2 * QEMU Crypto block device encryption LUKS format
4 * Copyright (c) 2015-2016 Red Hat, Inc.
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "qemu/bswap.h"
25 #include "block-luks.h"
27 #include "crypto/hash.h"
28 #include "crypto/afsplit.h"
29 #include "crypto/pbkdf.h"
30 #include "crypto/secret.h"
31 #include "crypto/random.h"
32 #include "qemu/uuid.h"
34 #include "qemu/coroutine.h"
37 * Reference for the LUKS format implemented here is
39 * docs/on-disk-format.pdf
41 * in 'cryptsetup' package source code
43 * This file implements the 1.2.1 specification, dated
47 typedef struct QCryptoBlockLUKS QCryptoBlockLUKS
;
48 typedef struct QCryptoBlockLUKSHeader QCryptoBlockLUKSHeader
;
49 typedef struct QCryptoBlockLUKSKeySlot QCryptoBlockLUKSKeySlot
;
52 /* The following constants are all defined by the LUKS spec */
53 #define QCRYPTO_BLOCK_LUKS_VERSION 1
55 #define QCRYPTO_BLOCK_LUKS_MAGIC_LEN 6
56 #define QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN 32
57 #define QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN 32
58 #define QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN 32
59 #define QCRYPTO_BLOCK_LUKS_DIGEST_LEN 20
60 #define QCRYPTO_BLOCK_LUKS_SALT_LEN 32
61 #define QCRYPTO_BLOCK_LUKS_UUID_LEN 40
62 #define QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS 8
63 #define QCRYPTO_BLOCK_LUKS_STRIPES 4000
64 #define QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS 1000
65 #define QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS 1000
66 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET 4096
68 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED 0x0000DEAD
69 #define QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED 0x00AC71F3
71 #define QCRYPTO_BLOCK_LUKS_SECTOR_SIZE 512LL
73 static const char qcrypto_block_luks_magic
[QCRYPTO_BLOCK_LUKS_MAGIC_LEN
] = {
74 'L', 'U', 'K', 'S', 0xBA, 0xBE
77 typedef struct QCryptoBlockLUKSNameMap QCryptoBlockLUKSNameMap
;
78 struct QCryptoBlockLUKSNameMap
{
83 typedef struct QCryptoBlockLUKSCipherSizeMap QCryptoBlockLUKSCipherSizeMap
;
84 struct QCryptoBlockLUKSCipherSizeMap
{
88 typedef struct QCryptoBlockLUKSCipherNameMap QCryptoBlockLUKSCipherNameMap
;
89 struct QCryptoBlockLUKSCipherNameMap
{
91 const QCryptoBlockLUKSCipherSizeMap
*sizes
;
95 static const QCryptoBlockLUKSCipherSizeMap
96 qcrypto_block_luks_cipher_size_map_aes
[] = {
97 { 16, QCRYPTO_CIPHER_ALG_AES_128
},
98 { 24, QCRYPTO_CIPHER_ALG_AES_192
},
99 { 32, QCRYPTO_CIPHER_ALG_AES_256
},
103 static const QCryptoBlockLUKSCipherSizeMap
104 qcrypto_block_luks_cipher_size_map_cast5
[] = {
105 { 16, QCRYPTO_CIPHER_ALG_CAST5_128
},
109 static const QCryptoBlockLUKSCipherSizeMap
110 qcrypto_block_luks_cipher_size_map_serpent
[] = {
111 { 16, QCRYPTO_CIPHER_ALG_SERPENT_128
},
112 { 24, QCRYPTO_CIPHER_ALG_SERPENT_192
},
113 { 32, QCRYPTO_CIPHER_ALG_SERPENT_256
},
117 static const QCryptoBlockLUKSCipherSizeMap
118 qcrypto_block_luks_cipher_size_map_twofish
[] = {
119 { 16, QCRYPTO_CIPHER_ALG_TWOFISH_128
},
120 { 24, QCRYPTO_CIPHER_ALG_TWOFISH_192
},
121 { 32, QCRYPTO_CIPHER_ALG_TWOFISH_256
},
125 static const QCryptoBlockLUKSCipherNameMap
126 qcrypto_block_luks_cipher_name_map
[] = {
127 { "aes", qcrypto_block_luks_cipher_size_map_aes
},
128 { "cast5", qcrypto_block_luks_cipher_size_map_cast5
},
129 { "serpent", qcrypto_block_luks_cipher_size_map_serpent
},
130 { "twofish", qcrypto_block_luks_cipher_size_map_twofish
},
135 * This struct is written to disk in big-endian format,
136 * but operated upon in native-endian format.
138 struct QCryptoBlockLUKSKeySlot
{
139 /* state of keyslot, enabled/disable */
141 /* iterations for PBKDF2 */
143 /* salt for PBKDF2 */
144 uint8_t salt
[QCRYPTO_BLOCK_LUKS_SALT_LEN
];
145 /* start sector of key material */
146 uint32_t key_offset_sector
;
147 /* number of anti-forensic stripes */
151 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSKeySlot
) != 48);
155 * This struct is written to disk in big-endian format,
156 * but operated upon in native-endian format.
