Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934229AbdC3RjC (ORCPT ); Thu, 30 Mar 2017 13:39:02 -0400 Received: from mail.sigma-star.at ([95.130.255.111]:45996 "EHLO mail.sigma-star.at" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933150AbdC3RjB (ORCPT ); Thu, 30 Mar 2017 13:39:01 -0400 From: David Gstir To: tytso@mit.edu, jaegeuk@kernel.org Cc: ebiggers3@gmail.com, dwalter@sigma-star.at, richard@sigma-star.at, herbert@gondor.apana.org.au, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, David Gstir Subject: [PATCH] fscrypt: Add support for AES-128-CBC Date: Thu, 30 Mar 2017 19:38:40 +0200 Message-Id: <20170330173840.72909-1-david@sigma-star.at> X-Mailer: git-send-email 2.12.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 12484 Lines: 348 From: Daniel Walter fscrypt provides facilities to use different encryption algorithms which are selectable by userspace when setting the encryption policy. Currently, only AES-256-XTS for file contents and AES-256-CBC-CTS for file names are implemented. Which is a clear case of kernel offers the mechanism and userspace selects a policy. Similar to what dm-crypt and ecryptfs have. This patch adds support for using AES-128-CBC for file contents and AES-128-CBC-CTS for file name encryption. To mitigate watermarking attacks, IVs are generated using the ESSIV algorithm. While AES-CBC is actually slightly less secure than AES-XTS from a security point of view, there is more widespread hardware support. Especially low-powered embedded devices crypto accelerators such as CAAM or CESA support only AES-CBC-128 with an acceptable speed. Using AES-CBC gives us the acceptable performance while still providing a moderate level of security for persistent storage. [david: massaged commit message] Signed-off-by: Daniel Walter Signed-off-by: David Gstir --- fs/crypto/crypto.c | 25 ++++++++---- fs/crypto/fscrypt_private.h | 5 ++- fs/crypto/keyinfo.c | 87 ++++++++++++++++++++++++++++++++++++------ include/linux/fscrypt_common.h | 6 ++- include/uapi/linux/fs.h | 2 + 5 files changed, 103 insertions(+), 22 deletions(-) diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c index 6d6eca3..210b586 100644 --- a/fs/crypto/crypto.c +++ b/fs/crypto/crypto.c @@ -26,6 +26,7 @@ #include #include #include +#include #include "fscrypt_private.h" static unsigned int num_prealloc_crypto_pages = 32; @@ -147,17 +148,31 @@ int fscrypt_do_page_crypto(const struct inode *inode, fscrypt_direction_t rw, { struct { __le64 index; - u8 padding[FS_XTS_TWEAK_SIZE - sizeof(__le64)]; - } xts_tweak; + u8 padding[FS_IV_SIZE - sizeof(__le64)]; + } blk_desc; struct skcipher_request *req = NULL; DECLARE_FS_COMPLETION_RESULT(ecr); struct scatterlist dst, src; struct fscrypt_info *ci = inode->i_crypt_info; struct crypto_skcipher *tfm = ci->ci_ctfm; + u8 iv[FS_IV_SIZE]; int res = 0; BUG_ON(len == 0); + BUILD_BUG_ON(sizeof(blk_desc) != FS_IV_SIZE); + BUILD_BUG_ON(AES_BLOCK_SIZE != FS_IV_SIZE); + blk_desc.index = cpu_to_le64(lblk_num); + memset(blk_desc.padding, 0, sizeof(blk_desc.padding)); + + if (ci->ci_data_mode == FS_ENCRYPTION_MODE_AES_128_CBC) { + BUG_ON(ci->ci_essiv_tfm == NULL); + memset(iv, 0, sizeof(iv)); + crypto_cipher_encrypt_one(ci->ci_essiv_tfm, iv, (u8 *)&blk_desc); + } else { + memcpy(iv, &blk_desc, sizeof(iv)); + } + req = skcipher_request_alloc(tfm, gfp_flags); if (!req) { printk_ratelimited(KERN_ERR @@ -170,15 +185,11 @@ int fscrypt_do_page_crypto(const struct inode *inode, fscrypt_direction_t rw, req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, page_crypt_complete, &ecr); - BUILD_BUG_ON(sizeof(xts_tweak) != FS_XTS_TWEAK_SIZE); - xts_tweak.index = cpu_to_le64(lblk_num); - memset(xts_tweak.padding, 0, sizeof(xts_tweak.padding)); - sg_init_table(&dst, 1); sg_set_page(&dst, dest_page, len, offs); sg_init_table(&src, 1); sg_set_page(&src, src_page, len, offs); - skcipher_request_set_crypt(req, &src, &dst, len, &xts_tweak); + skcipher_request_set_crypt(req, &src, &dst, len, &iv); if (rw == FS_DECRYPT) res = crypto_skcipher_decrypt(req); else diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h index e39696e..81ce9af 100644 --- a/fs/crypto/fscrypt_private.h +++ b/fs/crypto/fscrypt_private.h @@ -16,8 +16,10 @@ #define FS_FNAME_CRYPTO_DIGEST_SIZE 32 /* Encryption parameters */ -#define FS_XTS_TWEAK_SIZE 16 +#define FS_IV_SIZE 16 #define FS_AES_128_ECB_KEY_SIZE 16 +#define FS_AES_128_CBC_KEY_SIZE 16 +#define FS_AES_128_CTS_KEY_SIZE 16 #define FS_AES_256_GCM_KEY_SIZE 32 #define FS_AES_256_CBC_KEY_SIZE 32 #define FS_AES_256_CTS_KEY_SIZE 32 @@ -67,6 +69,7 @@ struct fscrypt_info { u8 ci_filename_mode; u8 ci_flags; struct crypto_skcipher *ci_ctfm; + struct crypto_cipher *ci_essiv_tfm; u8 ci_master_key[FS_KEY_DESCRIPTOR_SIZE]; }; diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c index 8cdfddc..cc515e9 100644 --- a/fs/crypto/keyinfo.c +++ b/fs/crypto/keyinfo.c @@ -10,6 +10,7 @@ #include #include +#include #include "fscrypt_private.h" static void derive_crypt_complete(struct crypto_async_request *req, int rc) @@ -27,13 +28,13 @@ static void derive_crypt_complete(struct crypto_async_request *req, int rc) * derive_key_aes() - Derive a key using AES-128-ECB * @deriving_key: Encryption key used for derivation. * @source_key: Source key to which to apply derivation. - * @derived_key: Derived key. + * @derived_key_raw: Derived raw key. * * Return: Zero on success; non-zero otherwise. */ static int derive_key_aes(u8 deriving_key[FS_AES_128_ECB_KEY_SIZE], - u8 source_key[FS_AES_256_XTS_KEY_SIZE], - u8 derived_key[FS_AES_256_XTS_KEY_SIZE]) + struct fscrypt_key *source_key, + u8 derived_raw_key[FS_MAX_KEY_SIZE]) { int res = 0; struct skcipher_request *req = NULL; @@ -60,10 +61,10 @@ static int derive_key_aes(u8 deriving_key[FS_AES_128_ECB_KEY_SIZE], if (res < 0) goto out; - sg_init_one(&src_sg, source_key, FS_AES_256_XTS_KEY_SIZE); - sg_init_one(&dst_sg, derived_key, FS_AES_256_XTS_KEY_SIZE); - skcipher_request_set_crypt(req, &src_sg, &dst_sg, - FS_AES_256_XTS_KEY_SIZE, NULL); + sg_init_one(&src_sg, source_key->raw, source_key->size); + sg_init_one(&dst_sg, derived_raw_key, source_key->size); + skcipher_request_set_crypt(req, &src_sg, &dst_sg, source_key->size, + NULL); res = crypto_skcipher_encrypt(req); if (res == -EINPROGRESS || res == -EBUSY) { wait_for_completion(&ecr.completion); @@ -75,9 +76,28 @@ static int derive_key_aes(u8 deriving_key[FS_AES_128_ECB_KEY_SIZE], return res; } +static bool valid_key_size(struct fscrypt_info *ci, struct fscrypt_key *key, + int reg_file) +{ + if (reg_file) { + switch(ci->ci_data_mode) { + case FS_ENCRYPTION_MODE_AES_256_XTS: + return key->size >= FS_AES_256_XTS_KEY_SIZE; + case FS_ENCRYPTION_MODE_AES_128_CBC: + return key->size >= FS_AES_128_CBC_KEY_SIZE; + } + } else { + if (ci->ci_filename_mode == FS_ENCRYPTION_MODE_AES_256_CTS) + return key->size >= FS_AES_256_CTS_KEY_SIZE; + if (ci->ci_filename_mode == FS_ENCRYPTION_MODE_AES_128_CTS) + return key->size >= FS_AES_128_CTS_KEY_SIZE; + } + return false; +} + static int validate_user_key(struct fscrypt_info *crypt_info, struct fscrypt_context *ctx, u8 *raw_key, - const char *prefix) + const char *prefix, int reg_file) { char *description; struct key *keyring_key; @@ -111,14 +131,14 @@ static int validate_user_key(struct fscrypt_info *crypt_info, master_key = (struct fscrypt_key *)ukp->data; BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE); - if (master_key->size != FS_AES_256_XTS_KEY_SIZE) { + if (!valid_key_size(crypt_info, master_key, reg_file)) { printk_once(KERN_WARNING "%s: key size incorrect: %d\n", __func__, master_key->size); res = -ENOKEY; goto out; } - res = derive_key_aes(ctx->nonce, master_key->raw, raw_key); + res = derive_key_aes(ctx->nonce, master_key, raw_key); out: up_read(&keyring_key->sem); key_put(keyring_key); @@ -134,6 +154,11 @@ static int determine_cipher_type(struct fscrypt_info *ci, struct inode *inode, *keysize_ret = FS_AES_256_XTS_KEY_SIZE; return 0; } + if (ci->ci_data_mode == FS_ENCRYPTION_MODE_AES_128_CBC) { + *cipher_str_ret = "cbc(aes)"; + *keysize_ret = FS_AES_128_CBC_KEY_SIZE; + return 0; + } pr_warn_once("fscrypto: unsupported contents encryption mode " "%d for inode %lu\n", ci->ci_data_mode, inode->i_ino); @@ -146,6 +171,11 @@ static int determine_cipher_type(struct fscrypt_info *ci, struct inode *inode, *keysize_ret = FS_AES_256_CTS_KEY_SIZE; return 0; } + if (ci->ci_filename_mode == FS_ENCRYPTION_MODE_AES_128_CTS) { + *cipher_str_ret = "cts(cbc(aes))"; + *keysize_ret = FS_AES_128_CTS_KEY_SIZE; + return 0; + } pr_warn_once("fscrypto: unsupported filenames encryption mode " "%d for inode %lu\n", ci->ci_filename_mode, inode->i_ino); @@ -163,6 +193,8 @@ static void put_crypt_info(struct fscrypt_info *ci) return; crypto_free_skcipher(ci->ci_ctfm); + if (ci->ci_essiv_tfm) + crypto_free_cipher(ci->ci_essiv_tfm); kmem_cache_free(fscrypt_info_cachep, ci); } @@ -171,6 +203,10 @@ int fscrypt_get_encryption_info(struct inode *inode) struct fscrypt_info *crypt_info; struct fscrypt_context ctx; struct crypto_skcipher *ctfm; + struct crypto_cipher *essiv_tfm; + __u32 sha_ws[SHA_WORKSPACE_WORDS]; + __u32 essiv_key[SHA_DIGEST_WORDS]; + const char *cipher_str; int keysize; u8 *raw_key = NULL; @@ -207,6 +243,10 @@ int fscrypt_get_encryption_info(struct inode *inode) if (ctx.flags & ~FS_POLICY_FLAGS_VALID) return -EINVAL; + if (ctx.contents_encryption_mode == FS_ENCRYPTION_MODE_AES_128_CBC && + ctx.filenames_encryption_mode != FS_ENCRYPTION_MODE_AES_128_CTS) + return -EINVAL; + crypt_info = kmem_cache_alloc(fscrypt_info_cachep, GFP_NOFS); if (!crypt_info) return -ENOMEM; @@ -215,6 +255,7 @@ int fscrypt_get_encryption_info(struct inode *inode) crypt_info->ci_data_mode = ctx.contents_encryption_mode; crypt_info->ci_filename_mode = ctx.filenames_encryption_mode; crypt_info->ci_ctfm = NULL; + crypt_info->ci_essiv_tfm = NULL; memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor, sizeof(crypt_info->ci_master_key)); @@ -231,10 +272,12 @@ int fscrypt_get_encryption_info(struct inode *inode) if (!raw_key) goto out; - res = validate_user_key(crypt_info, &ctx, raw_key, FS_KEY_DESC_PREFIX); + res = validate_user_key(crypt_info, &ctx, raw_key, FS_KEY_DESC_PREFIX, + S_ISREG(inode->i_mode)); if (res && inode->i_sb->s_cop->key_prefix) { int res2 = validate_user_key(crypt_info, &ctx, raw_key, - inode->i_sb->s_cop->key_prefix); + inode->i_sb->s_cop->key_prefix, + S_ISREG(inode->i_mode)); if (res2) { if (res2 == -ENOKEY) res = -ENOKEY; @@ -258,6 +301,26 @@ int fscrypt_get_encryption_info(struct inode *inode) if (res) goto out; + if (crypt_info->ci_data_mode == FS_ENCRYPTION_MODE_AES_128_CBC) { + /* init ESSIV generator */ + essiv_tfm = crypto_alloc_cipher("aes", 0, 0); + if (!essiv_tfm || IS_ERR(essiv_tfm)) { + res = essiv_tfm ? PTR_ERR(essiv_tfm) : -ENOMEM; + printk(KERN_DEBUG + "%s: error %d (inode %u) allocating essiv tfm\n", + __func__, res, (unsigned) inode->i_ino); + goto out; + } + /* calc sha of key for essiv generation */ + memset(sha_ws, 0, sizeof(sha_ws)); + sha_init(essiv_key); + sha_transform(essiv_key, raw_key, sha_ws); + res = crypto_cipher_setkey(essiv_tfm, (u8 *)essiv_key, keysize); + if (res) + goto out; + + crypt_info->ci_essiv_tfm = essiv_tfm; + } if (cmpxchg(&inode->i_crypt_info, NULL, crypt_info) == NULL) crypt_info = NULL; out: diff --git a/include/linux/fscrypt_common.h b/include/linux/fscrypt_common.h index 10c1abf..83d32a6 100644 --- a/include/linux/fscrypt_common.h +++ b/include/linux/fscrypt_common.h @@ -104,12 +104,14 @@ static inline bool fscrypt_dummy_context_enabled(struct inode *inode) static inline bool fscrypt_valid_contents_enc_mode(u32 mode) { - return (mode == FS_ENCRYPTION_MODE_AES_256_XTS); + return (mode == FS_ENCRYPTION_MODE_AES_256_XTS || + mode == FS_ENCRYPTION_MODE_AES_128_CBC); } static inline bool fscrypt_valid_filenames_enc_mode(u32 mode) { - return (mode == FS_ENCRYPTION_MODE_AES_256_CTS); + return (mode == FS_ENCRYPTION_MODE_AES_256_CTS || + mode == FS_ENCRYPTION_MODE_AES_128_CTS); } static inline bool fscrypt_is_dot_dotdot(const struct qstr *str) diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h index 048a85e..231b15d 100644 --- a/include/uapi/linux/fs.h +++ b/include/uapi/linux/fs.h @@ -272,6 +272,8 @@ struct fsxattr { #define FS_ENCRYPTION_MODE_AES_256_GCM 2 #define FS_ENCRYPTION_MODE_AES_256_CBC 3 #define FS_ENCRYPTION_MODE_AES_256_CTS 4 +#define FS_ENCRYPTION_MODE_AES_128_CBC 5 +#define FS_ENCRYPTION_MODE_AES_128_CTS 6 struct fscrypt_policy { __u8 version; -- 2.10.2