2 * QEMU Crypto block device encryption LUKS format
4 * Copyright (c) 2015-2016 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/bswap.h"
25 #include "block-luks.h"
27 #include "crypto/hash.h"
28 #include "crypto/afsplit.h"
29 #include "crypto/pbkdf.h"
30 #include "crypto/secret.h"
31 #include "crypto/random.h"
32 #include "qemu/uuid.h"
34 #include "qemu/coroutine.h"
37 * Reference for the LUKS format implemented here is
39 * docs/on-disk-format.pdf
41 * in 'cryptsetup' package source code
43 * This file implements the 1.2.1 specification, dated
47 typedef struct QCryptoBlockLUKS QCryptoBlockLUKS
;
48 typedef struct QCryptoBlockLUKSHeader QCryptoBlockLUKSHeader
;
49 typedef struct QCryptoBlockLUKSKeySlot QCryptoBlockLUKSKeySlot
;
52 /* The following constants are all defined by the LUKS spec */
53 #define QCRYPTO_BLOCK_LUKS_VERSION 1
55 #define QCRYPTO_BLOCK_LUKS_MAGIC_LEN 6
56 #define QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN 32
57 #define QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN 32
58 #define QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN 32
59 #define QCRYPTO_BLOCK_LUKS_DIGEST_LEN 20
60 #define QCRYPTO_BLOCK_LUKS_SALT_LEN 32
61 #define QCRYPTO_BLOCK_LUKS_UUID_LEN 40
62 #define QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS 8
63 #define QCRYPTO_BLOCK_LUKS_STRIPES 4000
64 #define QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS 1000
65 #define QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS 1000
66 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET 4096
68 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED 0x0000DEAD
69 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED 0x00AC71F3
71 #define QCRYPTO_BLOCK_LUKS_SECTOR_SIZE 512LL
73 static const char qcrypto_block_luks_magic
[QCRYPTO_BLOCK_LUKS_MAGIC_LEN
] = {
74 'L', 'U', 'K', 'S', 0xBA, 0xBE
77 typedef struct QCryptoBlockLUKSNameMap QCryptoBlockLUKSNameMap
;
78 struct QCryptoBlockLUKSNameMap
{
83 typedef struct QCryptoBlockLUKSCipherSizeMap QCryptoBlockLUKSCipherSizeMap
;
84 struct QCryptoBlockLUKSCipherSizeMap
{
88 typedef struct QCryptoBlockLUKSCipherNameMap QCryptoBlockLUKSCipherNameMap
;
89 struct QCryptoBlockLUKSCipherNameMap
{
91 const QCryptoBlockLUKSCipherSizeMap
*sizes
;
95 static const QCryptoBlockLUKSCipherSizeMap
96 qcrypto_block_luks_cipher_size_map_aes
[] = {
97 { 16, QCRYPTO_CIPHER_ALG_AES_128
},
98 { 24, QCRYPTO_CIPHER_ALG_AES_192
},
99 { 32, QCRYPTO_CIPHER_ALG_AES_256
},
103 static const QCryptoBlockLUKSCipherSizeMap
104 qcrypto_block_luks_cipher_size_map_cast5
[] = {
105 { 16, QCRYPTO_CIPHER_ALG_CAST5_128
},
109 static const QCryptoBlockLUKSCipherSizeMap
110 qcrypto_block_luks_cipher_size_map_serpent
[] = {
111 { 16, QCRYPTO_CIPHER_ALG_SERPENT_128
},
112 { 24, QCRYPTO_CIPHER_ALG_SERPENT_192
},
113 { 32, QCRYPTO_CIPHER_ALG_SERPENT_256
},
117 static const QCryptoBlockLUKSCipherSizeMap
118 qcrypto_block_luks_cipher_size_map_twofish
[] = {
119 { 16, QCRYPTO_CIPHER_ALG_TWOFISH_128
},
120 { 24, QCRYPTO_CIPHER_ALG_TWOFISH_192
},
121 { 32, QCRYPTO_CIPHER_ALG_TWOFISH_256
},
125 static const QCryptoBlockLUKSCipherNameMap
126 qcrypto_block_luks_cipher_name_map
[] = {
127 { "aes", qcrypto_block_luks_cipher_size_map_aes
},
128 { "cast5", qcrypto_block_luks_cipher_size_map_cast5
},
129 { "serpent", qcrypto_block_luks_cipher_size_map_serpent
},
130 { "twofish", qcrypto_block_luks_cipher_size_map_twofish
},
135 * This struct is written to disk in big-endian format,
136 * but operated upon in native-endian format.
138 struct QCryptoBlockLUKSKeySlot
{
139 /* state of keyslot, enabled/disable */
141 /* iterations for PBKDF2 */
143 /* salt for PBKDF2 */
144 uint8_t salt
[QCRYPTO_BLOCK_LUKS_SALT_LEN
];
145 /* start sector of key material */
146 uint32_t key_offset_sector
;
147 /* number of anti-forensic stripes */
151 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSKeySlot
) != 48);
155 * This struct is written to disk in big-endian format,
156 * but operated upon in native-endian format.
