint8_t *slotkey
= NULL
;
886 g_autofree
uint8_t *splitkey
= NULL
;
887 size_t splitkeylen
= 0;
889 g_autoptr(QCryptoCipher
) cipher
= NULL
;
890 g_autoptr(QCryptoIVGen
) ivgen
= NULL
;
891 g_autofree
char *password
= NULL
;
892 const char *cipher_alg
;
893 const char *cipher_mode
;
894 const char *ivgen_alg
;
895 const char *ivgen_hash_alg
= NULL
;
896 const char *hash_alg
;
897 g_autofree
char *cipher_mode_spec
= NULL
;
898 QCryptoCipherAlgorithm ivcipheralg
= 0;
901 memcpy(&luks_opts
, &options
->u
.luks
, sizeof(luks_opts
));
902 if (!luks_opts
.has_iter_time
) {
903 luks_opts
.iter_time
= 2000;
905 if (!luks_opts
.has_cipher_alg
) {
906 luks_opts
.cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
;
908 if (!luks_opts
.has_cipher_mode
) {
909 luks_opts
.cipher_mode
= QCRYPTO_CIPHER_MODE_XTS
;
911 if (!luks_opts
.has_ivgen_alg
) {
912 luks_opts
.ivgen_alg
= QCRYPTO_IVGEN_ALG_PLAIN64
;
914 if (!luks_opts
.has_hash_alg
) {
915 luks_opts
.hash_alg
= QCRYPTO_HASH_ALG_SHA256
;
917 if (luks_opts
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
918 if (!luks_opts
.has_ivgen_hash_alg
) {
919 luks_opts
.ivgen_hash_alg
= QCRYPTO_HASH_ALG_SHA256
;
920 luks_opts
.has_ivgen_hash_alg
= true;
923 /* Note we're allowing ivgen_hash_alg to be set even for
924 * non-essiv iv generators that don't need a hash. It will
925 * be silently ignored, for compatibility with dm-crypt */
927 if (!options
->u
.luks
.key_secret
) {
928 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
929 optprefix
? optprefix
: "");
932 password
= qcrypto_secret_lookup_as_utf8(luks_opts
.key_secret
, errp
);
937 luks
= g_new0(QCryptoBlockLUKS
, 1);
938 block
->opaque
= luks
;
940 memcpy(luks
->header
.magic
, qcrypto_block_luks_magic
,
941 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
);
943 /* We populate the header in native endianness initially and
944 * then convert everything to big endian just before writing
947 luks
->header
.version
= QCRYPTO_BLOCK_LUKS_VERSION
;
948 qcrypto_block_luks_uuid_gen(luks
->header
.uuid
);
950 cipher_alg
= qcrypto_block_luks_cipher_alg_lookup(luks_opts
.cipher_alg
,
956 cipher_mode
= QCryptoCipherMode_str(luks_opts
.cipher_mode
);
957 ivgen_alg
= QCryptoIVGenAlgorithm_str(luks_opts
.ivgen_alg
);
958 if (luks_opts
.has_ivgen_hash_alg
) {
959 ivgen_hash_alg
= QCryptoHashAlgorithm_str(luks_opts
.ivgen_hash_alg
);
960 cipher_mode_spec
= g_strdup_printf("%s-%s:%s", cipher_mode
, ivgen_alg
,
963 cipher_mode_spec
= g_strdup_printf("%s-%s", cipher_mode
, ivgen_alg
);
965 hash_alg
= QCryptoHashAlgorithm_str(luks_opts
.hash_alg
);
968 if (strlen(cipher_alg
) >= QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN
) {
969 error_setg(errp
, "Cipher name '%s' is too long for LUKS header",
973 if (strlen(cipher_mode_spec
) >= QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN
) {
974 error_setg(errp
, "Cipher mode '%s' is too long for LUKS header",
978 if (strlen(hash_alg
) >= QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN
) {
979 error_setg(errp
, "Hash name '%s' is too long for LUKS header",
984 if (luks_opts
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
985 ivcipheralg
= qcrypto_block_luks_essiv_cipher(luks_opts
.cipher_alg
,
986 luks_opts
.ivgen_hash_alg
,
989 error_propagate(errp
, local_err
);
993 ivcipheralg
= luks_opts
.cipher_alg
;
996 strcpy(luks
->header
.cipher_name
, cipher_alg
);
997 strcpy(luks
->header
.cipher_mode
, cipher_mode_spec
);
998 strcpy(luks
->header
.hash_spec
, hash_alg