158 struct QCryptoBlockLUKSHeader
{
159 /* 'L', 'U', 'K', 'S', '0xBA', '0xBE' */
160 char magic
[QCRYPTO_BLOCK_LUKS_MAGIC_LEN
];
162 /* LUKS version, currently 1 */
165 /* cipher name specification (aes, etc) */
166 char cipher_name
[QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN
];
168 /* cipher mode specification (cbc-plain, xts-essiv:sha256, etc) */
169 char cipher_mode
[QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN
];
171 /* hash specification (sha256, etc) */
172 char hash_spec
[QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN
];
174 /* start offset of the volume data (in 512 byte sectors) */
175 uint32_t payload_offset_sector
;
177 /* Number of key bytes */
178 uint32_t master_key_len
;
180 /* master key checksum after PBKDF2 */
181 uint8_t master_key_digest
[QCRYPTO_BLOCK_LUKS_DIGEST_LEN
];
183 /* salt for master key PBKDF2 */
184 uint8_t master_key_salt
[QCRYPTO_BLOCK_LUKS_SALT_LEN
];
186 /* iterations for master key PBKDF2 */
187 uint32_t master_key_iterations
;
189 /* UUID of the partition in standard ASCII representation */
190 uint8_t uuid
[QCRYPTO_BLOCK_LUKS_UUID_LEN
];
193 QCryptoBlockLUKSKeySlot key_slots
[QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
];
196 QEMU_BUILD_BUG_ON(sizeof(struct QCryptoBlockLUKSHeader
) != 592);
199 struct QCryptoBlockLUKS
{
200 QCryptoBlockLUKSHeader header
;
202 /* Main encryption algorithm used for encryption*/
203 QCryptoCipherAlgorithm cipher_alg
;
205 /* Mode of encryption for the selected encryption algorithm */
206 QCryptoCipherMode cipher_mode
;
208 /* Initialization vector generation algorithm */
209 QCryptoIVGenAlgorithm ivgen_alg
;
211 /* Hash algorithm used for IV generation*/
212 QCryptoHashAlgorithm ivgen_hash_alg
;
215 * Encryption algorithm used for IV generation.
216 * Usually the same as main encryption algorithm
218 QCryptoCipherAlgorithm ivgen_cipher_alg
;
220 /* Hash algorithm used in pbkdf2 function */
221 QCryptoHashAlgorithm hash_alg
;
225 static int qcrypto_block_luks_cipher_name_lookup(const char *name
,
226 QCryptoCipherMode mode
,
230 const QCryptoBlockLUKSCipherNameMap
*map
=
231 qcrypto_block_luks_cipher_name_map
;
232 size_t maplen
= G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map
);
235 if (mode
== QCRYPTO_CIPHER_MODE_XTS
) {
239 for (i
= 0; i
< maplen
; i
++) {
240 if (!g_str_equal(map
[i
].name
, name
)) {
243 for (j
= 0; j
< map
[i
].sizes
[j
].key_bytes
; j
++) {
244 if (map
[i
].sizes
[j
].key_bytes
== key_bytes
) {
245 return map
[i
].sizes
[j
].id
;
250 error_setg(errp
, "Algorithm %s with key size %d bytes not supported",
256 qcrypto_block_luks_cipher_alg_lookup(QCryptoCipherAlgorithm alg
,
259 const QCryptoBlockLUKSCipherNameMap
*map
=
260 qcrypto_block_luks_cipher_name_map
;
261 size_t maplen
= G_N_ELEMENTS(qcrypto_block_luks_cipher_name_map
);
263 for (i
= 0; i
< maplen
; i
++) {
264 for (j
= 0; j
< map
[i
].sizes
[j
].key_bytes
; j
++) {
265 if (map
[i
].sizes
[j
].id
== alg
) {
271 error_setg(errp
, "Algorithm '%s' not supported",
272 QCryptoCipherAlgorithm_str(alg
));
276 /* XXX replace with qapi_enum_parse() in future, when we can
277 * make that function emit a more friendly error message */
278 static int qcrypto_block_luks_name_lookup(const char *name
,
279 const QEnumLookup
*map
,
283 int ret
= qapi_enum_parse(map
, name
, -1, NULL
);
286 error_setg(errp
, "%s %s not supported", type
, name
);
292 #define qcrypto_block_luks_cipher_mode_lookup(name, errp) \
293 qcrypto_block_luks_name_lookup(name, \
294 &QCryptoCipherMode_lookup, \
298 #define qcrypto_block_luks_hash_name_lookup(name, errp) \
299 qcrypto_block_luks_name_lookup(name, \
300 &QCryptoHashAlgorithm_lookup, \
304 #define qcrypto_block_luks_ivgen_name_lookup(name, errp) \
305 qcrypto_block_luks_name_lookup(name, \
306 &QCryptoIVGenAlgorithm_lookup, \
312 qcrypto_block_luks_has_format(const uint8_t *buf
,
315 const QCryptoBlockLUKSHeader
*luks_header
= (const void *)buf
;
317 if (buf_size
>= offsetof(QCryptoBlockLUKSHeader
, cipher_name
) &&
318 memcmp(luks_header
->magic
, qcrypto_block_luks_magic
,
319 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
) == 0 &&
320 be16_to_cpu(luks_header
->version
) == QCRYPTO_BLOCK_LUKS_VERSION
) {
329 * Deal with a quirk of dm-crypt usage of ESSIV.
