1 // SPDX-License-Identifier: GPL-2.0
3 * key management facility for FS encryption support.
5 * Copyright (C) 2015, Google, Inc.
7 * This contains encryption key functions.
9 * Written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar, 2015.
12 #include <keys/user-type.h>
13 #include <linux/hashtable.h>
14 #include <linux/scatterlist.h>
15 #include <crypto/aes.h>
16 #include <crypto/algapi.h>
17 #include <crypto/sha.h>
18 #include <crypto/skcipher.h>
19 #include "fscrypt_private.h"
21 static struct crypto_shash
*essiv_hash_tfm
;
23 /* Table of keys referenced by FS_POLICY_FLAG_DIRECT_KEY policies */
24 static DEFINE_HASHTABLE(fscrypt_master_keys
, 6); /* 6 bits = 64 buckets */
25 static DEFINE_SPINLOCK(fscrypt_master_keys_lock
);
28 * Key derivation function. This generates the derived key by encrypting the
29 * master key with AES-128-ECB using the inode's nonce as the AES key.
31 * The master key must be at least as long as the derived key. If the master
32 * key is longer, then only the first 'derived_keysize' bytes are used.
34 static int derive_key_aes(const u8
*master_key
,
35 const struct fscrypt_context
*ctx
,
36 u8
*derived_key
, unsigned int derived_keysize
)
39 struct skcipher_request
*req
= NULL
;
40 DECLARE_CRYPTO_WAIT(wait
);
41 struct scatterlist src_sg
, dst_sg
;
42 struct crypto_skcipher
*tfm
= crypto_alloc_skcipher("ecb(aes)", 0, 0);
49 crypto_skcipher_set_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
50 req
= skcipher_request_alloc(tfm
, GFP_NOFS
);
55 skcipher_request_set_callback(req
,
56 CRYPTO_TFM_REQ_MAY_BACKLOG
| CRYPTO_TFM_REQ_MAY_SLEEP
,
57 crypto_req_done
, &wait
);
58 res
= crypto_skcipher_setkey(tfm
, ctx
->nonce
, sizeof(ctx
->nonce
));
62 sg_init_one(&src_sg
, master_key
, derived_keysize
);
63 sg_init_one(&dst_sg
, derived_key
, derived_keysize
);
64 skcipher_request_set_crypt(req
, &src_sg
, &dst_sg
, derived_keysize
,
66 res
= crypto_wait_req(crypto_skcipher_encrypt(req
), &wait
);
68 skcipher_request_free(req
);
69 crypto_free_skcipher(tfm
);
74 * Search the current task's subscribed keyrings for a "logon" key with
75 * description prefix:descriptor, and if found acquire a read lock on it and
76 * return a pointer to its validated payload in *payload_ret.
79 find_and_lock_process_key(const char *prefix
,
80 const u8 descriptor
[FS_KEY_DESCRIPTOR_SIZE
],
81 unsigned int min_keysize
,
82 const struct fscrypt_key
**payload_ret
)
86 const struct user_key_payload
*ukp
;
87 const struct fscrypt_key
*payload
;
89 description
= kasprintf(GFP_NOFS
, "%s%*phN", prefix
,
90 FS_KEY_DESCRIPTOR_SIZE
, descriptor
);
92 return ERR_PTR(-ENOMEM
);
94 key
= request_key(&key_type_logon
, description
, NULL
);
100 ukp
= user_key_payload_locked(key
);
102 if (!ukp
) /* was the key revoked before we acquired its semaphore? */
105 payload
= (const struct fscrypt_key
*)ukp
->data
;
107 if (ukp
->datalen
!= sizeof(struct fscrypt_key
) ||
108 payload
->size
< 1 || payload
->size
> FS_MAX_KEY_SIZE
) {
110 "key with description '%s' has invalid payload",
115 if (payload
->size
< min_keysize
) {
117 "key with description '%s' is too short (got %u bytes, need %u+ bytes)",
118 key
->description
, payload
->size
, min_keysize
);
122 *payload_ret
= payload
;
128 return ERR_PTR(-ENOKEY
);
131 static struct fscrypt_mode available_modes
[] = {
132 [FS_ENCRYPTION_MODE_AES_256_XTS