);
1000 luks
->header
.master_key_len
=
1001 qcrypto_cipher_get_key_len(luks_opts
.cipher_alg
);
1003 if (luks_opts
.cipher_mode
== QCRYPTO_CIPHER_MODE_XTS
) {
1004 luks
->header
.master_key_len
*= 2;
1007 /* Generate the salt used for hashing the master key
1010 if (qcrypto_random_bytes(luks
->header
.master_key_salt
,
1011 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1016 /* Generate random master key */
1017 masterkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
1018 if (qcrypto_random_bytes(masterkey
,
1019 luks
->header
.master_key_len
, errp
) < 0) {
1024 /* Setup the block device payload encryption objects */
1025 if (qcrypto_block_init_cipher(block
, luks_opts
.cipher_alg
,
1026 luks_opts
.cipher_mode
, masterkey
,
1027 luks
->header
.master_key_len
, 1, errp
) < 0) {
1031 block
->kdfhash
= luks_opts
.hash_alg
;
1032 block
->niv
= qcrypto_cipher_get_iv_len(luks_opts
.cipher_alg
,
1033 luks_opts
.cipher_mode
);
1034 block
->ivgen
= qcrypto_ivgen_new(luks_opts
.ivgen_alg
,
1036 luks_opts
.ivgen_hash_alg
,
1037 masterkey
, luks
->header
.master_key_len
,
1040 if (!block
->ivgen
) {
1045 /* Determine how many iterations we need to hash the master
1046 * key, in order to have 1 second of compute time used
1048 iters
= qcrypto_pbkdf2_count_iters(luks_opts
.hash_alg
,
1049 masterkey
, luks
->header
.master_key_len
,
1050 luks
->header
.master_key_salt
,
1051 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1052 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
,
1055 error_propagate(errp
, local_err
);
1059 if (iters
> (ULLONG_MAX
/ luks_opts
.iter_time
)) {
1060 error_setg_errno(errp
, ERANGE
,
1061 "PBKDF iterations %llu too large to scale",
1062 (unsigned long long)iters
);
1066 /* iter_time was in millis, but count_iters reported for secs */
1067 iters
= iters
* luks_opts
.iter_time
/ 1000;
1069 /* Why /= 8 ? That matches cryptsetup, but there's no
1070 * explanation why they chose /= 8... Probably so that
1071 * if all 8 keyslots are active we only spend 1 second
1072 * in total time to check all keys */
1074 if (iters
> UINT32_MAX
) {
1075 error_setg_errno(errp
, ERANGE
,
1076 "PBKDF iterations %llu larger than %u",
1077 (unsigned long long)iters
, UINT32_MAX
);
1080 iters
= MAX(iters
, QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS
);
1081 luks
->header
.master_key_iterations
= iters
;
1083 /* Hash the master key, saving the result in the LUKS
1084 * header. This hash is used when opening the encrypted
1085 * device to verify that the user password unlocked a
1088 if (qcrypto_pbkdf2(luks_opts
.hash_alg
,
1089 masterkey
, luks
->header
.master_key_len
,
1090 luks
->header
.master_key_salt
,
1091 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1092 luks
->header
.master_key_iterations
,
1093 luks
->header
.master_key_digest
,
1094 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
,
1100 /* Although LUKS has multiple key slots, we're just going
1101 * to use the first key slot */
1102 splitkeylen
= luks
->header
.master_key_len
* QCRYPTO_BLOCK_LUKS_STRIPES
;
1103 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1104 luks
->header
.key_slots
[i
].active
= i
== 0 ?
1105 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
:
1106 QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED
;
1107 luks
->header
.key_slots
[i
].stripes
= QCRYPTO_BLOCK_LUKS_STRIPES
;
1109 /* This calculation doesn't match that shown in the spec,
1110 * but instead follows the cryptsetup implementation.