158 struct QCryptoBlockLUKSHeader
{
159 /* 'L', 'U', 'K', 'S', '0xBA', '0xBE' */
160 char magic
[QCRYPTO_BLOCK_LUKS_MAGIC_LEN
];
162 /* LUKS version, currently 1 */
165 /* cipher name specification (aes, etc) */
166 char cipher_name
[QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN
];
168 /* cipher mode specification (cbc-plain, xts-essiv:sha256, etc) */
169 char cipher_mode
[QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN
];
171 /* hash specification (sha256, etc) */
172 char hash_spec
[QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN
];
174 /* start offset of the volume data (in 512 byte sectors) */
175 uint32_t payload_offset_sector
;
177 /* Number of key bytes */
178 uint32_t master_key_len
;
180 /* master key checksum after PBKDF2 */
181 uint8_t master_key_digest
[QCRYPTO_BLOCK_LUKS_DIGEST_LEN
];
183 /* salt for master key PBKDF2 */
184 uint8_t master_key_salt
[QCRYPTO_BLOCK_LUKS_SALT_LEN
];
186 /* iterations for master key PBKDF2 */
187 uint32_t master_key_iterations
;
189 /* UUID of the partition in standard ASCII representation */
190 uint8_t uuid
[QCRYPTO_BLOCK_LUKS_UUID_LEN
];
193 QCryptoBlockLUKSKeySlot key_slots
[QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
];
196 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSHeader
) != 592);
199 struct QCryptoBlockLUKS
{
200 QCryptoBlockLUKSHeader header
;
202 /* Main encryption algorithm used for encryption*/
203 QCryptoCipherAlgorithm cipher_alg
;
205 /* Mode of encryption for the selected encryption algorithm */
206 QCryptoCipherMode cipher_mode
;
208 /* Initialization vector generation algorithm */
209 QCryptoIVGenAlgorithm ivgen_alg
;
211 /* Hash algorithm used for IV generation*/
212 QCryptoHashAlgorithm ivgen_hash_alg
;
215 * Encryption algorithm used for IV generation.
216 * Usually the same as main encryption algorithm
218 QCryptoCipherAlgorithm ivgen_cipher_alg
;
220 /* Hash algorithm used in pbkdf2 function */
221 QCryptoHashAlgorithm hash_alg
;
225 static int qcrypto_block_luks_cipher_name_lookup(const char *name
,
226 QCryptoCipherMode mode
,
230 const QCryptoBlockLUKSCipherNameMap
*map
=
231 qcrypto_block_luks_cipher_name_map
;
232 size_t maplen
= G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map
);
235 if (mode
== QCRYPTO_CIPHER_MODE_XTS
) {
239 for (i
= 0; i
< maplen
; i
++) {
240 if (!g_str_equal(map
[i
].name
, name
)) {
243 for (j
= 0; j
< map
[i
].sizes
[j
].key_bytes
; j
++) {
244 if (map
[i
].sizes
[j
].key_bytes
== key_bytes
) {
245 return map
[i
].sizes
[j
].id
;
250 error_setg(errp
, "Algorithm %s with key size %d bytes not supported",
256 qcrypto_block_luks_cipher_alg_lookup(QCryptoCipherAlgorithm alg
,
259 const QCryptoBlockLUKSCipherNameMap
*map
=
260 qcrypto_block_luks_cipher_name_map
;
261 size_t maplen
= G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map
);
263 for (i
= 0; i
< maplen
; i
++) {
264 for (j
= 0; j
< map
[i
].sizes
[j
].key_bytes
; j
++) {
265 if (map
[i
].sizes
[j
].id
== alg
) {
271 error_setg(errp
, "Algorithm '%s' not supported",
272 QCryptoCipherAlgorithm_str(alg
));
276 /* XXX replace with qapi_enum_parse() in future, when we can
277 * make that function emit a more friendly error message */
278 static int qcrypto_block_luks_name_lookup(const char *name
,
279 const QEnumLookup
*map
,
283 int ret
= qapi_enum_parse(map
, name
, -1, NULL
);
286 error_setg(errp
, "%s %s not supported", type
, name
);
292 #define qcrypto_block_luks_cipher_mode_lookup(name, errp) \
293 qcrypto_block_luks_name_lookup(name, \
294 &QCryptoCipherMode_lookup, \
298 #define qcrypto_block_luks_hash_name_lookup(name, errp) \
299 qcrypto_block_luks_name_lookup(name, \
300 &QCryptoHashAlgorithm_lookup, \
304 #define qcrypto_block_luks_ivgen_name_lookup(name, errp) \
305 qcrypto_block_luks_name_lookup(name, \
306 &QCryptoIVGenAlgorithm_lookup, \
312 qcrypto_block_luks_has_format(const uint8_t *buf
,
315 const QCryptoBlockLUKSHeader
*luks_header
= (const void *)buf
;
317 if (buf_size
>= offsetof(QCryptoBlockLUKSHeader
, cipher_name
) &&
318 memcmp(luks_header
->magic
, qcrypto_block_luks_magic
,
319 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
) == 0 &&
320 be16_to_cpu(luks_header
->version
) == QCRYPTO_BLOCK_LUKS_VERSION
) {
329 * Deal with a quirk of dm-crypt usage of ESSIV.