] = {
133 .friendly_name
= "AES-256-XTS",
134 .cipher_str
= "xts(aes)",
138 [FS_ENCRYPTION_MODE_AES_256_CTS
] = {
139 .friendly_name
= "AES-256-CTS-CBC",
140 .cipher_str
= "cts(cbc(aes))",
144 [FS_ENCRYPTION_MODE_AES_128_CBC
] = {
145 .friendly_name
= "AES-128-CBC",
146 .cipher_str
= "cbc(aes)",
151 [FS_ENCRYPTION_MODE_AES_128_CTS
] = {
152 .friendly_name
= "AES-128-CTS-CBC",
153 .cipher_str
= "cts(cbc(aes))",
157 [FS_ENCRYPTION_MODE_ADIANTUM
] = {
158 .friendly_name
= "Adiantum",
159 .cipher_str
= "adiantum(xchacha12,aes)",
165 static struct fscrypt_mode
*
166 select_encryption_mode(const struct fscrypt_info
*ci
, const struct inode
*inode
)
168 if (!fscrypt_valid_enc_modes(ci
->ci_data_mode
, ci
->ci_filename_mode
)) {
169 fscrypt_warn(inode
->i_sb
,
170 "inode %lu uses unsupported encryption modes (contents mode %d, filenames mode %d)",
171 inode
->i_ino
, ci
->ci_data_mode
,
172 ci
->ci_filename_mode
);
173 return ERR_PTR(-EINVAL
);
176 if (S_ISREG(inode
->i_mode
))
177 return &available_modes
[ci
->ci_data_mode
];
179 if (S_ISDIR(inode
->i_mode
) || S_ISLNK(inode
->i_mode
))
180 return &available_modes
[ci
->ci_filename_mode
];
182 WARN_ONCE(1, "fscrypt: filesystem tried to load encryption info for inode %lu, which is not encryptable (file type %d)\n",
183 inode
->i_ino
, (inode
->i_mode
& S_IFMT
));
184 return ERR_PTR(-EINVAL
);
187 /* Find the master key, then derive the inode's actual encryption key */
188 static int find_and_derive_key(const struct inode
*inode
,
189 const struct fscrypt_context
*ctx
,
190 u8
*derived_key
, const struct fscrypt_mode
*mode
)
193 const struct fscrypt_key
*payload
;
196 key
= find_and_lock_process_key(FS_KEY_DESC_PREFIX
,
197 ctx
->master_key_descriptor
,
198 mode
->keysize
, &payload
);
199 if (key
== ERR_PTR(-ENOKEY
) && inode
->i_sb
->s_cop
->key_prefix
) {
200 key
= find_and_lock_process_key(inode
->i_sb
->s_cop
->key_prefix
,
201 ctx
->master_key_descriptor
,
202 mode
->keysize
, &payload
);
207 if (ctx
->flags
& FS_POLICY_FLAG_DIRECT_KEY
) {
208 if (mode
->ivsize
< offsetofend(union fscrypt_iv
, nonce
)) {
209 fscrypt_warn(inode
->i_sb
,
210 "direct key mode not allowed with %s",
211 mode
->friendly_name
);
213 } else if (ctx
->contents_encryption_mode
!=
214 ctx
->filenames_encryption_mode
) {
215 fscrypt_warn(inode
->i_sb
,
216 "direct key mode not allowed with different contents and filenames modes");
219 memcpy(derived_key
, payload
->raw
, mode
->keysize
);
223 err
= derive_key_aes(payload
->raw
, ctx
, derived_key
,
231 /* Allocate and key a symmetric cipher object for the given encryption mode */
232 static struct crypto_skcipher
*
233 allocate_skcipher_for_mode(struct fscrypt_mode
*mode
, const u8
*raw_key
,
234 const struct inode
*inode
)
236 struct crypto_skcipher
*tfm
;
239 tfm
= crypto_alloc_skcipher(mode
->cipher_str
, 0, 0);
241 fscrypt_warn(inode
->i_sb
,
242 "error allocating '%s' transform for inode %lu: %ld",
243 mode
->cipher_str
, inode
->i_ino
, PTR_ERR(tfm
));
246 if (unlikely(!mode
->logged_impl_name
)) {
248 * fscrypt performance can vary greatly depending on which
249 * crypto algorithm implementation is used. Help people debug
250 * performance problems by logging the ->cra_driver_name the
251 * first time a mode is used. Note that multiple threads can
252 * race here, but it doesn't really matter.