331 * When calculating ESSIV IVs, the cipher length used by ESSIV
332 * may be different from the cipher length used for the block
333 * encryption, becauses dm-crypt uses the hash digest length
334 * as the key size. ie, if you have AES 128 as the block cipher
335 * and SHA 256 as ESSIV hash, then ESSIV will use AES 256 as
336 * the cipher since that gets a key length matching the digest
337 * size, not AES 128 with truncated digest as might be imagined
339 static QCryptoCipherAlgorithm
340 qcrypto_block_luks_essiv_cipher(QCryptoCipherAlgorithm cipher
,
341 QCryptoHashAlgorithm hash
,
344 size_t digestlen
= qcrypto_hash_digest_len(hash
);
345 size_t keylen
= qcrypto_cipher_get_key_len(cipher
);
346 if (digestlen
== keylen
) {
351 case QCRYPTO_CIPHER_ALG_AES_128
:
352 case QCRYPTO_CIPHER_ALG_AES_192
:
353 case QCRYPTO_CIPHER_ALG_AES_256
:
354 if (digestlen
== qcrypto_cipher_get_key_len(
355 QCRYPTO_CIPHER_ALG_AES_128
)) {
356 return QCRYPTO_CIPHER_ALG_AES_128
;
357 } else if (digestlen
== qcrypto_cipher_get_key_len(
358 QCRYPTO_CIPHER_ALG_AES_192
)) {
359 return QCRYPTO_CIPHER_ALG_AES_192
;
360 } else if (digestlen
== qcrypto_cipher_get_key_len(
361 QCRYPTO_CIPHER_ALG_AES_256
)) {
362 return QCRYPTO_CIPHER_ALG_AES_256
;
364 error_setg(errp
, "No AES cipher with key size %zu available",
369 case QCRYPTO_CIPHER_ALG_SERPENT_128
:
370 case QCRYPTO_CIPHER_ALG_SERPENT_192
:
371 case QCRYPTO_CIPHER_ALG_SERPENT_256
:
372 if (digestlen
== qcrypto_cipher_get_key_len(
373 QCRYPTO_CIPHER_ALG_SERPENT_128
)) {
374 return QCRYPTO_CIPHER_ALG_SERPENT_128
;
375 } else if (digestlen
== qcrypto_cipher_get_key_len(
376 QCRYPTO_CIPHER_ALG_SERPENT_192
)) {
377 return QCRYPTO_CIPHER_ALG_SERPENT_192
;
378 } else if (digestlen
== qcrypto_cipher_get_key_len(
379 QCRYPTO_CIPHER_ALG_SERPENT_256
)) {
380 return QCRYPTO_CIPHER_ALG_SERPENT_256
;
382 error_setg(errp
, "No Serpent cipher with key size %zu available",
387 case QCRYPTO_CIPHER_ALG_TWOFISH_128
:
388 case QCRYPTO_CIPHER_ALG_TWOFISH_192
:
389 case QCRYPTO_CIPHER_ALG_TWOFISH_256
:
390 if (digestlen
== qcrypto_cipher_get_key_len(
391 QCRYPTO_CIPHER_ALG_TWOFISH_128
)) {
392 return QCRYPTO_CIPHER_ALG_TWOFISH_128
;
393 } else if (digestlen
== qcrypto_cipher_get_key_len(
394 QCRYPTO_CIPHER_ALG_TWOFISH_192
)) {
395 return QCRYPTO_CIPHER_ALG_TWOFISH_192
;
396 } else if (digestlen
== qcrypto_cipher_get_key_len(
397 QCRYPTO_CIPHER_ALG_TWOFISH_256
)) {
398 return QCRYPTO_CIPHER_ALG_TWOFISH_256
;
400 error_setg(errp
, "No Twofish cipher with key size %zu available",
406 error_setg(errp
, "Cipher %s not supported with essiv",
407 QCryptoCipherAlgorithm_str(cipher
));
413 * Stores the main LUKS header, taking care of endianess
416 qcrypto_block_luks_store_header(QCryptoBlock
*block
,
417 QCryptoBlockWriteFunc writefunc
,
421 const QCryptoBlockLUKS
*luks
= block
->opaque
;
422 Error
*local_err
= NULL
;
424 g_autofree QCryptoBlockLUKSHeader
*hdr_copy
= NULL
;
426 /* Create a copy of the header */
427 hdr_copy
= g_new0(QCryptoBlockLUKSHeader
, 1);
428 memcpy(hdr_copy
, &luks
->header
, sizeof(QCryptoBlockLUKSHeader
));
431 * Everything on disk uses Big Endian (tm), so flip header fields
432 * before writing them
434 cpu_to_be16s(&hdr_copy
->version
);
435 cpu_to_be32s(&hdr_copy
->payload_offset_sector
);
436 cpu_to_be32s(&hdr_copy
->master_key_len
);
437 cpu_to_be32s(&hdr_copy
->master_key_iterations
);
439 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
440 cpu_to_be32s(&hdr_copy
->key_slots
[i
].active
);
441 cpu_to_be32s(&hdr_copy
->key_slots
[i
].iterations
);
442 cpu_to_be32s(&hdr_copy
->key_slots
[i
].key_offset_sector
);
443 cpu_to_be32s(&hdr_copy
->key_slots
[i
].stripes
);
446 /* Write out the partition header and key slot headers */
447 writefunc(block
, 0, (const uint8_t *)hdr_copy
, sizeof(*hdr_copy
),
451 error_propagate(errp
, local_err
);
458 * Loads the main LUKS header,and byteswaps it to native endianess
459 * And run basic sanity checks on it
462 qcrypto_block_luks_load_header(QCryptoBlock
*block
,
463 QCryptoBlockReadFunc readfunc
,
469 QCryptoBlockLUKS
*luks
= block
->opaque
;
472 * Read the entire LUKS header, minus the key material from
473 * the underlying device
475 rv
= readfunc(block
, 0,
476 (uint8_t *)&luks
->header
,
477 sizeof(luks
->header
),
485 * The header is always stored in big-endian format, so
486 * convert everything to native
488 be16_to_cpus(&luks
->header
.version
);
489 be32_to_cpus(&luks
->header
.payload_offset_sector
);
490 be32_to_cpus(&luks
->header
.master_key_len
);
491 be32_to_cpus(&luks
->header
.master_key_iterations
);
493 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
494 be32_to_cpus(&luks
->header
.key_slots
[i
].active
);
495 be32_to_cpus(&luks
->header
.key_slots
[i
].iterations
);
496 be32_to_cpus(&luks
->header
.key_slots
[i
].key_offset_sector
);
497 be32_to_cpus(&luks
->header
.key_slots
[i
].stripes
);
504 * Given a key slot, and user password, this will attempt to unlock
505 * the master encryption key from the key slot.