331 * When calculating ESSIV IVs, the cipher length used by ESSIV
332 * may be different from the cipher length used for the block
333 * encryption, becauses dm-crypt uses the hash digest length
334 * as the key size. ie, if you have AES 128 as the block cipher
335 * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as
336 * the cipher since that gets a key length matching the digest
337 * size, not AES 128 with truncated digest as might be imagined
339 static QCryptoCipherAlgorithm
340 qcrypto_block_luks_essiv_cipher(QCryptoCipherAlgorithm cipher
,
341 QCryptoHashAlgorithm hash
,
344 size_t digestlen
= qcrypto_hash_digest_len(hash
);
345 size_t keylen
= qcrypto_cipher_get_key_len(cipher
);
346 if (digestlen
== keylen
) {
351 case QCRYPTO_CIPHER_ALG_AES_128
:
352 case QCRYPTO_CIPHER_ALG_AES_192
:
353 case QCRYPTO_CIPHER_ALG_AES_256
:
354 if (digestlen
== qcrypto_cipher_get_key_len(
355 QCRYPTO_CIPHER_ALG_AES_128
)) {
356 return QCRYPTO_CIPHER_ALG_AES_128
;
357 } else if (digestlen
== qcrypto_cipher_get_key_len(
358 QCRYPTO_CIPHER_ALG_AES_192
)) {
359 return QCRYPTO_CIPHER_ALG_AES_192
;
360 } else if (digestlen
== qcrypto_cipher_get_key_len(
361 QCRYPTO_CIPHER_ALG_AES_256
)) {
362 return QCRYPTO_CIPHER_ALG_AES_256
;
364 error_setg(errp
, "No AES cipher with key size %zu available",
369 case QCRYPTO_CIPHER_ALG_SERPENT_128
:
370 case QCRYPTO_CIPHER_ALG_SERPENT_192
:
371 case QCRYPTO_CIPHER_ALG_SERPENT_256
:
372 if (digestlen
== qcrypto_cipher_get_key_len(
373 QCRYPTO_CIPHER_ALG_SERPENT_128
)) {
374 return QCRYPTO_CIPHER_ALG_SERPENT_128
;
375 } else if (digestlen
== qcrypto_cipher_get_key_len(
376 QCRYPTO_CIPHER_ALG_SERPENT_192
)) {
377 return QCRYPTO_CIPHER_ALG_SERPENT_192
;
378 } else if (digestlen
== qcrypto_cipher_get_key_len(
379 QCRYPTO_CIPHER_ALG_SERPENT_256
)) {
380 return QCRYPTO_CIPHER_ALG_SERPENT_256
;
382 error_setg(errp
, "No Serpent cipher with key size %zu available",
387 case QCRYPTO_CIPHER_ALG_TWOFISH_128
:
388 case QCRYPTO_CIPHER_ALG_TWOFISH_192
:
389 case QCRYPTO_CIPHER_ALG_TWOFISH_256
:
390 if (digestlen
== qcrypto_cipher_get_key_len(
391 QCRYPTO_CIPHER_ALG_TWOFISH_128
)) {
392 return QCRYPTO_CIPHER_ALG_TWOFISH_128
;
393 } else if (digestlen
== qcrypto_cipher_get_key_len(
394 QCRYPTO_CIPHER_ALG_TWOFISH_192
)) {
395 return QCRYPTO_CIPHER_ALG_TWOFISH_192
;
396 } else if (digestlen
== qcrypto_cipher_get_key_len(
397 QCRYPTO_CIPHER_ALG_TWOFISH_256
)) {
398 return QCRYPTO_CIPHER_ALG_TWOFISH_256
;
400 error_setg(errp
, "No Twofish cipher with key size %zu available",
406 error_setg(errp
, "Cipher %s not supported with essiv",
407 QCryptoCipherAlgorithm_str(cipher
));
413 * Given a key slot, and user password, this will attempt to unlock
414 * the master encryption key from the key slot.
417 * 0 if the key slot is disabled, or key could not be decrypted
418 * with the provided password
419 * 1 if the key slot is enabled, and key decrypted successfully
420 * with the provided password
421 * -1 if a fatal error occurred loading the key
424 qcrypto_block_luks_load_key(QCryptoBlock
*block
,
426 const char *password
,
428 QCryptoBlockReadFunc readfunc
,
432 QCryptoBlockLUKS
*luks
= block
->opaque
;
433 const QCryptoBlockLUKSKeySlot
*slot
= &luks
->header
.key_slots
[slot_idx
];
434 g_autofree
uint8_t *splitkey
= NULL
;
436 g_autofree
uint8_t *possiblekey
= NULL
;
438 g_autoptr(QCryptoCipher
) cipher
= NULL
;
439 uint8_t keydigest
[QCRYPTO_BLOCK_LUKS_DIGEST_LEN
];
440 g_autoptr(QCryptoIVGen
) ivgen
= NULL
;
443 if (slot
->active
!= QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
) {
447 splitkeylen
= luks
->header
.master_key_len
* slot
->stripes
;
448 splitkey
= g_new0(uint8_t, splitkeylen
);
449 possiblekey
= g_new0(uint8_t, luks
->header
.master_key_len
);
452 * The user password is used to generate a (possible)
453 * decryption key. This may or may not successfully
454 * decrypt the master key - we just blindly assume
455 * the key is correct and validate the results of
458 if (qcrypto_pbkdf2(luks
->hash_alg
,
459 (const uint8_t *)password
, strlen(password
),
460 slot
->salt
, QCRYPTO_BLOCK_LUKS_SALT_LEN
,
462 possiblekey
, luks
->header
.master_key_len
,
468 * We need to read the master key material from the
469 * LUKS key material header. What we're reading is
470 * not the raw master key, but rather the data after
471 * it has been passed through AFSplit and the result
475 slot
->key_offset_sector
* QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
476 splitkey
, splitkeylen
,
484 /* Setup the cipher/ivgen that we'll use to try to decrypt
485 * the split master key material */
486 cipher
= qcrypto_cipher_new(luks
->cipher_alg
,
489 luks
->header
.master_key_len
,
495 niv
= qcrypto_cipher_get_iv_len(luks
->cipher_alg
,
498 ivgen
= qcrypto_ivgen_new(luks
->ivgen_alg
,
499 luks
->ivgen_cipher_alg
,
500 luks
->ivgen_hash_alg
,
502 luks
->header
.master_key_len
,
510 * The master key needs to be decrypted in the same
511 * way that the block device payload will be decrypted
512 * later. In particular we'll be using the IV generator
513 * to reset the encryption cipher every time the master
514 * key crosses a sector boundary.
