2 * key management facility for FS encryption support.
4 * Copyright (C) 2015, Google, Inc.
6 * This contains encryption key functions.
8 * Written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar, 2015.
11 #include <keys/user-type.h>
12 #include <linux/scatterlist.h>
13 #include "fscrypt_private.h"
15 static void derive_crypt_complete(struct crypto_async_request
*req
, int rc
)
17 struct fscrypt_completion_result
*ecr
= req
->data
;
19 if (rc
== -EINPROGRESS
)
23 complete(&ecr
->completion
);
27 * derive_key_aes() - Derive a key using AES-128-ECB
28 * @deriving_key: Encryption key used for derivation.
29 * @source_key: Source key to which to apply derivation.
30 * @derived_key: Derived key.
32 * Return: Zero on success; non-zero otherwise.
34 static int derive_key_aes(u8 deriving_key
[FS_AES_128_ECB_KEY_SIZE
],
35 u8 source_key
[FS_AES_256_XTS_KEY_SIZE
],
36 u8 derived_key
[FS_AES_256_XTS_KEY_SIZE
])
39 struct skcipher_request
*req
= NULL
;
40 DECLARE_FS_COMPLETION_RESULT(ecr
);
41 struct scatterlist src_sg
, dst_sg
;
42 struct crypto_skcipher
*tfm
= crypto_alloc_skcipher("ecb(aes)", 0, 0);
49 crypto_skcipher_set_flags(tfm
, CRYPTO_TFM_REQ_WEAK_KEY
);
50 req
= skcipher_request_alloc(tfm
, GFP_NOFS
);
55 skcipher_request_set_callback(req
,
56 CRYPTO_TFM_REQ_MAY_BACKLOG
| CRYPTO_TFM_REQ_MAY_SLEEP
,
57 derive_crypt_complete
, &ecr
);
58 res
= crypto_skcipher_setkey(tfm
, deriving_key
,
59 FS_AES_128_ECB_KEY_SIZE
);
63 sg_init_one(&src_sg
, source_key
, FS_AES_256_XTS_KEY_SIZE
);
64 sg_init_one(&dst_sg
, derived_key
, FS_AES_256_XTS_KEY_SIZE
);
65 skcipher_request_set_crypt(req
, &src_sg
, &dst_sg
,
66 FS_AES_256_XTS_KEY_SIZE
, NULL
);
67 res
= crypto_skcipher_encrypt(req
);
68 if (res
== -EINPROGRESS
|| res
== -EBUSY
) {
69 wait_for_completion(&ecr
.completion
);
73 skcipher_request_free(req
);
74 crypto_free_skcipher(tfm
);
78 static int validate_user_key(struct fscrypt_info
*crypt_info
,
79 struct fscrypt_context
*ctx
, u8
*raw_key
,
83 struct key
*keyring_key
;
84 struct fscrypt_key
*master_key
;
85 const struct user_key_payload
*ukp
;
88 description
= kasprintf(GFP_NOFS
, "%s%*phN", prefix
,
89 FS_KEY_DESCRIPTOR_SIZE
,
90 ctx
->master_key_descriptor
);
94 keyring_key
= request_key(&key_type_logon
, description
, NULL
);
96 if (IS_ERR(keyring_key
))
97 return PTR_ERR(keyring_key
);
98 down_read(&keyring_key
->sem
);
100 if (keyring_key
->type
!= &key_type_logon
) {
101 printk_once(KERN_WARNING
102 "%s: key type must be logon\n", __func__
);
106 ukp
= user_key_payload_locked(keyring_key
);
107 if (ukp
->datalen
!= sizeof(struct fscrypt_key
)) {
111 master_key
= (struct fscrypt_key
*)ukp
->data
;
112 BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE
!= FS_KEY_DERIVATION_NONCE_SIZE
);
114 if (master_key
->size
!= FS_AES_256_XTS_KEY_SIZE
) {
115 printk_once(KERN_WARNING
116 "%s: key size incorrect: %d\n",
117 __func__
, master_key
->size
);
121 res
= derive_key_aes(ctx
->nonce
, master_key
->raw
, raw_key
);
123 up_read(&keyring_key
->sem
);
124 key_put(keyring_key
);
128 static int determine_cipher_type(struct fscrypt_info
*ci
, struct inode
*inode
,
129 const char **cipher_str_ret
, int *keysize_ret
)
131 if (S_ISREG(inode
->i_mode
)) {
132 if (ci
->ci_data_mode
== FS_ENCRYPTION_MODE_AES_256_XTS
) {
133 *cipher_str_ret
= "xts(aes)";
134 *keysize_ret
= FS_AES_256_XTS_KEY_SIZE
;
137 pr_warn_once("fscrypto: unsupported contents encryption mode "