254 mode
->logged_impl_name
= true;
255 pr_info("fscrypt: %s using implementation \"%s\"\n",
257 crypto_skcipher_alg(tfm
)->base
.cra_driver_name
);
259 crypto_skcipher_set_flags(tfm
, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS
);
260 err
= crypto_skcipher_setkey(tfm
, raw_key
, mode
->keysize
);
267 crypto_free_skcipher(tfm
);
271 /* Master key referenced by FS_POLICY_FLAG_DIRECT_KEY policy */
272 struct fscrypt_master_key
{
273 struct hlist_node mk_node
;
274 refcount_t mk_refcount
;
275 const struct fscrypt_mode
*mk_mode
;
276 struct crypto_skcipher
*mk_ctfm
;
277 u8 mk_descriptor
[FS_KEY_DESCRIPTOR_SIZE
];
278 u8 mk_raw
[FS_MAX_KEY_SIZE
];
281 static void free_master_key(struct fscrypt_master_key
*mk
)
284 crypto_free_skcipher(mk
->mk_ctfm
);
289 static void put_master_key(struct fscrypt_master_key
*mk
)
291 if (!refcount_dec_and_lock(&mk
->mk_refcount
, &fscrypt_master_keys_lock
))
293 hash_del(&mk
->mk_node
);
294 spin_unlock(&fscrypt_master_keys_lock
);
300 * Find/insert the given master key into the fscrypt_master_keys table. If
301 * found, it is returned with elevated refcount, and 'to_insert' is freed if
302 * non-NULL. If not found, 'to_insert' is inserted and returned if it's
303 * non-NULL; otherwise NULL is returned.
305 static struct fscrypt_master_key
*
306 find_or_insert_master_key(struct fscrypt_master_key
*to_insert
,
307 const u8
*raw_key
, const struct fscrypt_mode
*mode
,
308 const struct fscrypt_info
*ci
)
310 unsigned long hash_key
;
311 struct fscrypt_master_key
*mk
;
314 * Careful: to avoid potentially leaking secret key bytes via timing
315 * information, we must key the hash table by descriptor rather than by
316 * raw key, and use crypto_memneq() when comparing raw keys.
319 BUILD_BUG_ON(sizeof(hash_key
) > FS_KEY_DESCRIPTOR_SIZE
);
320 memcpy(&hash_key
, ci
->ci_master_key_descriptor
, sizeof(hash_key
));
322 spin_lock(&fscrypt_master_keys_lock
);
323 hash_for_each_possible(fscrypt_master_keys
, mk
, mk_node
, hash_key
) {
324 if (memcmp(ci
->ci_master_key_descriptor
, mk
->mk_descriptor
,
325 FS_KEY_DESCRIPTOR_SIZE
) != 0)
327 if (mode
!= mk
->mk_mode
)
329 if (crypto_memneq(raw_key
, mk
->mk_raw
, mode
->keysize
))
331 /* using existing tfm with same (descriptor, mode, raw_key) */
332 refcount_inc(&mk
->mk_refcount
);
333 spin_unlock(&fscrypt_master_keys_lock
);
334 free_master_key(to_insert
);
338 hash_add(fscrypt_master_keys
, &to_insert
->mk_node
, hash_key
);
339 spin_unlock(&fscrypt_master_keys_lock
);
343 /* Prepare to encrypt directly using the master key in the given mode */
344 static struct fscrypt_master_key
*
345 fscrypt_get_master_key(const struct fscrypt_info
*ci
, struct fscrypt_mode
*mode
,
346 const u8
*raw_key
, const struct inode
*inode
)
348 struct fscrypt_master_key
*mk
;
351 /* Is there already a tfm for this key? */
352 mk
= find_or_insert_master_key(NULL
, raw_key
, mode
, ci
);