508 * 0 if the key slot is disabled, or key could not be decrypted
509 * with the provided password
510 * 1 if the key slot is enabled, and key decrypted successfully
511 * with the provided password
512 * -1 if a fatal error occurred loading the key
515 qcrypto_block_luks_load_key(QCryptoBlock
*block
,
517 const char *password
,
519 QCryptoBlockReadFunc readfunc
,
523 QCryptoBlockLUKS
*luks
= block
->opaque
;
524 const QCryptoBlockLUKSKeySlot
*slot
= &luks
->header
.key_slots
[slot_idx
];
525 g_autofree
uint8_t *splitkey
= NULL
;
527 g_autofree
uint8_t *possiblekey
= NULL
;
529 g_autoptr(QCryptoCipher
) cipher
= NULL
;
530 uint8_t keydigest
[QCRYPTO_BLOCK_LUKS_DIGEST_LEN
];
531 g_autoptr(QCryptoIVGen
) ivgen
= NULL
;
534 if (slot
->active
!= QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
) {
538 splitkeylen
= luks
->header
.master_key_len
* slot
->stripes
;
539 splitkey
= g_new0(uint8_t, splitkeylen
);
540 possiblekey
= g_new0(uint8_t, luks
->header
.master_key_len
);
543 * The user password is used to generate a (possible)
544 * decryption key. This may or may not successfully
545 * decrypt the master key - we just blindly assume
546 * the key is correct and validate the results of
549 if (qcrypto_pbkdf2(luks
->hash_alg
,
550 (const uint8_t *)password
, strlen(password
),
551 slot
->salt
, QCRYPTO_BLOCK_LUKS_SALT_LEN
,
553 possiblekey
, luks
->header
.master_key_len
,
559 * We need to read the master key material from the
560 * LUKS key material header. What we're reading is
561 * not the raw master key, but rather the data after
562 * it has been passed through AFSplit and the result
566 slot
->key_offset_sector
* QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
567 splitkey
, splitkeylen
,
575 /* Setup the cipher/ivgen that we'll use to try to decrypt
576 * the split master key material */
577 cipher
= qcrypto_cipher_new(luks
->cipher_alg
,
580 luks
->header
.master_key_len
,
586 niv
= qcrypto_cipher_get_iv_len(luks
->cipher_alg
,
589 ivgen
= qcrypto_ivgen_new(luks
->ivgen_alg
,
590 luks
->ivgen_cipher_alg
,
591 luks
->ivgen_hash_alg
,
593 luks
->header
.master_key_len
,
601 * The master key needs to be decrypted in the same
602 * way that the block device payload will be decrypted
603 * later. In particular we'll be using the IV generator
604 * to reset the encryption cipher every time the master
605 * key crosses a sector boundary.
607 if (qcrypto_block_cipher_decrypt_helper(cipher
,
610 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
619 * Now we've decrypted the split master key, join
620 * it back together to get the actual master key.
622 if (qcrypto_afsplit_decode(luks
->hash_alg
,
623 luks
->header
.master_key_len
,
633 * We still don't know that the masterkey we got is valid,
634 * because we just blindly assumed the user's password
635 * was correct. This is where we now verify it. We are
636 * creating a hash of the master key using PBKDF and
637 * then comparing that to the hash stored in the key slot
640 if (qcrypto_pbkdf2(luks
->hash_alg
,
642 luks
->header
.master_key_len
,
643 luks
->header
.master_key_salt
,
644 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
645 luks
->header
.master_key_iterations
,
647 G_N_ELEMENTS(keydigest
),
652 if (memcmp(keydigest
, luks
->header
.master_key_digest
,
653 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
) == 0) {
654 /* Success, we got the right master key */
658 /* Fail, user's password was not valid for this key slot,
659 * tell caller to try another slot */
665 * Given a user password, this will iterate over all key
666 * slots and try to unlock each active key slot using the
667 * password until it successfully obtains a master key.
