e503fc55 | 11-Mar-2024 |
Daniel P. Berrangé <berrange@redhat.com> |
crypto: query gcrypt for cipher availability
Just because a cipher is defined in the gcrypt header file, does not imply that it can be used. Distros can filter the list of ciphers when building gcry
crypto: query gcrypt for cipher availability
Just because a cipher is defined in the gcrypt header file, does not imply that it can be used. Distros can filter the list of ciphers when building gcrypt. For example, RHEL-9 disables the SM4 cipher. It is also possible that running in FIPS mode might dynamically change what ciphers are available at runtime.
qcrypto_cipher_supports must therefore query gcrypt directly to check for cipher availability.
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
show more ...
|
0bd779e2 | 30-Jan-2024 |
Hyman Huang <yong.huang@smartx.com> |
crypto: Introduce 'detached-header' field in QCryptoBlockInfoLUKS
When querying the LUKS disk with the qemu-img tool or other APIs, add information about whether the LUKS header is detached.
Additi
crypto: Introduce 'detached-header' field in QCryptoBlockInfoLUKS
When querying the LUKS disk with the qemu-img tool or other APIs, add information about whether the LUKS header is detached.
Additionally, update the test case with the appropriate modification.
Signed-off-by: Hyman Huang <yong.huang@smartx.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
show more ...
|
d74523a3 | 30-Jan-2024 |
Hyman Huang <yong.huang@smartx.com> |
crypto: Modify the qcrypto_block_create to support creation flags
Expand the signature of qcrypto_block_create to enable the formation of LUKS volumes with detachable headers. To accomplish that, in
crypto: Modify the qcrypto_block_create to support creation flags
Expand the signature of qcrypto_block_create to enable the formation of LUKS volumes with detachable headers. To accomplish that, introduce QCryptoBlockCreateFlags to instruct the creation process to set the payload_offset_sector to 0.
Signed-off-by: Hyman Huang <yong.huang@smartx.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
show more ...
|
9ad5c4e7 | 30-Jan-2024 |
Hyman Huang <yong.huang@smartx.com> |
crypto: Support LUKS volume with detached header
By enhancing the LUKS driver, it is possible to implement the LUKS volume with a detached header.
Normally a LUKS volume has a layout: disk: | he
crypto: Support LUKS volume with detached header
By enhancing the LUKS driver, it is possible to implement the LUKS volume with a detached header.
Normally a LUKS volume has a layout: disk: | header | key material | disk payload data |
With a detached LUKS header, you need 2 disks so getting: disk1: | header | key material | disk2: | disk payload data |
There are a variety of benefits to doing this: * Secrecy - the disk2 cannot be identified as containing LUKS volume since there's no header * Control - if access to the disk1 is restricted, then even if someone has access to disk2 they can't unlock it. Might be useful if you have disks on NFS but want to restrict which host can launch a VM instance from it, by dynamically providing access to the header to a designated host * Flexibility - your application data volume may be a given size and it is inconvenient to resize it to add encryption.You can store the LUKS header separately and use the existing storage volume for payload * Recovery - corruption of a bit in the header may make the entire payload inaccessible. It might be convenient to take backups of the header. If your primary disk header becomes corrupt, you can unlock the data still by pointing to the backup detached header
Take the raw-format image as an example to introduce the usage of the LUKS volume with a detached header:
1. prepare detached LUKS header images $ dd if=/dev/zero of=test-header.img bs=1M count=32 $ dd if=/dev/zero of=test-payload.img bs=1M count=1000 $ cryptsetup luksFormat --header test-header.img test-payload.img > --force-password --type luks1
2. block-add a protocol blockdev node of payload image $ virsh qemu-monitor-command vm '{"execute":"blockdev-add", > "arguments":{"node-name":"libvirt-1-storage", "driver":"file", > "filename":"test-payload.img"}}'
3. block-add a protocol blockdev node of LUKS header as above. $ virsh qemu-monitor-command vm '{"execute":"blockdev-add", > "arguments":{"node-name":"libvirt-2-storage", "driver":"file", > "filename": "test-header.img" }}'
4. object-add the secret for decrypting the cipher stored in LUKS header above $ virsh qemu-monitor-command vm '{"execute":"object-add", > "arguments":{"qom-type":"secret", "id": > "libvirt-2-storage-secret0", "data":"abc123"}}'
5. block-add the raw-drived blockdev format node $ virsh qemu-monitor-command vm '{"execute":"blockdev-add", > "arguments":{"node-name":"libvirt-1-format", "driver":"raw", > "file":"libvirt-1-storage"}}'
6. block-add the luks-drived blockdev to link the raw disk with the LUKS header by specifying the field "header" $ virsh qemu-monitor-command vm '{"execute":"blockdev-add", > "arguments":{"node-name":"libvirt-2-format", "driver":"luks", > "file":"libvirt-1-format", "header":"libvirt-2-storage", > "key-secret":"libvirt-2-format-secret0"}}'
7. hot-plug the virtio-blk device finally $ virsh qemu-monitor-command vm '{"execute":"device_add", > "arguments": {"num-queues":"1", "driver":"virtio-blk-pci", > "drive": "libvirt-2-format", "id":"virtio-disk2"}}'
Starting a VM with a LUKS volume with detached header is somewhat similar to hot-plug in that both maintaining the same json command while the starting VM changes the "blockdev-add/device_add" parameters to "blockdev/device".
Signed-off-by: Hyman Huang <yong.huang@smartx.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
show more ...
|
ff494c8e | 03-Jun-2023 |
Richard Henderson <richard.henderson@linaro.org> |
crypto: Unexport AES_*_rot, AES_TeN, AES_TdN
These arrays are no longer used outside of aes.c.
Acked-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.
crypto: Unexport AES_*_rot, AES_TeN, AES_TdN
These arrays are no longer used outside of aes.c.
Acked-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
10545354 | 03-Jun-2023 |
Richard Henderson <richard.henderson@linaro.org> |
crypto: Remove AES_imc
This array is no longer used.
Acked-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <ric
crypto: Remove AES_imc
This array is no longer used.
Acked-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|
c10c559b | 03-Jun-2023 |
Richard Henderson <richard.henderson@linaro.org> |
crypto: Implement aesdec_IMC with AES_imc_rot
This method uses one uint32_t * 256 table instead of 4, which means its data cache overhead is less.
Acked-by: Daniel P. Berrangé <berrange@redhat.com>
crypto: Implement aesdec_IMC with AES_imc_rot
This method uses one uint32_t * 256 table instead of 4, which means its data cache overhead is less.
Acked-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
show more ...
|