encrypted-keys: add ecryptfs format support (79a73d18) · Commits · e / devices / android_kernel_fairphone_FP3

Documentation/keys-ecryptfs.txt

0 → 100644

+68 −0

Original line number	Diff line number	Diff line
		Encrypted keys for the eCryptfs filesystem

		ECryptfs is a stacked filesystem which transparently encrypts and decrypts each
		file using a randomly generated File Encryption Key (FEK).

		Each FEK is in turn encrypted with a File Encryption Key Encryption Key (FEFEK)
		either in kernel space or in user space with a daemon called 'ecryptfsd'. In
		the former case the operation is performed directly by the kernel CryptoAPI
		using a key, the FEFEK, derived from a user prompted passphrase; in the latter
		the FEK is encrypted by 'ecryptfsd' with the help of external libraries in order
		to support other mechanisms like public key cryptography, PKCS#11 and TPM based
		operations.

		The data structure defined by eCryptfs to contain information required for the
		FEK decryption is called authentication token and, currently, can be stored in a
		kernel key of the 'user' type, inserted in the user's session specific keyring
		by the userspace utility 'mount.ecryptfs' shipped with the package
		'ecryptfs-utils'.

		The 'encrypted' key type has been extended with the introduction of the new
		format 'ecryptfs' in order to be used in conjunction with the eCryptfs
		filesystem. Encrypted keys of the newly introduced format store an
		authentication token in its payload with a FEFEK randomly generated by the
		kernel and protected by the parent master key.

		In order to avoid known-plaintext attacks, the datablob obtained through
		commands 'keyctl print' or 'keyctl pipe' does not contain the overall
		authentication token, which content is well known, but only the FEFEK in
		encrypted form.

		The eCryptfs filesystem may really benefit from using encrypted keys in that the
		required key can be securely generated by an Administrator and provided at boot
		time after the unsealing of a 'trusted' key in order to perform the mount in a
		controlled environment. Another advantage is that the key is not exposed to
		threats of malicious software, because it is available in clear form only at
		kernel level.

		Usage:
		keyctl add encrypted name "new ecryptfs key-type:master-key-name keylen" ring
		keyctl add encrypted name "load hex_blob" ring
		keyctl update keyid "update key-type:master-key-name"

		name:= '<16 hexadecimal characters>'
		key-type:= 'trusted' \| 'user'
		keylen:= 64


		Example of encrypted key usage with the eCryptfs filesystem:

		Create an encrypted key "1000100010001000" of length 64 bytes with format
		'ecryptfs' and save it using a previously loaded user key "test":

		$ keyctl add encrypted 1000100010001000 "new ecryptfs user:test 64" @u
		19184530

		$ keyctl print 19184530
		ecryptfs user:test 64 490045d4bfe48c99f0d465fbbbb79e7500da954178e2de0697
		dd85091f5450a0511219e9f7cd70dcd498038181466f78ac8d4c19504fcc72402bfc41c2
		f253a41b7507ccaa4b2b03fff19a69d1cc0b16e71746473f023a95488b6edfd86f7fdd40
		9d292e4bacded1258880122dd553a661

		$ keyctl pipe 19184530 > ecryptfs.blob

		Mount an eCryptfs filesystem using the created encrypted key "1000100010001000"
		into the '/secret' directory:

		$ mount -i -t ecryptfs -oecryptfs_sig=1000100010001000,\
		ecryptfs_cipher=aes,ecryptfs_key_bytes=32 /secret /secret

Documentation/security/keys-trusted-encrypted.txt

+4 −2

Original line number	Diff line number	Diff line
		@@ -63,7 +63,7 @@ Usage:
		keyctl add encrypted name "load hex_blob" ring
		keyctl update keyid "update key-type:master-key-name"

		format:= 'default'
		format:= 'default \| ecryptfs'
		key-type:= 'trusted' \| 'user'


		@@ -154,4 +154,6 @@ Load an encrypted key "evm" from saved blob:
		24717c64 5972dcb82ab2dde83376d82b2e3c09ffc

		Other uses for trusted and encrypted keys, such as for disk and file encryption
		are anticipated.
		are anticipated. In particular the new format 'ecryptfs' has been defined in
		in order to use encrypted keys to mount an eCryptfs filesystem. More details
		about the usage can be found in the file 'Documentation/keys-ecryptfs.txt'.