356 /* Nope, allocate one. */
357 mk
= kzalloc(sizeof(*mk
), GFP_NOFS
);
359 return ERR_PTR(-ENOMEM
);
360 refcount_set(&mk
->mk_refcount
, 1);
362 mk
->mk_ctfm
= allocate_skcipher_for_mode(mode
, raw_key
, inode
);
363 if (IS_ERR(mk
->mk_ctfm
)) {
364 err
= PTR_ERR(mk
->mk_ctfm
);
368 memcpy(mk
->mk_descriptor
, ci
->ci_master_key_descriptor
,
369 FS_KEY_DESCRIPTOR_SIZE
);
370 memcpy(mk
->mk_raw
, raw_key
, mode
->keysize
);
372 return find_or_insert_master_key(mk
, raw_key
, mode
, ci
);
379 static int derive_essiv_salt(const u8
*key
, int keysize
, u8
*salt
)
381 struct crypto_shash
*tfm
= READ_ONCE(essiv_hash_tfm
);
383 /* init hash transform on demand */
384 if (unlikely(!tfm
)) {
385 struct crypto_shash
*prev_tfm
;
387 tfm
= crypto_alloc_shash("sha256", 0, 0);
390 "error allocating SHA-256 transform: %ld",
394 prev_tfm
= cmpxchg(&essiv_hash_tfm
, NULL
, tfm
);
396 crypto_free_shash(tfm
);
402 SHASH_DESC_ON_STACK(desc
, tfm
);
405 return crypto_shash_digest(desc
, key
, keysize
, salt
);
409 static int init_essiv_generator(struct fscrypt_info
*ci
, const u8
*raw_key
,
413 struct crypto_cipher
*essiv_tfm
;
414 u8 salt
[SHA256_DIGEST_SIZE
];
416 essiv_tfm
= crypto_alloc_cipher("aes", 0, 0);
417 if (IS_ERR(essiv_tfm
))
418 return PTR_ERR(essiv_tfm
);
420 ci
->ci_essiv_tfm
= essiv_tfm
;
422 err
= derive_essiv_salt(raw_key
, keysize
, salt
);
427 * Using SHA256 to derive the salt/key will result in AES-256 being
428 * used for IV generation. File contents encryption will still use the
429 * configured keysize (AES-128) nevertheless.
431 err
= crypto_cipher_setkey(essiv_tfm
, salt
, sizeof(salt
));
436 memzero_explicit(salt
, sizeof(salt
));
440 void __exit
fscrypt_essiv_cleanup(void)
442 crypto_free_shash(essiv_hash_tfm
);
446 * Given the encryption mode and key (normally the derived key, but for
447 * FS_POLICY_FLAG_DIRECT_KEY mode it's the master key), set up the inode's
448 * symmetric cipher transform object(s).
450 static int setup_crypto_transform(struct fscrypt_info
*ci
,
451 struct fscrypt_mode
*mode
,
452 const u8
*raw_key
, const struct inode
*inode
)
454 struct fscrypt_master_key
*mk
;
455 struct crypto_skcipher
*ctfm
;
458 if (ci
->ci_flags
& FS_POLICY_FLAG_DIRECT_KEY
) {
459 mk
= fscrypt_get_master_key(ci
, mode
, raw_key
, inode
);
465 ctfm
= allocate_skcipher_for_mode(mode
, raw_key
, inode
);
467 return PTR_ERR(ctfm
);
469 ci
->ci_master_key
= mk
;
472 if (mode
->needs_essiv
) {
473 /* ESSIV implies 16-byte IVs which implies !DIRECT_KEY */
474 WARN_ON(mode
->ivsize
!= AES_BLOCK_SIZE
);
475 WARN_ON(ci
->ci_flags
& FS_POLICY_FLAG_DIRECT_KEY
);
477 err
= init_essiv_generator(ci
, raw_key
, mode
->keysize
);
479 fscrypt_warn(inode
->i_sb
,
480 "error initializing ESSIV generator for inode %lu: %d",
488 static void put_crypt_info(struct fscrypt_info
*ci
)
493 if (ci
->ci_master_key
) {
494 put_master_key(ci
->ci_master_key
);
