a425a70b26
Add a new per-file key derivation method to ext4 encryption defined as:
derived_key[0:127] = AES-256-ENCRYPT(master_key[0:255], nonce)
derived_key[128:255] = AES-256-ENCRYPT(master_key[0:255], nonce ^ 0x01)
derived_key[256:383] = AES-256-ENCRYPT(master_key[256:511], nonce)
derived_key[384:511] = AES-256-ENCRYPT(master_key[256:511], nonce ^ 0x01)
... where the derived key and master key are both 512 bits, the nonce is
128 bits, AES-256-ENCRYPT takes the arguments (key, plaintext), and
'nonce ^ 0x01' denotes flipping the low order bit of the last byte.
The existing key derivation method is
'derived_key = AES-128-ECB-ENCRYPT(key=nonce, plaintext=master_key)'.
We want to make this change because currently, given a derived key you
can easily compute the master key by computing
'AES-128-ECB-DECRYPT(key=nonce, ciphertext=derived_key)'.
This was formerly OK because the previous threat model assumed that the
master key and derived keys are equally hard to obtain by an attacker.
However, we are looking to move the master key into secure hardware in
some cases, so we want to make sure that an attacker with access to a
derived key cannot compute the master key.
We are doing this instead of increasing the nonce to 512 bits because
it's important that the per-file xattr fit in the inode itself. By
default, inodes are 256 bytes, and on Android we're already pretty close
to that limit. If we increase the nonce size, we end up allocating a new
filesystem block for each and every encrypted file, which has a
substantial performance and disk utilization impact.
Another option considered was to use the HMAC-SHA512 of the nonce, keyed
by the master key. However this would be a little less performant,
would be less extensible to other key sizes and MAC algorithms, and
would pull in a dependency (security-wise and code-wise) on SHA-512.
Due to the use of "aes" rather than "ecb(aes)" in the implementation,
the new key derivation method is actually about twice as fast as the old
one, though the old one could be optimized similarly as well.
This patch makes the new key derivation method be used whenever HEH is
used to encrypt filenames. Although these two features are logically
independent, it was decided to bundle them together for now. Note that
neither feature is upstream yet, and it cannot be guaranteed that the
on-disk format won't change if/when these features are upstreamed. For
this reason, and as noted in the previous patch, the features are both
behind a special mode number for now.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Change-Id: Iee4113f57e59dc8c0b7dc5238d7003c83defb986
163 lines
4.1 KiB
C
163 lines
4.1 KiB
C
/*
|
|
* linux/fs/ext4/ext4_crypto.h
|
|
*
|
|
* Copyright (C) 2015, Google, Inc.
|
|
*
|
|
* This contains encryption header content for ext4
|
|
*
|
|
* Written by Michael Halcrow, 2015.
|
|
*/
|
|
|
|
#ifndef _EXT4_CRYPTO_H
|
|
#define _EXT4_CRYPTO_H
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#define EXT4_KEY_DESCRIPTOR_SIZE 8
|
|
|
|
/* Policy provided via an ioctl on the topmost directory */
|
|
struct ext4_encryption_policy {
|
|
char version;
|
|
char contents_encryption_mode;
|
|
char filenames_encryption_mode;
|
|
char flags;
|
|
char master_key_descriptor[EXT4_KEY_DESCRIPTOR_SIZE];
|
|
} __attribute__((__packed__));
|
|
|
|
#define EXT4_ENCRYPTION_CONTEXT_FORMAT_V1 1
|
|
#define EXT4_KEY_DERIVATION_NONCE_SIZE 16
|
|
|
|
#define EXT4_POLICY_FLAGS_PAD_4 0x00
|
|
#define EXT4_POLICY_FLAGS_PAD_8 0x01
|
|
#define EXT4_POLICY_FLAGS_PAD_16 0x02
|
|
#define EXT4_POLICY_FLAGS_PAD_32 0x03
|
|
#define EXT4_POLICY_FLAGS_PAD_MASK 0x03
|
|
#define EXT4_POLICY_FLAGS_VALID 0x03
|
|
|
|