138 "%d for inode %lu\n",
139 ci
->ci_data_mode
, inode
->i_ino
);
143 if (S_ISDIR(inode
->i_mode
) || S_ISLNK(inode
->i_mode
)) {
144 if (ci
->ci_filename_mode
== FS_ENCRYPTION_MODE_AES_256_CTS
) {
145 *cipher_str_ret
= "cts(cbc(aes))";
146 *keysize_ret
= FS_AES_256_CTS_KEY_SIZE
;
149 pr_warn_once("fscrypto: unsupported filenames encryption mode "
150 "%d for inode %lu\n",
151 ci
->ci_filename_mode
, inode
->i_ino
);
155 pr_warn_once("fscrypto: unsupported file type %d for inode %lu\n",
156 (inode
->i_mode
& S_IFMT
), inode
->i_ino
);
160 static void put_crypt_info(struct fscrypt_info
*ci
)
165 crypto_free_skcipher(ci
->ci_ctfm
);
166 kmem_cache_free(fscrypt_info_cachep
, ci
);
169 int fscrypt_get_encryption_info(struct inode
*inode
)
171 struct fscrypt_info
*crypt_info
;
172 struct fscrypt_context ctx
;
173 struct crypto_skcipher
*ctfm
;
174 const char *cipher_str
;
179 if (inode
->i_crypt_info
)
182 res
= fscrypt_initialize(inode
->i_sb
->s_cop
->flags
);
186 if (!inode
->i_sb
->s_cop
->get_context
)
189 res
= inode
->i_sb
->s_cop
->get_context(inode
, &ctx
, sizeof(ctx
));
191 if (!fscrypt_dummy_context_enabled(inode
) ||
192 inode
->i_sb
->s_cop
->is_encrypted(inode
))
194 /* Fake up a context for an unencrypted directory */
195 memset(&ctx
, 0, sizeof(ctx
));
196 ctx
.format
= FS_ENCRYPTION_CONTEXT_FORMAT_V1
;
197 ctx
.contents_encryption_mode
= FS_ENCRYPTION_MODE_AES_256_XTS
;
198 ctx
.filenames_encryption_mode
= FS_ENCRYPTION_MODE_AES_256_CTS
;
199 memset(ctx
.master_key_descriptor
, 0x42, FS_KEY_DESCRIPTOR_SIZE
);
200 } else if (res
!= sizeof(ctx
)) {
204 if (ctx
.format
!= FS_ENCRYPTION_CONTEXT_FORMAT_V1
)
207 if (ctx
.flags
& ~FS_POLICY_FLAGS_VALID
)
210 crypt_info
= kmem_cache_alloc(fscrypt_info_cachep
, GFP_NOFS
);
214 crypt_info
->ci_flags
= ctx
.flags
;
215 crypt_info
->ci_data_mode
= ctx
.contents_encryption_mode
;
216 crypt_info
->ci_filename_mode
= ctx
.filenames_encryption_mode
;
217 crypt_info
->ci_ctfm
= NULL
;
218 memcpy(crypt_info
->ci_master_key
, ctx
.master_key_descriptor
,
219 sizeof(crypt_info
->ci_master_key
));
221 res
= determine_cipher_type(crypt_info
, inode
, &cipher_str
, &keysize
);
226 * This cannot be a stack buffer because it is passed to the scatterlist
227 * crypto API as part of key derivation.
230 raw_key
= kmalloc(FS_MAX_KEY_SIZE
, GFP_NOFS
);
234 res
= validate_user_key(crypt_info
, &ctx
, raw_key
, FS_KEY_DESC_PREFIX
);
235 if (res
&& inode
->i_sb
->s_cop
->key_prefix
) {
236 int res2
= validate_user_key(crypt_info
, &ctx
, raw_key
,
237 inode
->i_sb
->s_cop
->key_prefix
);
246 ctfm
= crypto_alloc_skcipher(cipher_str
, 0, 0);
247 if (!ctfm
|| IS_ERR(ctfm
)) {
248 res
= ctfm
? PTR_ERR(ctfm
) : -ENOMEM
;
250 "%s: error %d (inode %u) allocating crypto tfm\n",
251 __func__
, res
, (unsigned) inode
->i_ino
);
254 crypt_info
->ci_ctfm
= ctfm
;
255 crypto_skcipher_clear_flags(ctfm
, ~0);
256 crypto_skcipher_set_flags(ctfm
, CRYPTO_TFM_REQ_WEAK_KEY
);
257 res
= crypto_skcipher_setkey(ctfm
, raw_key
, keysize
);
261 if (cmpxchg(&inode
->i_crypt_info
, NULL
, crypt_info
) == NULL
)
266 put_crypt_info(crypt_info
);
270 EXPORT_SYMBOL(fscrypt_get_encryption_info
);
272 void fscrypt_put_encryption_info(struct inode
*inode
, struct fscrypt_info
*ci
)
274 struct fscrypt_info
*prev
;
277 ci
= ACCESS_ONCE(inode
->i_crypt_info
);
281 prev
= cmpxchg(&inode
->i_crypt_info
, ci
, NULL
);
287 EXPORT_SYMBOL(fscrypt_put_encryption_info
);