669 * Returns 0 if a key was loaded, -1 if no keys could be loaded
672 qcrypto_block_luks_find_key(QCryptoBlock
*block
,
673 const char *password
,
675 QCryptoBlockReadFunc readfunc
,
682 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
683 rv
= qcrypto_block_luks_load_key(block
,
698 error_setg(errp
, "Invalid password, cannot unlock any keyslot");
705 qcrypto_block_luks_open(QCryptoBlock
*block
,
706 QCryptoBlockOpenOptions
*options
,
707 const char *optprefix
,
708 QCryptoBlockReadFunc readfunc
,
714 QCryptoBlockLUKS
*luks
= NULL
;
715 Error
*local_err
= NULL
;
716 g_autofree
uint8_t *masterkey
= NULL
;
717 char *ivgen_name
, *ivhash_name
;
718 g_autofree
char *password
= NULL
;
719 g_autofree
char *cipher_mode
= NULL
;
721 if (!(flags
& QCRYPTO_BLOCK_OPEN_NO_IO
)) {
722 if (!options
->u
.luks
.key_secret
) {
723 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
724 optprefix
? optprefix
: "");
727 password
= qcrypto_secret_lookup_as_utf8(
728 options
->u
.luks
.key_secret
, errp
);
734 luks
= g_new0(QCryptoBlockLUKS
, 1);
735 block
->opaque
= luks
;
737 if (qcrypto_block_luks_load_header(block
, readfunc
, opaque
, errp
) < 0) {
741 if (memcmp(luks
->header
.magic
, qcrypto_block_luks_magic
,
742 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
) != 0) {
743 error_setg(errp
, "Volume is not in LUKS format");
746 if (luks
->header
.version
!= QCRYPTO_BLOCK_LUKS_VERSION
) {
747 error_setg(errp
, "LUKS version %" PRIu32
" is not supported",
748 luks
->header
.version
);
752 cipher_mode
= g_strdup(luks
->header
.cipher_mode
);
755 * The cipher_mode header contains a string that we have
756 * to further parse, of the format
758 * <cipher-mode>-<iv-generator>[:<iv-hash>]
760 * eg cbc-essiv:sha256, cbc-plain64
762 ivgen_name
= strchr(cipher_mode
, '-');
764 error_setg(errp
, "Unexpected cipher mode string format %s",
771 ivhash_name
= strchr(ivgen_name
, ':');
773 luks
->ivgen_hash_alg
= 0;
778 luks
->ivgen_hash_alg
= qcrypto_block_luks_hash_name_lookup(ivhash_name
,
781 error_propagate(errp
, local_err
);
786 luks
->cipher_mode
= qcrypto_block_luks_cipher_mode_lookup(cipher_mode
,
789 error_propagate(errp
, local_err
);
794 qcrypto_block_luks_cipher_name_lookup(luks
->header
.cipher_name
,
796 luks
->header
.master_key_len
,
799 error_propagate(errp
, local_err
);
804 qcrypto_block_luks_hash_name_lookup(luks
->header
.hash_spec
,
807 error_propagate(errp
, local_err
);
811 luks
->ivgen_alg
= qcrypto_block_luks_ivgen_name_lookup(ivgen_name
,
814 error_propagate(errp
, local_err
);
818 if (luks
->ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
820 error_setg(errp
, "Missing IV generator hash specification");
823 luks
->ivgen_cipher_alg
=
824 qcrypto_block_luks_essiv_cipher(luks
->cipher_alg
,
825 luks
->ivgen_hash_alg
,
828 error_propagate(errp
, local_err
);
832 /* Note we parsed the ivhash_name earlier in the cipher_mode
833 * spec string even with plain/plain64 ivgens, but we
834 * will ignore it, since it is irrelevant for these ivgens.
835 * This is for compat with dm-crypt which will silently
836 * ignore hash names with these ivgens rather than report
837 * an error about the invalid usage
839 luks
->ivgen_cipher_alg
= luks
->cipher_alg
;
842 if (!(flags
& QCRYPTO_BLOCK_OPEN_NO_IO
)) {
843 /* Try to find which key slot our password is valid for
844 * and unlock the master key from that slot.
847 masterkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
849 if (qcrypto_block_luks_find_key(block
,
857 /* We have a valid master key now, so can setup the
858 * block device payload decryption objects
860 block
->kdfhash
= luks
->hash_alg
;
861 block
->niv
= qcrypto_cipher_get_iv_len(luks
->cipher_alg
,
864 block
->ivgen
= qcrypto_ivgen_new(luks
->ivgen_alg
,
865 luks
->ivgen_cipher_alg
,
866 luks
->ivgen_hash_alg
,
868 luks
->header
.master_key_len
,
874 if (qcrypto_block_init_cipher(block
,
878 luks
->header
.master_key_len
,
885 block
->sector_size
= QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
886 block
->payload_offset
= luks
->header
.payload_offset_sector
*
892 qcrypto_block_free_cipher(block
);
893 qcrypto_ivgen_free(block
->ivgen
);
900 qcrypto_block_luks_uuid_gen(uint8_t *uuidstr
)
903 qemu_uuid_generate(&uuid
);
904 qemu_uuid_unparse(&uuid
, (char *)uuidstr
);
908 qcrypto_block_luks_create(QCryptoBlock
*block
,
909 QCryptoBlockCreateOptions
*options
,
910 const char *optprefix
,
911 QCryptoBlockInitFunc initfunc
,
912 QCryptoBlockWriteFunc writefunc
,
916 QCryptoBlockLUKS
*luks
;
917 QCryptoBlockCreateOptionsLUKS luks_opts
;
918 Error
*local_err
= NULL
;
919 g_autofree
uint8_t *masterkey
= NULL
;
920 g_autofree
uint8_t *slotkey
= NULL
;
921 g_autofree
uint8_t *splitkey
= NULL
;
922 size_t splitkeylen
= 0;
924 g_autoptr(QCryptoCipher
) cipher