/**
|
|
* Encryption context for inode
|
|
*
|
|
* Protector format:
|
|
* 1 byte: Protector format (1 = this version)
|
|
* 1 byte: File contents encryption mode
|
|
* 1 byte: File names encryption mode
|
|
* 1 byte: Reserved
|
|
* 8 bytes: Master Key descriptor
|
|
* 16 bytes: Encryption Key derivation nonce
|
|
*/
|
|
struct ext4_encryption_context {
|
|
char format;
|
|
char contents_encryption_mode;
|
|
char filenames_encryption_mode;
|
|
char flags;
|
|
char master_key_descriptor[EXT4_KEY_DESCRIPTOR_SIZE];
|
|
char nonce[EXT4_KEY_DERIVATION_NONCE_SIZE];
|
|
} __attribute__((__packed__));
|
|
|
|
/* Encryption parameters */
|
|
#define EXT4_XTS_TWEAK_SIZE 16
|
|
#define EXT4_AES_128_ECB_KEY_SIZE 16
|
|
#define EXT4_AES_256_GCM_KEY_SIZE 32
|
|
#define EXT4_AES_256_ECB_KEY_SIZE 32
|
|
#define EXT4_AES_256_CBC_KEY_SIZE 32
|
|
#define EXT4_AES_256_CTS_KEY_SIZE 32
|
|
#define EXT4_AES_256_HEH_KEY_SIZE 32
|
|
#define EXT4_AES_256_XTS_KEY_SIZE 64
|
|
#define EXT4_MAX_KEY_SIZE 64
|
|
|
|
#define EXT4_KEY_DESC_PREFIX "ext4:"
|
|
#define EXT4_KEY_DESC_PREFIX_SIZE 5
|
|
|
|
/* This is passed in from userspace into the kernel keyring */
|
|
struct ext4_encryption_key {
|
|
__u32 mode;
|
|
char raw[EXT4_MAX_KEY_SIZE];
|
|
__u32 size;
|
|
} __attribute__((__packed__));
|
|
|
|
struct ext4_crypt_info {
|
|
char ci_data_mode;
|
|
char ci_filename_mode;
|
|
char ci_flags;
|
|
struct crypto_ablkcipher *ci_ctfm;
|
|
struct key *ci_keyring_key;
|
|
char ci_master_key[EXT4_KEY_DESCRIPTOR_SIZE];
|
|
};
|
|
|
|
#define EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL 0x00000001
|
|
#define EXT4_WRITE_PATH_FL 0x00000002
|
|
|
|
struct ext4_crypto_ctx {
|
|
union {
|
|
struct {
|
|
struct page *bounce_page; /* Ciphertext page */
|
|
struct page *control_page; /* Original page */
|
|
} w;
|
|
struct {
|
|
struct bio *bio;
|
|
struct work_struct work;
|
|
} r;
|
|
struct list_head free_list; /* Free list */
|
|
};
|
|
char flags; /* Flags */
|
|
char mode; /* Encryption mode for tfm */
|
|
};
|
|
|
|
struct ext4_completion_result {
|
|
struct completion completion;
|
|
int res;
|
|
};
|
|
|
|
#define DECLARE_EXT4_COMPLETION_RESULT(ecr) \
|
|
struct ext4_completion_result ecr = { \
|
|
COMPLETION_INITIALIZER((ecr).completion), 0 }
|
|
|
|
static inline int ext4_encryption_key_size(int mode)
|
|
{
|
|
switch (mode) {
|
|
case EXT4_ENCRYPTION_MODE_AES_256_XTS:
|
|
return EXT4_AES_256_XTS_KEY_SIZE;
|
|
case EXT4_ENCRYPTION_MODE_AES_256_GCM:
|
|
return EXT4_AES_256_GCM_KEY_SIZE;
|
|
case EXT4_ENCRYPTION_MODE_AES_256_CBC:
|
|
return EXT4_AES_256_CBC_KEY_SIZE;
|
|
case EXT4_ENCRYPTION_MODE_AES_256_CTS:
|
|
return EXT4_AES_256_CTS_KEY_SIZE;
|
|
case EXT4_ENCRYPTION_MODE_AES_256_HEH:
|
|
return EXT4_AES_256_HEH_KEY_SIZE;
|
|
default:
|
|
BUG();
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
#define EXT4_FNAME_NUM_SCATTER_ENTRIES 4
|
|
#define EXT4_CRYPTO_BLOCK_SIZE 16
|
|
#define EXT4_FNAME_CRYPTO_DIGEST_SIZE 32
|
|
|
|
struct ext4_str {
|
|
unsigned char *name;
|
|
u32 len;
|
|
};
|
|
|
|
/**
|
|
* For encrypted symlinks, the ciphertext length is stored at the beginning
|
|
* of the string in little-endian format.
|
|
*/
|
|
struct ext4_encrypted_symlink_data {
|
|
__le16 len;
|
|
char encrypted_path[1];
|
|
} __attribute__((__packed__));
|
|
|
|
/**
|
|
* This function is used to calculate the disk space required to
|
|
* store a filename of length l in encrypted symlink format.
|
|
*/
|
|
static inline u32 encrypted_symlink_data_len(u32 l)
|
|
{
|
|
if (l < EXT4_CRYPTO_BLOCK_SIZE)
|
|
l = EXT4_CRYPTO_BLOCK_SIZE;
|
|
return (l + sizeof(struct ext4_encrypted_symlink_data) - 1);
|
|
}
|
|
|
|
#endif /* _EXT4_CRYPTO_H */
|