516 if (qcrypto_block_cipher_decrypt_helper(cipher
,
519 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
528 * Now we've decrypted the split master key, join
529 * it back together to get the actual master key.
531 if (qcrypto_afsplit_decode(luks
->hash_alg
,
532 luks
->header
.master_key_len
,
542 * We still don't know that the masterkey we got is valid,
543 * because we just blindly assumed the user's password
544 * was correct. This is where we now verify it. We are
545 * creating a hash of the master key using PBKDF and
546 * then comparing that to the hash stored in the key slot
549 if (qcrypto_pbkdf2(luks
->hash_alg
,
551 luks
->header
.master_key_len
,
552 luks
->header
.master_key_salt
,
553 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
554 luks
->header
.master_key_iterations
,
556 G_N_ELEMENTS(keydigest
),
561 if (memcmp(keydigest
, luks
->header
.master_key_digest
,
562 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
) == 0) {
563 /* Success, we got the right master key */
567 /* Fail, user's password was not valid for this key slot,
568 * tell caller to try another slot */
574 * Given a user password, this will iterate over all key
575 * slots and try to unlock each active key slot using the
576 * password until it successfully obtains a master key.
578 * Returns 0 if a key was loaded, -1 if no keys could be loaded
581 qcrypto_block_luks_find_key(QCryptoBlock
*block
,
582 const char *password
,
584 QCryptoBlockReadFunc readfunc
,
591 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
592 rv
= qcrypto_block_luks_load_key(block
,
607 error_setg(errp
, "Invalid password, cannot unlock any keyslot");
614 qcrypto_block_luks_open(QCryptoBlock
*block
,
615 QCryptoBlockOpenOptions
*options
,
616 const char *optprefix
,
617 QCryptoBlockReadFunc readfunc
,
623 QCryptoBlockLUKS
*luks
= NULL
;
624 Error
*local_err
= NULL
;
628 g_autofree
uint8_t *masterkey
= NULL
;
629 char *ivgen_name
, *ivhash_name
;
630 g_autofree
char *password
= NULL
;
631 g_autofree
char *cipher_mode
= NULL
;
633 if (!(flags
& QCRYPTO_BLOCK_OPEN_NO_IO
)) {
634 if (!options
->u
.luks
.key_secret
) {
635 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
636 optprefix
? optprefix
: "");
639 password
= qcrypto_secret_lookup_as_utf8(
640 options
->u
.luks
.key_secret
, errp
);
646 luks
= g_new0(QCryptoBlockLUKS
, 1);
647 block
->opaque
= luks
;
649 /* Read the entire LUKS header, minus the key material from
650 * the underlying device */
651 rv
= readfunc(block
, 0,
652 (uint8_t *)&luks
->header
,
653 sizeof(luks
->header
),
661 /* The header is always stored in big-endian format, so
662 * convert everything to native */
663 be16_to_cpus(&luks
->header
.version
);
664 be32_to_cpus(&luks
->header
.payload_offset_sector
);
665 be32_to_cpus(&luks
->header
.master_key_len
);
666 be32_to_cpus(&luks
->header
.master_key_iterations
);
668 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
669 be32_to_cpus(&luks
->header
.key_slots
[i
].active
);
670 be32_to_cpus(&luks
->header
.key_slots
[i
].iterations
);
671 be32_to_cpus(&luks
->header
.key_slots
[i
].key_offset_sector
);
672 be32_to_cpus(&luks
->header
.key_slots
[i
].stripes
);
675 if (memcmp(luks
->header
.magic
, qcrypto_block_luks_magic
,
676 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
) != 0) {
677 error_setg(errp
, "Volume is not in LUKS format");
681 if (luks
->header
.version
!= QCRYPTO_BLOCK_LUKS_VERSION
) {
682 error_setg(errp
, "LUKS version %" PRIu32
" is not supported",
683 luks
->header
.version
);
688 cipher_mode
= g_strdup(luks
->header
.cipher_mode
);
691 * The cipher_mode header contains a string that we have
692 * to further parse, of the format
694 * <cipher-mode>-<iv-generator>[:<iv-hash>]
696 * eg cbc-essiv:sha256, cbc-plain64
698 ivgen_name
= strchr(cipher_mode
, '-');
701 error_setg(errp
, "Unexpected cipher mode string format %s",
708 ivhash_name
= strchr(ivgen_name
, ':');
710 luks
->ivgen_hash_alg
= 0;
715 luks
->ivgen_hash_alg
= qcrypto_block_luks_hash_name_lookup(ivhash_name
,
719 error_propagate(errp
, local_err
);
724 luks
->cipher_mode
= qcrypto_block_luks_cipher_mode_lookup(cipher_mode
,
728 error_propagate(errp
, local_err
);
733 qcrypto_block_luks_cipher_name_lookup(luks
->header
.cipher_name
,
735 luks
->header
.master_key_len
,
739 error_propagate(errp
, local_err
);
744 qcrypto_block_luks_hash_name_lookup(luks
->header
.hash_spec
,
748 error_propagate(errp
, local_err
);
752 luks
->ivgen_alg
= qcrypto_block_luks_ivgen_name_lookup(ivgen_name
,
756 error_propagate(errp
, local_err
);
760 if (luks
->ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
763 error_setg(errp
, "Missing IV generator hash specification");
766 luks
->ivgen_cipher_alg
=
767 qcrypto_block_luks_essiv_cipher(luks
->cipher_alg
,
768 luks
->ivgen_hash_alg
,
772 error_propagate(errp
, local_err
);
776 /* Note we parsed the ivhash_name earlier in the cipher_mode
777 * spec string even with plain/plain64 ivgens, but we
778 * will ignore it, since it is irrelevant for these ivgens.