1112 luks
->header
.key_slots
[i
].key_offset_sector
=
1113 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1114 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
) +
1115 (ROUND_UP(DIV_ROUND_UP(splitkeylen
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
),
1116 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1117 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
)) * i
);
1120 if (qcrypto_random_bytes(luks
->header
.key_slots
[0].salt
,
1121 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1126 /* Again we determine how many iterations are required to
1127 * hash the user password while consuming 1 second of compute
1129 iters
= qcrypto_pbkdf2_count_iters(luks_opts
.hash_alg
,
1130 (uint8_t *)password
, strlen(password
),
1131 luks
->header
.key_slots
[0].salt
,
1132 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1133 luks
->header
.master_key_len
,
1136 error_propagate(errp
, local_err
);
1140 if (iters
> (ULLONG_MAX
/ luks_opts
.iter_time
)) {
1141 error_setg_errno(errp
, ERANGE
,
1142 "PBKDF iterations %llu too large to scale",
1143 (unsigned long long)iters
);
1147 /* iter_time was in millis, but count_iters reported for secs */
1148 iters
= iters
* luks_opts
.iter_time
/ 1000;
1150 if (iters
> UINT32_MAX
) {
1151 error_setg_errno(errp
, ERANGE
,
1152 "PBKDF iterations %llu larger than %u",
1153 (unsigned long long)iters
, UINT32_MAX
);
1157 luks
->header
.key_slots
[0].iterations
=
1158 MAX(iters
, QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS
);
1161 /* Generate a key that we'll use to encrypt the master
1162 * key, from the user's password
1164 slotkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
1165 if (qcrypto_pbkdf2(luks_opts
.hash_alg
,
1166 (uint8_t *)password
, strlen(password
),
1167 luks
->header
.key_slots
[0].salt
,
1168 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1169 luks
->header
.key_slots
[0].iterations
,
1170 slotkey
, luks
->header
.master_key_len
,
1176 /* Setup the encryption objects needed to encrypt the
1177 * master key material
1179 cipher
= qcrypto_cipher_new(luks_opts
.cipher_alg
,
1180 luks_opts
.cipher_mode
,
1181 slotkey
, luks
->header
.master_key_len
,
1187 ivgen
= qcrypto_ivgen_new(luks_opts
.ivgen_alg
,
1189 luks_opts
.ivgen_hash_alg
,
1190 slotkey
, luks
->header
.master_key_len
,
1196 /* Before storing the master key, we need to vastly
1197 * increase its size, as protection against forensic
1198 * disk data recovery */
1199 splitkey
= g_new0(uint8_t, splitkeylen
);
1201 if (qcrypto_afsplit_encode(luks_opts
.hash_alg
,
1202 luks
->header
.master_key_len
,
1203 luks
->header
.key_slots
[0].stripes
,
1210 /* Now we encrypt the split master key with the key generated
1211 * from the user's password, before storing it */
1212 if (qcrypto_block_cipher_encrypt_helper(cipher
, block
->niv
, ivgen
,
1213 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1222 /* The total size of the LUKS headers is the partition header + key
1223 * slot headers, rounded up to the nearest sector, combined with
1224 * the size of each master key material region, also rounded up
1225 * to the nearest sector */
1226 luks
->header
.payload_offset_sector
=
1227 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1228 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
) +
1229 (ROUND_UP(DIV_ROUND_UP(splitkeylen
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
),
1230 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1231 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
)) *
1232 QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
);
1234 block
->sector_size
= QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
1235 block
->payload_offset
= luks
->header
.payload_offset_sector
*
1238 /* Reserve header space to match payload offset */
1239 initfunc(block
, block
->payload_offset
, opaque
, &local_err
);
1241 error_propagate(errp
, local_err
);
1245 /* Everything on disk uses Big Endian, so flip header fields
1246 * before writing them */
1247 cpu_to_be16s(&luks
->header
.version
);
1248 cpu_to_be32s(&luks
->header
.payload_offset_sector
);
1249 cpu_to_be32s(&luks
->header
.master_key_len
);
1250 cpu_to_be32s(&luks
->header
.master_key_iterations
);
1252 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1253 cpu_to_be32s(&luks
->header
.key_slots
[i
].active
);
1254 cpu_to_be32s(&luks
->header
.key_slots
[i
].iterations
);
1255 cpu_to_be32s(&luks
->header
.key_slots
[i
].key_offset_sector