security/keys/Makefile

+1 −1

Original line number	Diff line number	Diff line
		@@ -14,7 +14,7 @@ obj-y := \
		user_defined.o

		obj-$(CONFIG_TRUSTED_KEYS) += trusted.o
		obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted.o
		obj-$(CONFIG_ENCRYPTED_KEYS) += ecryptfs_format.o encrypted.o
		obj-$(CONFIG_KEYS_COMPAT) += compat.o
		obj-$(CONFIG_PROC_FS) += proc.o
		obj-$(CONFIG_SYSCTL) += sysctl.o

security/keys/ecryptfs_format.c

0 → 100644

+81 −0

Original line number	Diff line number	Diff line
		/*
		* ecryptfs_format.c: helper functions for the encrypted key type
		*
		* Copyright (C) 2006 International Business Machines Corp.
		* Copyright (C) 2010 Politecnico di Torino, Italy
		* TORSEC group -- http://security.polito.it
		*
		* Authors:
		* Michael A. Halcrow <mahalcro@us.ibm.com>
		* Tyler Hicks <tyhicks@ou.edu>
		* Roberto Sassu <roberto.sassu@polito.it>
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License as published by
		* the Free Software Foundation, version 2 of the License.
		*/

		#include <linux/module.h>
		#include "ecryptfs_format.h"

		u8 ecryptfs_get_auth_tok_key(struct ecryptfs_auth_tok auth_tok)
		{
		return auth_tok->token.password.session_key_encryption_key;
		}
		EXPORT_SYMBOL(ecryptfs_get_auth_tok_key);

		/*
		* ecryptfs_get_versions()
		*
		* Source code taken from the software 'ecryptfs-utils' version 83.
		*
		*/
		void ecryptfs_get_versions(int major, int minor, int *file_version)
		{
		*major = ECRYPTFS_VERSION_MAJOR;
		*minor = ECRYPTFS_VERSION_MINOR;
		if (file_version)
		*file_version = ECRYPTFS_SUPPORTED_FILE_VERSION;
		}
		EXPORT_SYMBOL(ecryptfs_get_versions);

		/*
		* ecryptfs_fill_auth_tok - fill the ecryptfs_auth_tok structure
		*
		* Fill the ecryptfs_auth_tok structure with required ecryptfs data.
		* The source code is inspired to the original function generate_payload()
		* shipped with the software 'ecryptfs-utils' version 83.
		*
		*/
		int ecryptfs_fill_auth_tok(struct ecryptfs_auth_tok *auth_tok,
		const char *key_desc)
		{
		int major, minor;

		ecryptfs_get_versions(&major, &minor, NULL);
		auth_tok->version = (((uint16_t)(major << 8) & 0xFF00)
		\| ((uint16_t)minor & 0x00FF));
		auth_tok->token_type = ECRYPTFS_PASSWORD;
		strncpy((char *)auth_tok->token.password.signature, key_desc,
		ECRYPTFS_PASSWORD_SIG_SIZE);
		auth_tok->token.password.session_key_encryption_key_bytes =
		ECRYPTFS_MAX_KEY_BYTES;
		/*
		* Removed auth_tok->token.password.salt and
		* auth_tok->token.password.session_key_encryption_key
		* initialization from the original code
		*/
		/* TODO: Make the hash parameterizable via policy */
		auth_tok->token.password.flags \|=
		ECRYPTFS_SESSION_KEY_ENCRYPTION_KEY_SET;
		/* The kernel code will encrypt the session key. */
		auth_tok->session_key.encrypted_key[0] = 0;
		auth_tok->session_key.encrypted_key_size = 0;
		/* Default; subject to change by kernel eCryptfs */
		auth_tok->token.password.hash_algo = PGP_DIGEST_ALGO_SHA512;
		auth_tok->token.password.flags &= ~(ECRYPTFS_PERSISTENT_PASSWORD);
		return 0;
		}
		EXPORT_SYMBOL(ecryptfs_fill_auth_tok);

		MODULE_LICENSE("GPL");

security/keys/ecryptfs_format.h

0 → 100644

+30 −0

Original line number	Diff line number	Diff line
		/*
		* ecryptfs_format.h: helper functions for the encrypted key type
		*
		* Copyright (C) 2006 International Business Machines Corp.
		* Copyright (C) 2010 Politecnico di Torino, Italy
		* TORSEC group -- http://security.polito.it
		*
		* Authors:
		* Michael A. Halcrow <mahalcro@us.ibm.com>
		* Tyler Hicks <tyhicks@ou.edu>
		* Roberto Sassu <roberto.sassu@polito.it>
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License as published by
		* the Free Software Foundation, version 2 of the License.
		*/

		#ifndef __KEYS_ECRYPTFS_H
		#define __KEYS_ECRYPTFS_H

		#include <linux/ecryptfs.h>

		#define PGP_DIGEST_ALGO_SHA512 10

		u8 ecryptfs_get_auth_tok_key(struct ecryptfs_auth_tok auth_tok);
		void ecryptfs_get_versions(int major, int minor, int *file_version);
		int ecryptfs_fill_auth_tok(struct ecryptfs_auth_tok *auth_tok,
		const char *key_desc);

		#endif /* __KEYS_ECRYPTFS_H */