779 * This is for compat with dm-crypt which will silently
780 * ignore hash names with these ivgens rather than report
781 * an error about the invalid usage
783 luks
->ivgen_cipher_alg
= luks
->cipher_alg
;
786 if (!(flags
& QCRYPTO_BLOCK_OPEN_NO_IO
)) {
787 /* Try to find which key slot our password is valid for
788 * and unlock the master key from that slot.
791 masterkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
793 if (qcrypto_block_luks_find_key(block
,
802 /* We have a valid master key now, so can setup the
803 * block device payload decryption objects
805 block
->kdfhash
= luks
->hash_alg
;
806 block
->niv
= qcrypto_cipher_get_iv_len(luks
->cipher_alg
,
809 block
->ivgen
= qcrypto_ivgen_new(luks
->ivgen_alg
,
810 luks
->ivgen_cipher_alg
,
811 luks
->ivgen_hash_alg
,
813 luks
->header
.master_key_len
,
820 ret
= qcrypto_block_init_cipher(block
,
824 luks
->header
.master_key_len
,
833 block
->sector_size
= QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
834 block
->payload_offset
= luks
->header
.payload_offset_sector
*
841 qcrypto_block_free_cipher(block
);
842 qcrypto_ivgen_free(block
->ivgen
);
849 qcrypto_block_luks_uuid_gen(uint8_t *uuidstr
)
852 qemu_uuid_generate(&uuid
);
853 qemu_uuid_unparse(&uuid
, (char *)uuidstr
);
857 qcrypto_block_luks_create(QCryptoBlock
*block
,
858 QCryptoBlockCreateOptions
*options
,
859 const char *optprefix
,
860 QCryptoBlockInitFunc initfunc
,
861 QCryptoBlockWriteFunc writefunc
,
865 QCryptoBlockLUKS
*luks
;
866 QCryptoBlockCreateOptionsLUKS luks_opts
;
867 Error
*local_err
= NULL
;
868 g_autofree
uint8_t *masterkey
= NULL
;
869 g_autofree
uint8_t *slotkey
= NULL
;
870 g_autofree
uint8_t *splitkey
= NULL
;
871 size_t splitkeylen
= 0;
873 g_autoptr(QCryptoCipher
) cipher
= NULL
;
874 g_autoptr(QCryptoIVGen
) ivgen
= NULL
;
875 g_autofree
char *password
= NULL
;
876 const char *cipher_alg
;
877 const char *cipher_mode
;
878 const char *ivgen_alg
;
879 const char *ivgen_hash_alg
= NULL
;
880 const char *hash_alg
;
881 g_autofree
char *cipher_mode_spec
= NULL
;
884 memcpy(&luks_opts
, &options
->u
.luks
, sizeof(luks_opts
));
885 if (!luks_opts
.has_iter_time
) {
886 luks_opts
.iter_time
= 2000;
888 if (!luks_opts
.has_cipher_alg
) {
889 luks_opts
.cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
;
891 if (!luks_opts
.has_cipher_mode
) {
892 luks_opts
.cipher_mode
= QCRYPTO_CIPHER_MODE_XTS
;
894 if (!luks_opts
.has_ivgen_alg
) {
895 luks_opts
.ivgen_alg
= QCRYPTO_IVGEN_ALG_PLAIN64
;
897 if (!luks_opts
.has_hash_alg
) {
898 luks_opts
.hash_alg
= QCRYPTO_HASH_ALG_SHA256
;
900 if (luks_opts
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
901 if (!luks_opts
.has_ivgen_hash_alg
) {
902 luks_opts
.ivgen_hash_alg
= QCRYPTO_HASH_ALG_SHA256
;
903 luks_opts
.has_ivgen_hash_alg
= true;
907 luks
= g_new0(QCryptoBlockLUKS
, 1);
908 block
->opaque
= luks
;
910 luks
->cipher_alg
= luks_opts
.cipher_alg
;
911 luks
->cipher_mode
= luks_opts
.cipher_mode
;
912 luks
->ivgen_alg
= luks_opts
.ivgen_alg
;
913 luks
->ivgen_hash_alg
= luks_opts
.ivgen_hash_alg
;
914 luks
->hash_alg
= luks_opts
.hash_alg
;
917 /* Note we're allowing ivgen_hash_alg to be set even for
918 * non-essiv iv generators that don't need a hash. It will
919 * be silently ignored, for compatibility with dm-crypt */
921 if (!options
->u
.luks
.key_secret
) {
922 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
923 optprefix
? optprefix
: "");
926 password
= qcrypto_secret_lookup_as_utf8(luks_opts
.key_secret
, errp
);
932 memcpy(luks
->header
.magic
, qcrypto_block_luks_magic
,
933 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
);
935 /* We populate the header in native endianness initially and
936 * then convert everything to big endian just before writing
939 luks
->header
.version
= QCRYPTO_BLOCK_LUKS_VERSION
;
940 qcrypto_block_luks_uuid_gen(luks
->header
.uuid
);
942 cipher_alg
= qcrypto_block_luks_cipher_alg_lookup(luks_opts
.cipher_alg
,
948 cipher_mode
= QCryptoCipherMode_str(luks_opts
.cipher_mode
);
949 ivgen_alg
= QCryptoIVGenAlgorithm_str(luks_opts
.ivgen_alg
);
950 if (luks_opts
.has_ivgen_hash_alg
) {
951 ivgen_hash_alg
= QCryptoHashAlgorithm_str(luks_opts
.ivgen_hash_alg
);
952 cipher_mode_spec
= g_strdup_printf("%s-%s:%s", cipher_mode
, ivgen_alg
