1 /*- 2 * Copyright (c) 2005-2010 Pawel Jakub Dawidek <pjd@FreeBSD.org> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <sys/cdefs.h> 28 __FBSDID("$FreeBSD$"); 29 30 #include <sys/param.h> 31 #ifdef _KERNEL 32 #include <sys/malloc.h> 33 #include <sys/systm.h> 34 #include <geom/geom.h> 35 #else 36 #include <stdio.h> 37 #include <stdint.h> 38 #include <stdlib.h> 39 #include <string.h> 40 #include <strings.h> 41 #include <errno.h> 42 #endif 43 44 #include <geom/eli/g_eli.h> 45 46 #ifdef _KERNEL 47 MALLOC_DECLARE(M_ELI); 48 #endif 49 50 /* 51 * Verify if the given 'key' is correct. 52 * Return 1 if it is correct and 0 otherwise. 53 */ 54 static int 55 g_eli_mkey_verify(const unsigned char *mkey, const unsigned char *key) 56 { 57 const unsigned char *odhmac; /* On-disk HMAC. */ 58 unsigned char chmac[SHA512_MDLEN]; /* Calculated HMAC. */ 59 unsigned char hmkey[SHA512_MDLEN]; /* Key for HMAC. */ 60 61 /* 62 * The key for HMAC calculations is: hmkey = HMAC_SHA512(Derived-Key, 0) 63 */ 64 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x00", 1, hmkey, 0); 65 66 odhmac = mkey + G_ELI_DATAIVKEYLEN; 67 68 /* Calculate HMAC from Data-Key and IV-Key. */ 69 g_eli_crypto_hmac(hmkey, sizeof(hmkey), mkey, G_ELI_DATAIVKEYLEN, 70 chmac, 0); 71 72 bzero(hmkey, sizeof(hmkey)); 73 74 /* 75 * Compare calculated HMAC with HMAC from metadata. 76 * If two HMACs are equal, 'key' is correct. 77 */ 78 return (!bcmp(odhmac, chmac, SHA512_MDLEN)); 79 } 80 81 /* 82 * Calculate HMAC from Data-Key and IV-Key. 83 */ 84 void 85 g_eli_mkey_hmac(unsigned char *mkey, const unsigned char *key) 86 { 87 unsigned char hmkey[SHA512_MDLEN]; /* Key for HMAC. */ 88 unsigned char *odhmac; /* On-disk HMAC. */ 89 90 /* 91 * The key for HMAC calculations is: hmkey = HMAC_SHA512(Derived-Key, 0) 92 */ 93 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x00", 1, hmkey, 0); 94 95 odhmac = mkey + G_ELI_DATAIVKEYLEN; 96 /* Calculate HMAC from Data-Key and IV-Key. */ 97 g_eli_crypto_hmac(hmkey, sizeof(hmkey), mkey, G_ELI_DATAIVKEYLEN, 98 odhmac, 0); 99 100 bzero(hmkey, sizeof(hmkey)); 101 } 102 103 /* 104 * Find and decrypt Master Key encrypted with 'key'. 105 * Return decrypted Master Key number in 'nkeyp' if not NULL. 106 * Return 0 on success, > 0 on failure, -1 on bad key. 107 */ 108 int 109 g_eli_mkey_decrypt(const struct g_eli_metadata *md, const unsigned char *key, 110 unsigned char *mkey, unsigned *nkeyp) 111 { 112 unsigned char tmpmkey[G_ELI_MKEYLEN]; 113 unsigned char enckey[SHA512_MDLEN]; /* Key for encryption. */ 114 const unsigned char *mmkey; 115 int bit, error, nkey; 116 117 if (nkeyp != NULL) 118 *nkeyp = -1; 119 120 /* 121 * The key for encryption is: enckey = HMAC_SHA512(Derived-Key, 1) 122 */ 123 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x01", 1, enckey, 0); 124 125 mmkey = md->md_mkeys; 126 for (nkey = 0; nkey < G_ELI_MAXMKEYS; nkey++, mmkey += G_ELI_MKEYLEN) { 127 bit = (1 << nkey); 128 if (!(md->md_keys & bit)) 129 continue; 130 bcopy(mmkey, tmpmkey, G_ELI_MKEYLEN); 131 error = g_eli_crypto_decrypt(md->md_ealgo, tmpmkey, 132 G_ELI_MKEYLEN, enckey, md->md_keylen); 133 if (error != 0) { 134 bzero(tmpmkey, sizeof(tmpmkey)); 135 bzero(enckey, sizeof(enckey)); 136 return (error); 137 } 138 if (g_eli_mkey_verify(tmpmkey, key)) { 139 bcopy(tmpmkey, mkey, G_ELI_DATAIVKEYLEN); 140 bzero(tmpmkey, sizeof(tmpmkey)); 141 bzero(enckey, sizeof(enckey)); 142 if (nkeyp != NULL) 143 *nkeyp = nkey; 144 return (0); 145 } 146 } 147 bzero(enckey, sizeof(enckey)); 148 bzero(tmpmkey, sizeof(tmpmkey)); 149 return (-1); 150 } 151 152 /* 153 * Encrypt the Master-Key and calculate HMAC to be able to verify it in the 154 * future. 