496 crypto_free_skcipher(ci
->ci_ctfm
);
497 crypto_free_cipher(ci
->ci_essiv_tfm
);
499 kmem_cache_free(fscrypt_info_cachep
, ci
);
502 int fscrypt_get_encryption_info(struct inode
*inode
)
504 struct fscrypt_info
*crypt_info
;
505 struct fscrypt_context ctx
;
506 struct fscrypt_mode
*mode
;
510 if (fscrypt_has_encryption_key(inode
))
513 res
= fscrypt_initialize(inode
->i_sb
->s_cop
->flags
);
517 res
= inode
->i_sb
->s_cop
->get_context(inode
, &ctx
, sizeof(ctx
));
519 if (!fscrypt_dummy_context_enabled(inode
) ||
522 /* Fake up a context for an unencrypted directory */
523 memset(&ctx
, 0, sizeof(ctx
));
524 ctx
.format
= FS_ENCRYPTION_CONTEXT_FORMAT_V1
;
525 ctx
.contents_encryption_mode
= FS_ENCRYPTION_MODE_AES_256_XTS
;
526 ctx
.filenames_encryption_mode
= FS_ENCRYPTION_MODE_AES_256_CTS
;
527 memset(ctx
.master_key_descriptor
, 0x42, FS_KEY_DESCRIPTOR_SIZE
);
528 } else if (res
!= sizeof(ctx
)) {
532 if (ctx
.format
!= FS_ENCRYPTION_CONTEXT_FORMAT_V1
)
535 if (ctx
.flags
& ~FS_POLICY_FLAGS_VALID
)
538 crypt_info
= kmem_cache_zalloc(fscrypt_info_cachep
, GFP_NOFS
);
542 crypt_info
->ci_flags
= ctx
.flags
;
543 crypt_info
->ci_data_mode
= ctx
.contents_encryption_mode
;
544 crypt_info
->ci_filename_mode
= ctx
.filenames_encryption_mode
;
545 memcpy(crypt_info
->ci_master_key_descriptor
, ctx
.master_key_descriptor
,
546 FS_KEY_DESCRIPTOR_SIZE
);
547 memcpy(crypt_info
->ci_nonce
, ctx
.nonce
, FS_KEY_DERIVATION_NONCE_SIZE
);
549 mode
= select_encryption_mode(crypt_info
, inode
);
554 WARN_ON(mode
->ivsize
> FSCRYPT_MAX_IV_SIZE
);
555 crypt_info
->ci_mode
= mode
;
558 * This cannot be a stack buffer because it may be passed to the
559 * scatterlist crypto API as part of key derivation.
562 raw_key
= kmalloc(mode
->keysize
, GFP_NOFS
);
566 res
= find_and_derive_key(inode
, &ctx
, raw_key
, mode
);
570 res
= setup_crypto_transform(crypt_info
, mode
, raw_key
, inode
);
574 if (cmpxchg_release(&inode
->i_crypt_info
, NULL
, crypt_info
) == NULL
)
579 put_crypt_info(crypt_info
);
583 EXPORT_SYMBOL(fscrypt_get_encryption_info
);
586 * fscrypt_put_encryption_info - free most of an inode's fscrypt data
588 * Free the inode's fscrypt_info. Filesystems must call this when the inode is
589 * being evicted. An RCU grace period need not have elapsed yet.
591 void fscrypt_put_encryption_info(struct inode
*inode
)
593 put_crypt_info(inode
->i_crypt_info
);
594 inode
->i_crypt_info
= NULL
;
596 EXPORT_SYMBOL(fscrypt_put_encryption_info
);
599 * fscrypt_free_inode - free an inode's fscrypt data requiring RCU delay
601 * Free the inode's cached decrypted symlink target, if any. Filesystems must
602 * call this after an RCU grace period, just before they free the inode.
604 void fscrypt_free_inode(struct inode
*inode
)
606 if (IS_ENCRYPTED(inode
) && S_ISLNK(inode
->i_mode
)) {
607 kfree(inode
->i_link
);
608 inode
->i_link
= NULL
;
611 EXPORT_SYMBOL(fscrypt_free_inode
);