= NULL
;
925 g_autoptr(QCryptoIVGen
) ivgen
= NULL
;
926 g_autofree
char *password
= NULL
;
927 const char *cipher_alg
;
928 const char *cipher_mode
;
929 const char *ivgen_alg
;
930 const char *ivgen_hash_alg
= NULL
;
931 const char *hash_alg
;
932 g_autofree
char *cipher_mode_spec
= NULL
;
935 memcpy(&luks_opts
, &options
->u
.luks
, sizeof(luks_opts
));
936 if (!luks_opts
.has_iter_time
) {
937 luks_opts
.iter_time
= 2000;
939 if (!luks_opts
.has_cipher_alg
) {
940 luks_opts
.cipher_alg
= QCRYPTO_CIPHER_ALG_AES_256
;
942 if (!luks_opts
.has_cipher_mode
) {
943 luks_opts
.cipher_mode
= QCRYPTO_CIPHER_MODE_XTS
;
945 if (!luks_opts
.has_ivgen_alg
) {
946 luks_opts
.ivgen_alg
= QCRYPTO_IVGEN_ALG_PLAIN64
;
948 if (!luks_opts
.has_hash_alg
) {
949 luks_opts
.hash_alg
= QCRYPTO_HASH_ALG_SHA256
;
951 if (luks_opts
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
952 if (!luks_opts
.has_ivgen_hash_alg
) {
953 luks_opts
.ivgen_hash_alg
= QCRYPTO_HASH_ALG_SHA256
;
954 luks_opts
.has_ivgen_hash_alg
= true;
958 luks
= g_new0(QCryptoBlockLUKS
, 1);
959 block
->opaque
= luks
;
961 luks
->cipher_alg
= luks_opts
.cipher_alg
;
962 luks
->cipher_mode
= luks_opts
.cipher_mode
;
963 luks
->ivgen_alg
= luks_opts
.ivgen_alg
;
964 luks
->ivgen_hash_alg
= luks_opts
.ivgen_hash_alg
;
965 luks
->hash_alg
= luks_opts
.hash_alg
;
968 /* Note we're allowing ivgen_hash_alg to be set even for
969 * non-essiv iv generators that don't need a hash. It will
970 * be silently ignored, for compatibility with dm-crypt */
972 if (!options
->u
.luks
.key_secret
) {
973 error_setg(errp
, "Parameter '%skey-secret' is required for cipher",
974 optprefix
? optprefix
: "");
977 password
= qcrypto_secret_lookup_as_utf8(luks_opts
.key_secret
, errp
);
983 memcpy(luks
->header
.magic
, qcrypto_block_luks_magic
,
984 QCRYPTO_BLOCK_LUKS_MAGIC_LEN
);
986 /* We populate the header in native endianness initially and
987 * then convert everything to big endian just before writing
990 luks
->header
.version
= QCRYPTO_BLOCK_LUKS_VERSION
;
991 qcrypto_block_luks_uuid_gen(luks
->header
.uuid
);
993 cipher_alg
= qcrypto_block_luks_cipher_alg_lookup(luks_opts
.cipher_alg
,
999 cipher_mode
= QCryptoCipherMode_str(luks_opts
.cipher_mode
);
1000 ivgen_alg
= QCryptoIVGenAlgorithm_str(luks_opts
.ivgen_alg
);
1001 if (luks_opts
.has_ivgen_hash_alg
) {
1002 ivgen_hash_alg
= QCryptoHashAlgorithm_str(luks_opts
.ivgen_hash_alg
);
1003 cipher_mode_spec
= g_strdup_printf("%s-%s:%s", cipher_mode
, ivgen_alg
,
1006 cipher_mode_spec
= g_strdup_printf("%s-%s", cipher_mode
, ivgen_alg
);
1008 hash_alg
= QCryptoHashAlgorithm_str(luks_opts
.hash_alg
);
1011 if (strlen(cipher_alg
) >= QCRYPTO_BLOCK_LUKS_CIPHER_NAME_LEN
) {
1012 error_setg(errp
, "Cipher name '%s' is too long for LUKS header",
1016 if (strlen(cipher_mode_spec
) >= QCRYPTO_BLOCK_LUKS_CIPHER_MODE_LEN
) {
1017 error_setg(errp
, "Cipher mode '%s' is too long for LUKS header",
1021 if (strlen(hash_alg
) >= QCRYPTO_BLOCK_LUKS_HASH_SPEC_LEN
) {
1022 error_setg(errp
, "Hash name '%s' is too long for LUKS header",
1027 if (luks_opts
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
1028 luks
->ivgen_cipher_alg
=
1029 qcrypto_block_luks_essiv_cipher(luks_opts
.cipher_alg
,
1030 luks_opts
.ivgen_hash_alg
,
1033 error_propagate(errp
, local_err
);
1037 luks
->ivgen_cipher_alg
= luks_opts
.cipher_alg
;
1040 strcpy(luks
->header
.cipher_name
, cipher_alg
);
1041 strcpy(luks
->header
.cipher_mode
, cipher_mode_spec
);
1042 strcpy(luks
->header
.hash_spec
, hash_alg
);
1044 luks
->header
.master_key_len
=
1045 qcrypto_cipher_get_key_len(luks_opts
.cipher_alg
);
1047 if (luks_opts
.cipher_mode
== QCRYPTO_CIPHER_MODE_XTS
) {
1048 luks
->header
.master_key_len
*= 2;
1051 /* Generate the salt used for hashing the master key
1054 if (qcrypto_random_bytes(luks
->header
.master_key_salt
,
1055 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1060 /* Generate random master key */
1061 masterkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
1062 if (qcrypto_random_bytes(masterkey
,
1063 luks
->header
.master_key_len
, errp
) < 0) {
1068 /* Setup the block device payload encryption objects */
1069 if (qcrypto_block_init_cipher(block
, luks_opts
.cipher_alg
,
1070 luks_opts
.cipher_mode
, masterkey
,
1071 luks
->header
.master_key_len
, 1, errp
) < 0) {
1075 block
->kdfhash
= luks_opts
.hash_alg
;
1076 block
->niv
= qcrypto_cipher_get_iv_len(luks_opts
.cipher_alg
,
1077 luks_opts
.cipher_mode
);
1078 block
->ivgen
= qcrypto_ivgen_new(luks_opts
.ivgen_alg
,
1079 luks
->ivgen_cipher_alg
,
1080 luks_opts
.ivgen_hash_alg
,
1081 masterkey
, luks
->header
.master_key_len
,
1084 if (!block
->ivgen
) {
1089 /* Determine how many iterations we need to hash the master
1090 * key, in order to have 1 second of compute time used