155 */ 156 int 157 g_eli_mkey_encrypt(unsigned algo, const unsigned char *key, unsigned keylen, 158 unsigned char *mkey) 159 { 160 unsigned char enckey[SHA512_MDLEN]; /* Key for encryption. */ 161 int error; 162 163 /* 164 * To calculate HMAC, the whole key (G_ELI_USERKEYLEN bytes long) will 165 * be used. 166 */ 167 g_eli_mkey_hmac(mkey, key); 168 /* 169 * The key for encryption is: enckey = HMAC_SHA512(Derived-Key, 1) 170 */ 171 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x01", 1, enckey, 0); 172 /* 173 * Encrypt the Master-Key and HMAC() result with the given key (this 174 * time only 'keylen' bits from the key are used). 175 */ 176 error = g_eli_crypto_encrypt(algo, mkey, G_ELI_MKEYLEN, enckey, keylen); 177 178 bzero(enckey, sizeof(enckey)); 179 180 return (error); 181 } 182 183 #ifdef _KERNEL 184 static void 185 g_eli_ekeys_generate(struct g_eli_softc *sc) 186 { 187 uint8_t *keys; 188 u_int kno; 189 off_t mediasize; 190 size_t blocksize; 191 struct { 192 char magic[4]; 193 uint8_t keyno[8]; 194 } __packed hmacdata; 195 196 KASSERT((sc->sc_flags & G_ELI_FLAG_SINGLE_KEY) == 0, 197 ("%s: G_ELI_FLAG_SINGLE_KEY flag present", __func__)); 198 199 if ((sc->sc_flags & G_ELI_FLAG_AUTH) != 0) { 200 struct g_provider *pp; 201 202 pp = LIST_FIRST(&sc->sc_geom->consumer)->provider; 203 mediasize = pp->mediasize; 204 blocksize = pp->sectorsize; 205 } else { 206 mediasize = sc->sc_mediasize; 207 blocksize = sc->sc_sectorsize; 208 } 209 sc->sc_nekeys = ((mediasize - 1) >> G_ELI_KEY_SHIFT) / blocksize + 1; 210 sc->sc_ekeys = 211 malloc(sc->sc_nekeys * (sizeof(uint8_t *) + G_ELI_DATAKEYLEN), 212 M_ELI, M_WAITOK); 213 keys = (uint8_t *)(sc->sc_ekeys + sc->sc_nekeys); 214 bcopy("ekey", hmacdata.magic, 4); 215 for (kno = 0; kno < sc->sc_nekeys; kno++, keys += G_ELI_DATAKEYLEN) { 216 sc->sc_ekeys[kno] = keys; 217 le64enc(hmacdata.keyno, (uint64_t)kno); 218 g_eli_crypto_hmac(sc->sc_mkey, G_ELI_MAXKEYLEN, 219 (uint8_t *)&hmacdata, sizeof(hmacdata), 220 sc->sc_ekeys[kno], 0); 221 } 222 } 223 224 /* 225 * When doing encryption only, copy IV key and encryption key. 226 * When doing encryption and authentication, copy IV key, generate encryption 227 * key and generate authentication key. 228 */ 229 void 230 g_eli_mkey_propagate(struct g_eli_softc *sc, const unsigned char *mkey) 231 { 232 233 /* Remember the Master Key. */ 234 bcopy(mkey, sc->sc_mkey, sizeof(sc->sc_mkey)); 235 236 bcopy(mkey, sc->sc_ivkey, sizeof(sc->sc_ivkey)); 237 mkey += sizeof(sc->sc_ivkey); 238 239 /* 240 * The authentication key is: akey = HMAC_SHA512(Master-Key, 0x11) 241 */ 242 if ((sc->sc_flags & G_ELI_FLAG_AUTH) != 0) { 243 g_eli_crypto_hmac(mkey, G_ELI_MAXKEYLEN, "\x11", 1, 244 sc->sc_akey, 0); 245 } else { 246 arc4rand(sc->sc_akey, sizeof(sc->sc_akey), 0); 247 } 248 249 if ((sc->sc_flags & G_ELI_FLAG_SINGLE_KEY) != 0) { 250 sc->sc_nekeys = 1; 251 sc->sc_ekeys = malloc(sc->sc_nekeys * 252 (sizeof(uint8_t *) + G_ELI_DATAKEYLEN), M_ELI, M_WAITOK); 253 sc->sc_ekeys[0] = (uint8_t *)(sc->sc_ekeys + sc->sc_nekeys); 254 if ((sc->sc_flags & G_ELI_FLAG_AUTH) == 0) 255 bcopy(mkey, sc->sc_ekeys[0], G_ELI_DATAKEYLEN); 256 else { 257 /* 258 * The encryption key is: ekey = HMAC_SHA512(Master-Key, 0x10) 259 */ 260 g_eli_crypto_hmac(mkey, G_ELI_MAXKEYLEN, "\x10", 1, 261 sc->sc_ekeys[0], 0); 262 } 263 } else { 264 /* Generate all encryption keys. */ 265 g_eli_ekeys_generate(sc); 266 } 267 268 if (sc->sc_flags & G_ELI_FLAG_AUTH) { 269 /* 270 * Precalculate SHA256 for HMAC key generation. 271 * This is expensive operation and we can do it only once now or 272 * for every access to sector, so now will be much better. 273 */ 274 SHA256_Init(&sc->sc_akeyctx); 275 SHA256_Update(&sc->sc_akeyctx, sc->sc_akey, 276 sizeof(sc->sc_akey)); 277 } 278 /* 279 * Precalculate SHA256 for IV generation. 280 * This is expensive operation and we can do it only once now or for 281 * every access to sector, so now will be much better. 282 */ 283 switch (sc->sc_ealgo) { 284 case CRYPTO_AES_XTS: 285 break; 286 default: 287 SHA256_Init(&sc->sc_ivctx); 288 SHA256_Update(&sc->sc_ivctx, sc->sc_ivkey, 289 sizeof(sc->sc_ivkey)); 290 break; 291 } 292 } 293 #endif 294