,
955 cipher_mode_spec
= g_strdup_printf("%s-%s", cipher_mode
, ivgen_alg
);
957 hash_alg
= QCryptoHashAlgorithm_str(luks_opts
.hash_alg
);
960 if (strlen(cipher_alg
) >= QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN
) {
961 error_setg(errp
, "Cipher name '%s' is too long for LUKS header",
965 if (strlen(cipher_mode_spec
) >= QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN
) {
966 error_setg(errp
, "Cipher mode '%s' is too long for LUKS header",
970 if (strlen(hash_alg
) >= QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN
) {
971 error_setg(errp
, "Hash name '%s' is too long for LUKS header",
976 if (luks_opts
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
977 luks
->ivgen_cipher_alg
=
978 qcrypto_block_luks_essiv_cipher(luks_opts
.cipher_alg
,
979 luks_opts
.ivgen_hash_alg
,
982 error_propagate(errp
, local_err
);
986 luks
->ivgen_cipher_alg
= luks_opts
.cipher_alg
;
989 strcpy(luks
->header
.cipher_name
, cipher_alg
);
990 strcpy(luks
->header
.cipher_mode
, cipher_mode_spec
);
991 strcpy(luks
->header
.hash_spec
, hash_alg
);
993 luks
->header
.master_key_len
=
994 qcrypto_cipher_get_key_len(luks_opts
.cipher_alg
);
996 if (luks_opts
.cipher_mode
== QCRYPTO_CIPHER_MODE_XTS
) {
997 luks
->header
.master_key_len
*= 2;
1000 /* Generate the salt used for hashing the master key
1003 if (qcrypto_random_bytes(luks
->header
.master_key_salt
,
1004 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1009 /* Generate random master key */
1010 masterkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
1011 if (qcrypto_random_bytes(masterkey
,
1012 luks
->header
.master_key_len
, errp
) < 0) {
1017 /* Setup the block device payload encryption objects */
1018 if (qcrypto_block_init_cipher(block
, luks_opts
.cipher_alg
,
1019 luks_opts
.cipher_mode
, masterkey
,
1020 luks
->header
.master_key_len
, 1, errp
) < 0) {
1024 block
->kdfhash
= luks_opts
.hash_alg
;
1025 block
->niv
= qcrypto_cipher_get_iv_len(luks_opts
.cipher_alg
,
1026 luks_opts
.cipher_mode
);
1027 block
->ivgen
= qcrypto_ivgen_new(luks_opts
.ivgen_alg
,
1028 luks
->ivgen_cipher_alg
,
1029 luks_opts
.ivgen_hash_alg
,
1030 masterkey
, luks
->header
.master_key_len
,
1033 if (!block
->ivgen
) {
1038 /* Determine how many iterations we need to hash the master
1039 * key, in order to have 1 second of compute time used
1041 iters
= qcrypto_pbkdf2_count_iters(luks_opts
.hash_alg
,
1042 masterkey
, luks
->header
.master_key_len
,
1043 luks
->header
.master_key_salt
,
1044 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1045 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
,
1048 error_propagate(errp
, local_err
);
1052 if (iters
> (ULLONG_MAX
/ luks_opts
.iter_time
)) {
1053 error_setg_errno(errp
, ERANGE
,
1054 "PBKDF iterations %llu too large to scale",
1055 (unsigned long long)iters
);
1059 /* iter_time was in millis, but count_iters reported for secs */
1060 iters
= iters
* luks_opts
.iter_time
/ 1000;
1062 /* Why /= 8 ? That matches cryptsetup, but there's no
1063 * explanation why they chose /= 8... Probably so that
1064 * if all 8 keyslots are active we only spend 1 second
1065 * in total time to check all keys */
1067 if (iters
> UINT32_MAX
) {
1068 error_setg_errno(errp
, ERANGE
,
1069 "PBKDF iterations %llu larger than %u",
1070 (unsigned long long)iters
, UINT32_MAX
);
1073 iters
= MAX(iters
, QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS
);
1074 luks
->header
.master_key_iterations
= iters
;
1076 /* Hash the master key, saving the result in the LUKS
1077 * header. This hash is used when opening the encrypted
1078 * device to verify that the user password unlocked a
1081 if (qcrypto_pbkdf2(luks_opts
.hash_alg
,
1082 masterkey
, luks
->header
.master_key_len
,
1083 luks
->header
.master_key_salt
,
1084 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1085 luks
->header
.master_key_iterations
,
1086 luks
->header
.master_key_digest
,
1087 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
,
1093 /* Although LUKS has multiple key slots, we're just going
1094 * to use the first key slot */
1095 splitkeylen
= luks
->header
.master_key_len
* QCRYPTO_BLOCK_LUKS_STRIPES
;
1096 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1097 luks
->header
.key_slots
[i
].active
= i
== 0 ?