1092 iters
= qcrypto_pbkdf2_count_iters(luks_opts
.hash_alg
,
1093 masterkey
, luks
->header
.master_key_len
,
1094 luks
->header
.master_key_salt
,
1095 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1096 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
,
1099 error_propagate(errp
, local_err
);
1103 if (iters
> (ULLONG_MAX
/ luks_opts
.iter_time
)) {
1104 error_setg_errno(errp
, ERANGE
,
1105 "PBKDF iterations %llu too large to scale",
1106 (unsigned long long)iters
);
1110 /* iter_time was in millis, but count_iters reported for secs */
1111 iters
= iters
* luks_opts
.iter_time
/ 1000;
1113 /* Why /= 8 ? That matches cryptsetup, but there's no
1114 * explanation why they chose /= 8... Probably so that
1115 * if all 8 keyslots are active we only spend 1 second
1116 * in total time to check all keys */
1118 if (iters
> UINT32_MAX
) {
1119 error_setg_errno(errp
, ERANGE
,
1120 "PBKDF iterations %llu larger than %u",
1121 (unsigned long long)iters
, UINT32_MAX
);
1124 iters
= MAX(iters
, QCRYPTO_BLOCK_LUKS_MIN_MASTER_KEY_ITERS
);
1125 luks
->header
.master_key_iterations
= iters
;
1127 /* Hash the master key, saving the result in the LUKS
1128 * header. This hash is used when opening the encrypted
1129 * device to verify that the user password unlocked a
1132 if (qcrypto_pbkdf2(luks_opts
.hash_alg
,
1133 masterkey
, luks
->header
.master_key_len
,
1134 luks
->header
.master_key_salt
,
1135 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1136 luks
->header
.master_key_iterations
,
1137 luks
->header
.master_key_digest
,
1138 QCRYPTO_BLOCK_LUKS_DIGEST_LEN
,
1144 /* Although LUKS has multiple key slots, we're just going
1145 * to use the first key slot */
1146 splitkeylen
= luks
->header
.master_key_len
* QCRYPTO_BLOCK_LUKS_STRIPES
;
1147 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1148 luks
->header
.key_slots
[i
].active
= i
== 0 ?
1149 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
:
1150 QCRYPTO_BLOCK_LUKS_KEY_SLOT_DISABLED
;
1151 luks
->header
.key_slots
[i
].stripes
= QCRYPTO_BLOCK_LUKS_STRIPES
;
1153 /* This calculation doesn't match that shown in the spec,
1154 * but instead follows the cryptsetup implementation.
1156 luks
->header
.key_slots
[i
].key_offset_sector
=
1157 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1158 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
) +
1159 (ROUND_UP(DIV_ROUND_UP(splitkeylen
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
),
1160 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1161 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
)) * i
);
1164 if (qcrypto_random_bytes(luks
->header
.key_slots
[0].salt
,
1165 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1170 /* Again we determine how many iterations are required to
1171 * hash the user password while consuming 1 second of compute
1173 iters
= qcrypto_pbkdf2_count_iters(luks_opts
.hash_alg
,
1174 (uint8_t *)password
, strlen(password
),
1175 luks
->header
.key_slots
[0].salt
,
1176 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1177 luks
->header
.master_key_len
,
1180 error_propagate(errp
, local_err
);
1184 if (iters
> (ULLONG_MAX
/ luks_opts
.iter_time
)) {
1185 error_setg_errno(errp
, ERANGE
,
1186 "PBKDF iterations %llu too large to scale",
1187 (unsigned long long)iters
);
1191 /* iter_time was in millis, but count_iters reported for secs */
1192 iters
= iters
* luks_opts
.iter_time
/ 1000;
1194 if (iters
> UINT32_MAX
) {
1195 error_setg_errno(errp
, ERANGE
,
1196 "PBKDF iterations %llu larger than %u",
1197 (unsigned long long)iters
, UINT32_MAX
);
1201 luks
->header
.key_slots
[0].iterations
=
1202 MAX(iters
, QCRYPTO_BLOCK_LUKS_MIN_SLOT_KEY_ITERS
);
1205 /* Generate a key that we'll use to encrypt the master
1206 * key, from the user's password
1208 slotkey
= g_new0(uint8_t, luks
->header
.master_key_len
);
1209 if (qcrypto_pbkdf2(luks_opts
.hash_alg
,
1210 (uint8_t *)password
, strlen(password
),
1211 luks
->header
.key_slots
[0].salt
,
1212 QCRYPTO_BLOCK_LUKS_SALT_LEN
,
1213 luks
->header
.key_slots
[0].iterations
,
1214 slotkey
, luks
->header
.master_key_len
,
1220 /* Setup the encryption objects needed to encrypt the
1221 * master key material
1223 cipher
= qcrypto_cipher_new(luks_opts
.cipher_alg
,
1224 luks_opts
.cipher_mode
,
1225 slotkey
, luks
->header
.master_key_len
,
1231 ivgen
= qcrypto_ivgen_new(luks_opts
.ivgen_alg
,
1232 luks
->ivgen_cipher_alg
,
1233 luks_opts
.ivgen_hash_alg
,
1234 slotkey
, luks
->header
.master_key_len
,
1240 /* Before storing the master key, we need to vastly
1241 * increase its size, as protection against forensic
1242 * disk data recovery */
1243 splitkey
= g_new0(uint8_t, splitkeylen
);
1245 if (qcrypto_afsplit_encode(luks_opts
.hash_alg
,
1246 luks