);
1256 cpu_to_be32s(&luks
->header
.key_slots
[i
].stripes
);
1260 /* Write out the partition header and key slot headers */
1262 (const uint8_t *)&luks
->header
,
1263 sizeof(luks
->header
),
1267 /* Delay checking local_err until we've byte-swapped */
1269 /* Byte swap the header back to native, in case we need
1270 * to read it again later */
1271 be16_to_cpus(&luks
->header
.version
);
1272 be32_to_cpus(&luks
->header
.payload_offset_sector
);
1273 be32_to_cpus(&luks
->header
.master_key_len
);
1274 be32_to_cpus(&luks
->header
.master_key_iterations
);
1276 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1277 be32_to_cpus(&luks
->header
.key_slots
[i
].active
);
1278 be32_to_cpus(&luks
->header
.key_slots
[i
].iterations
);
1279 be32_to_cpus(&luks
->header
.key_slots
[i
].key_offset_sector
);
1280 be32_to_cpus(&luks
->header
.key_slots
[i
].stripes
);
1284 error_propagate(errp
, local_err
);
1288 /* Write out the master key material, starting at the
1289 * sector immediately following the partition header. */
1290 if (writefunc(block
,
1291 luks
->header
.key_slots
[0].key_offset_sector
*
1292 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1293 splitkey
, splitkeylen
,
1295 errp
) != splitkeylen
) {
1299 luks
->cipher_alg
= luks_opts
.cipher_alg
;
1300 luks
->cipher_mode
= luks_opts
.cipher_mode
;
1301 luks
->ivgen_alg
= luks_opts
.ivgen_alg
;
1302 luks
->ivgen_hash_alg
= luks_opts
.ivgen_hash_alg
;
1303 luks
->hash_alg
= luks_opts
.hash_alg
;
1305 memset(masterkey
, 0, luks
->header
.master_key_len
);
1306 memset(slotkey
, 0, luks
->header
.master_key_len
);
1312 memset(masterkey
, 0, luks
->header
.master_key_len
);
1315 memset(slotkey
, 0, luks
->header
.master_key_len
);
1318 qcrypto_block_free_cipher(block
);
1319 qcrypto_ivgen_free(block
->ivgen
);
1326 static int qcrypto_block_luks_get_info(QCryptoBlock
*block
,
1327 QCryptoBlockInfo
*info
,
1330 QCryptoBlockLUKS
*luks
= block
->opaque
;
1331 QCryptoBlockInfoLUKSSlot
*slot
;
1332 QCryptoBlockInfoLUKSSlotList
*slots
= NULL
, **prev
= &info
->u
.luks
.slots
;
1335 info
->u
.luks
.cipher_alg
= luks
->cipher_alg
;
1336 info
->u
.luks
.cipher_mode
= luks
->cipher_mode
;
1337 info
->u
.luks
.ivgen_alg
= luks
->ivgen_alg
;
1338 if (info
->u
.luks
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
1339 info
->u
.luks
.has_ivgen_hash_alg
= true;
1340 info
->u
.luks
.ivgen_hash_alg
= luks
->ivgen_hash_alg
;
1342 info
->u
.luks
.hash_alg
= luks
->hash_alg
;
1343 info
->u
.luks
.payload_offset
= block
->payload_offset
;
1344 info
->u
.luks
.master_key_iters
= luks
->header
.master_key_iterations
;
1345 info
->u
.luks
.uuid
= g_strndup((const char *)luks
->header
.uuid
,
1346 sizeof(luks
->header
.uuid
));
1348 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1349 slots
= g_new0(QCryptoBlockInfoLUKSSlotList
, 1);
1352 slots
->value
= slot
= g_new0(QCryptoBlockInfoLUKSSlot
, 1);
1353 slot
->active
= luks
->header
.key_slots
[i
].active
==
1354 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
;
1355 slot
->key_offset
= luks
->header
.key_slots
[i
].key_offset_sector
1356 * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
1358 slot
->has_iters
= true;
1359 slot
->iters
= luks
->header
.key_slots
[i
].iterations
;
1360 slot
->has_stripes
= true;
1361 slot
->stripes
= luks
->header
.key_slots
[i
].stripes
;
1364 prev
= &slots
->next
;
1371 static void qcrypto_block_luks_cleanup(QCryptoBlock
*block
)
1373 g_free(block
->opaque
);
1378 qcrypto_block_luks_decrypt(QCryptoBlock
*block
,
1384 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1385 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1386 return qcrypto_block_decrypt_helper(block
,
1387 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1388 offset
, buf
, len
, errp
);
1393 qcrypto_block_luks_encrypt(QCryptoBlock
*block
,
1399 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1400 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1401 return qcrypto_block_encrypt_helper(block
,
1402 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1403 offset
, buf
, len
, errp
);
1407 const QCryptoBlockDriver qcrypto_block_driver_luks
= {
1408 .open
= qcrypto_block_luks_open
,
1409 .create
= qcrypto_block_luks_create
,
1410 .get_info
= qcrypto_block_luks_get_info
,
1411 .cleanup
= qcrypto_block_luks_cleanup
,
1412 .decrypt
= qcrypto_block_luks_decrypt
,
1413 .encrypt
= qcrypto_block_luks_encrypt
,
1414 .has_format
= qcrypto_block_luks_has_format
,