1098 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
:
1099 QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED
;
1100 luks
->header
.key_slots
[i
].stripes
= QCRYPTO_BLOCK_LUKS_STRIPES
;
1102 /* This calculation doesn't match that shown in the spec,
1103 * but instead follows the cryptsetup implementation.
1105 luks
->header
.key_slots
[i
].key_offset_sector
=
1106 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1107 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
) +
1108 (ROUND_UP(DIV_ROUND_UP(splitkeylen
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
),
1109 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1110 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
)) * i
);
1113 if (qcrypto_random_bytes(luks
->header
.key_slots
[0].salt
,
1114 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1119 /* Again we determine how many iterations are required to
1120 * hash the user password while consuming 1 second of compute
1122 iters
= qcrypto_pbkdf2_count_iters(luks_opts
.hash_alg
,
1123 (uint8_t *)password
, strlen(password
),
1124 luks
->header
.key_slots
[0].salt
,
1125 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1126 luks
->header
.master_key_len
,
1129 error_propagate(errp
, local_err
);
1133 if (iters
> (ULLONG_MAX
/ luks_opts
.iter_time
)) {
1134 error_setg_errno(errp
, ERANGE
,
1135 "PBKDF iterations %llu too large to scale",
1136 (unsigned long long)iters
);
1140 /* iter_time was in millis, but count_iters reported for secs */
1141 iters
= iters
* luks_opts
.iter_time
/ 1000;
1143 if (iters
> UINT32_MAX
) {
1144 error_setg_errno(errp
, ERANGE
,
1145 "PBKDF iterations %llu larger than %u",
1146 (unsigned long long)iters
, UINT32_MAX
);
1150 luks
->header
.key_slots
[0].iterations
=
1151 MAX(iters
, QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS
);
1154 /* Generate a key that we'll use to encrypt the master
1155 * key, from the user's password
1157 slotkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
1158 if (qcrypto_pbkdf2(luks_opts
.hash_alg
,
1159 (uint8_t *)password
, strlen(password
),
1160 luks
->header
.key_slots
[0].salt
,
1161 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1162 luks
->header
.key_slots
[0].iterations
,
1163 slotkey
, luks
->header
.master_key_len
,
1169 /* Setup the encryption objects needed to encrypt the
1170 * master key material
1172 cipher
= qcrypto_cipher_new(luks_opts
.cipher_alg
,
1173 luks_opts
.cipher_mode
,
1174 slotkey
, luks
->header
.master_key_len
,
1180 ivgen
= qcrypto_ivgen_new(luks_opts
.ivgen_alg
,
1181 luks
->ivgen_cipher_alg
,
1182 luks_opts
.ivgen_hash_alg
,
1183 slotkey
, luks
->header
.master_key_len
,
1189 /* Before storing the master key, we need to vastly
1190 * increase its size, as protection against forensic
1191 * disk data recovery */
1192 splitkey
= g_new0(uint8_t, splitkeylen
);
1194 if (qcrypto_afsplit_encode(luks_opts
.hash_alg
,
1195 luks
->header
.master_key_len
,
1196 luks
->header
.key_slots
[0].stripes
,
1203 /* Now we encrypt the split master key with the key generated
1204 * from the user's password, before storing it */
1205 if (qcrypto_block_cipher_encrypt_helper(cipher
, block
->niv
, ivgen
,
1206 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1215 /* The total size of the LUKS headers is the partition header + key
1216 * slot headers, rounded up to the nearest sector, combined with
1217 * the size of each master key material region, also rounded up
1218 * to the nearest sector */
1219 luks
->header
.payload_offset_sector
=
1220 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1221 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
) +
1222 (ROUND_UP(DIV_ROUND_UP(splitkeylen
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
),
1223 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1224 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
)) *
1225 QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
);
1227 block
->sector_size
= QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
1228 block
->payload_offset
= luks
->header
.payload_offset_sector
*
1231 /* Reserve header space to match payload offset */
1232 initfunc(block
, block
->payload_offset
, opaque
, &local_err
);
1234 error_propagate(errp
, local_err
);
1238 /* Everything on disk uses Big Endian, so flip header fields
1239 * before writing them */
1240 cpu_to_be16s(&luks
->header
.version
);
1241 cpu_to_be32s(&luks
->header
.payload_offset_sector
);
1242 cpu_to_be32s(&luks
->header
.master_key_len
);