->header
.master_key_len
,
1247 luks
->header
.key_slots
[0].stripes
,
1254 /* Now we encrypt the split master key with the key generated
1255 * from the user's password, before storing it */
1256 if (qcrypto_block_cipher_encrypt_helper(cipher
, block
->niv
, ivgen
,
1257 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1266 /* The total size of the LUKS headers is the partition header + key
1267 * slot headers, rounded up to the nearest sector, combined with
1268 * the size of each master key material region, also rounded up
1269 * to the nearest sector */
1270 luks
->header
.payload_offset_sector
=
1271 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1272 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
) +
1273 (ROUND_UP(DIV_ROUND_UP(splitkeylen
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
),
1274 (QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET
/
1275 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
)) *
1276 QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
);
1278 block
->sector_size
= QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
1279 block
->payload_offset
= luks
->header
.payload_offset_sector
*
1282 /* Reserve header space to match payload offset */
1283 initfunc(block
, block
->payload_offset
, opaque
, &local_err
);
1285 error_propagate(errp
, local_err
);
1289 if (qcrypto_block_luks_store_header(block
, writefunc
, opaque
, errp
) < 0) {
1293 /* Write out the master key material, starting at the
1294 * sector immediately following the partition header. */
1295 if (writefunc(block
,
1296 luks
->header
.key_slots
[0].key_offset_sector
*
1297 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1298 splitkey
, splitkeylen
,
1300 errp
) != splitkeylen
) {
1304 memset(masterkey
, 0, luks
->header
.master_key_len
);
1305 memset(slotkey
, 0, luks
->header
.master_key_len
);
1311 memset(masterkey
, 0, luks
->header
.master_key_len
);
1314 memset(slotkey
, 0, luks
->header
.master_key_len
);
1317 qcrypto_block_free_cipher(block
);
1318 qcrypto_ivgen_free(block
->ivgen
);
1325 static int qcrypto_block_luks_get_info(QCryptoBlock
*block
,
1326 QCryptoBlockInfo
*info
,
1329 QCryptoBlockLUKS
*luks
= block
->opaque
;
1330 QCryptoBlockInfoLUKSSlot
*slot
;
1331 QCryptoBlockInfoLUKSSlotList
*slots
= NULL
, **prev
= &info
->u
.luks
.slots
;
1334 info
->u
.luks
.cipher_alg
= luks
->cipher_alg
;
1335 info
->u
.luks
.cipher_mode
= luks
->cipher_mode
;
1336 info
->u
.luks
.ivgen_alg
= luks
->ivgen_alg
;
1337 if (info
->u
.luks
.ivgen_alg
== QCRYPTO_IVGEN_ALG_ESSIV
) {
1338 info
->u
.luks
.has_ivgen_hash_alg
= true;
1339 info
->u
.luks
.ivgen_hash_alg
= luks
->ivgen_hash_alg
;
1341 info
->u
.luks
.hash_alg
= luks
->hash_alg
;
1342 info
->u
.luks
.payload_offset
= block
->payload_offset
;
1343 info
->u
.luks
.master_key_iters
= luks
->header
.master_key_iterations
;
1344 info
->u
.luks
.uuid
= g_strndup((const char *)luks
->header
.uuid
,
1345 sizeof(luks
->header
.uuid
));
1347 for (i
= 0; i
< QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS
; i
++) {
1348 slots
= g_new0(QCryptoBlockInfoLUKSSlotList
, 1);
1351 slots
->value
= slot
= g_new0(QCryptoBlockInfoLUKSSlot
, 1);
1352 slot
->active
= luks
->header
.key_slots
[i
].active
==
1353 QCRYPTO_BLOCK_LUKS_KEY_SLOT_ENABLED
;
1354 slot
->key_offset
= luks
->header
.key_slots
[i
].key_offset_sector
1355 * QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
;
1357 slot
->has_iters
= true;
1358 slot
->iters
= luks
->header
.key_slots
[i
].iterations
;
1359 slot
->has_stripes
= true;
1360 slot
->stripes
= luks
->header
.key_slots
[i
].stripes
;
1363 prev
= &slots
->next
;
1370 static void qcrypto_block_luks_cleanup(QCryptoBlock
*block
)
1372 g_free(block
->opaque
);
1377 qcrypto_block_luks_decrypt(QCryptoBlock
*block
,
1383 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1384 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1385 return qcrypto_block_decrypt_helper(block
,
1386 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1387 offset
, buf
, len
, errp
);
1392 qcrypto_block_luks_encrypt(QCryptoBlock
*block
,
1398 assert(QEMU_IS_ALIGNED(offset
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1399 assert(QEMU_IS_ALIGNED(len
, QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
));
1400 return qcrypto_block_encrypt_helper(block
,
1401 QCRYPTO_BLOCK_LUKS_SECTOR_SIZE
,
1402 offset
, buf
, len
, errp
);
1406 const QCryptoBlockDriver qcrypto_block_driver_luks
= {
1407 .open
= qcrypto_block_luks_open
,
1408 .create
= qcrypto_block_luks_create
,
1409 .get_info
= qcrypto_block_luks_get_info
,
1410 .cleanup
= qcrypto_block_luks_cleanup
,
1411 .decrypt
= qcrypto_block_luks_decrypt
,
1412 .encrypt
= qcrypto_block_luks_encrypt
,
1413 .has_format
= qcrypto_block_luks_has_format
,