1243 cpu_to_be32s(&luks
->header
.master_key_iterations
);
1245 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1246 cpu_to_be32s(&luks
->header
.key_slots
[i
].active
);
1247 cpu_to_be32s(&luks
->header
.key_slots
[i
].iterations
);
1248 cpu_to_be32s(&luks
->header
.key_slots
[i
].key_offset_sector
);
1249 cpu_to_be32s(&luks
->header
.key_slots
[i
].stripes
);
1253 /* Write out the partition header and key slot headers */
1255 (const uint8_t *)&luks
->header
,
1256 sizeof(luks
->header
),
1260 /* Delay checking local_err until we've byte-swapped */
1262 /* Byte swap the header back to native, in case we need
1263 * to read it again later */
1264 be16_to_cpus(&luks
->header
.version
);
1265 be32_to_cpus(&luks
->header
.payload_offset_sector
);
1266 be32_to_cpus(&luks
->header
.master_key_len
);
1267 be32_to_cpus(&luks
->header
.master_key_iterations
);
1269 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1270 be32_to_cpus(&luks
->header
.key_slots
[i
].active
);
1271 be32_to_cpus(&luks
->header
.key_slots
[i
].iterations
);
1272 be32_to_cpus(&luks
->header
.key_slots
[i
].key_offset_sector
);
1273 be32_to_cpus(&luks
->header
.key_slots
[i
].stripes
);
1277 error_propagate(errp
, local_err
);
1281 /* Write out the master key material, starting at the
1282 * sector immediately following the partition header. */
1283 if (writefunc(block
,
1284 luks
->header
.key_slots
[0].key_offset_sector
*
1285 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1286 splitkey
, splitkeylen
,
1288 errp
) != splitkeylen
) {
1292 memset(masterkey
, 0, luks
->header
.master_key_len
);
1293 memset(slotkey
, 0, luks
->header
.master_key_len
);
1299 memset(masterkey
, 0, luks
->header
.master_key_len
);
1302 memset(slotkey
, 0, luks
->header
.master_key_len
);
1305 qcrypto_block_free_cipher(block
);
1306 qcrypto_ivgen_free(block
->ivgen
);
1313 static int qcrypto_block_luks_get_info(QCryptoBlock
*block
,
1314 QCryptoBlockInfo
*info
,
1317 QCryptoBlockLUKS
*luks
= block
->opaque
;
1318 QCryptoBlockInfoLUKSSlot
*slot
;
1319 QCryptoBlockInfoLUKSSlotList
*slots
= NULL
, **prev
= &info
->u
.luks
.slots
;
1322 info
->u
.luks
.cipher_alg
= luks
->cipher_alg
;
1323 info
->u
.luks
.cipher_mode
= luks
->cipher_mode
;
1324 info
->u
.luks
.ivgen_alg
= luks
->ivgen_alg
;
1325 if (info
->u
.luks
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
1326 info
->u
.luks
.has_ivgen_hash_alg
= true;
1327 info
->u
.luks
.ivgen_hash_alg
= luks
->ivgen_hash_alg
;
1329 info
->u
.luks
.hash_alg
= luks
->hash_alg
;
1330 info
->u
.luks
.payload_offset
= block
->payload_offset
;
1331 info
->u
.luks
.master_key_iters
= luks
->header
.master_key_iterations
;
1332 info
->u
.luks
.uuid
= g_strndup((const char *)luks
->header
.uuid
,
1333 sizeof(luks
->header
.uuid
));
1335 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1336 slots
= g_new0(QCryptoBlockInfoLUKSSlotList
, 1);
1339 slots
->value
= slot
= g_new0(QCryptoBlockInfoLUKSSlot
, 1);
1340 slot
->active
= luks
->header
.key_slots
[i
].active
==
1341 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
;
1342 slot
->key_offset
= luks
->header
.key_slots
[i
].key_offset_sector
1343 * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
1345 slot
->has_iters
= true;
1346 slot
->iters
= luks
->header
.key_slots
[i
].iterations
;
1347 slot
->has_stripes
= true;
1348 slot
->stripes
= luks
->header
.key_slots
[i
].stripes
;
1351 prev
= &slots
->next
;
1358 static void qcrypto_block_luks_cleanup(QCryptoBlock
*block
)
1360 g_free(block
->opaque
);
1365 qcrypto_block_luks_decrypt(QCryptoBlock
*block
,
1371 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1372 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1373 return qcrypto_block_decrypt_helper(block
,
1374 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1375 offset
, buf
, len
, errp
);
1380 qcrypto_block_luks_encrypt(QCryptoBlock
*block
,
1386 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1387 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1388 return qcrypto_block_encrypt_helper(block
,
1389 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1390 offset
, buf
, len
, errp
);
1394 const QCryptoBlockDriver qcrypto_block_driver_luks
= {
1395 .open
= qcrypto_block_luks_open
,
1396 .create
= qcrypto_block_luks_create
,
1397 .get_info
= qcrypto_block_luks_get_info
,
1398 .cleanup
= qcrypto_block_luks_cleanup
,
1399 .decrypt
= qcrypto_block_luks_decrypt
,
1400 .encrypt
= qcrypto_block_luks_encrypt
,
1401 .has_format
= qcrypto_block_luks_has_format
,