1# -*- Mode: Python -*- 2# vim: filetype=python 3# 4 5## 6# = Cryptography 7## 8 9## 10# @QCryptoTLSCredsEndpoint: 11# 12# The type of network endpoint that will be using the credentials. 13# Most types of credential require different setup / structures 14# depending on whether they will be used in a server versus a client. 15# 16# @client: the network endpoint is acting as the client 17# 18# @server: the network endpoint is acting as the server 19# 20# Since: 2.5 21## 22{ 'enum': 'QCryptoTLSCredsEndpoint', 23 'prefix': 'QCRYPTO_TLS_CREDS_ENDPOINT', 24 'data': ['client', 'server']} 25 26## 27# @QCryptoSecretFormat: 28# 29# The data format that the secret is provided in 30# 31# @raw: raw bytes. When encoded in JSON only valid UTF-8 sequences 32# can be used 33# 34# @base64: arbitrary base64 encoded binary data 35# 36# Since: 2.6 37## 38{ 'enum': 'QCryptoSecretFormat', 39 'prefix': 'QCRYPTO_SECRET_FORMAT', 40 'data': ['raw', 'base64']} 41 42## 43# @QCryptoHashAlgorithm: 44# 45# The supported algorithms for computing content digests 46# 47# @md5: MD5. Should not be used in any new code, legacy compat only 48# 49# @sha1: SHA-1. Should not be used in any new code, legacy compat only 50# 51# @sha224: SHA-224. (since 2.7) 52# 53# @sha256: SHA-256. Current recommended strong hash. 54# 55# @sha384: SHA-384. (since 2.7) 56# 57# @sha512: SHA-512. (since 2.7) 58# 59# @ripemd160: RIPEMD-160. (since 2.7) 60# 61# Since: 2.6 62## 63{ 'enum': 'QCryptoHashAlgorithm', 64 'prefix': 'QCRYPTO_HASH_ALG', 65 'data': ['md5', 'sha1', 'sha224', 'sha256', 'sha384', 'sha512', 'ripemd160']} 66 67## 68# @QCryptoCipherAlgorithm: 69# 70# The supported algorithms for content encryption ciphers 71# 72# @aes-128: AES with 128 bit / 16 byte keys 73# 74# @aes-192: AES with 192 bit / 24 byte keys 75# 76# @aes-256: AES with 256 bit / 32 byte keys 77# 78# @des: DES with 56 bit / 8 byte keys. Do not use except in VNC. 79# (since 6.1) 80# 81# @3des: 3DES(EDE) with 192 bit / 24 byte keys (since 2.9) 82# 83# @cast5-128: Cast5 with 128 bit / 16 byte keys 84# 85# @serpent-128: Serpent with 128 bit / 16 byte keys 86# 87# @serpent-192: Serpent with 192 bit / 24 byte keys 88# 89# @serpent-256: Serpent with 256 bit / 32 byte keys 90# 91# @twofish-128: Twofish with 128 bit / 16 byte keys 92# 93# @twofish-192: Twofish with 192 bit / 24 byte keys 94# 95# @twofish-256: Twofish with 256 bit / 32 byte keys 96# 97# @sm4: SM4 with 128 bit / 16 byte keys (since 9.0) 98# 99# Since: 2.6 100## 101{ 'enum': 'QCryptoCipherAlgorithm', 102 'prefix': 'QCRYPTO_CIPHER_ALG', 103 'data': ['aes-128', 'aes-192', 'aes-256', 104 'des', '3des', 105 'cast5-128', 106 'serpent-128', 'serpent-192', 'serpent-256', 107 'twofish-128', 'twofish-192', 'twofish-256', 108 'sm4']} 109 110## 111# @QCryptoCipherMode: 112# 113# The supported modes for content encryption ciphers 114# 115# @ecb: Electronic Code Book 116# 117# @cbc: Cipher Block Chaining 118# 119# @xts: XEX with tweaked code book and ciphertext stealing 120# 121# @ctr: Counter (Since 2.8) 122# 123# Since: 2.6 124## 125{ 'enum': 'QCryptoCipherMode', 126 'prefix': 'QCRYPTO_CIPHER_MODE', 127 'data': ['ecb', 'cbc', 'xts', 'ctr']} 128 129## 130# @QCryptoIVGenAlgorithm: 131# 132# The supported algorithms for generating initialization vectors for 133# full disk encryption. The 'plain' generator should not be used for 134# disks with sector numbers larger than 2^32, except where 135# compatibility with pre-existing Linux dm-crypt volumes is required. 136# 137# @plain: 64-bit sector number truncated to 32-bits 138# 139# @plain64: 64-bit sector number 140# 141# @essiv: 64-bit sector number encrypted with a hash of the encryption 142# key 143# 144# Since: 2.6 145## 146{ 'enum': 'QCryptoIVGenAlgorithm', 147 'prefix': 'QCRYPTO_IVGEN_ALG', 148 'data': ['plain', 'plain64', 'essiv']} 149 150## 151# @QCryptoBlockFormat: 152# 153# The supported full disk encryption formats 154# 155# @qcow: QCow/QCow2 built-in AES-CBC encryption. Use only for 156# liberating data from old images. 157# 158# @luks: LUKS encryption format. Recommended for new images 159# 160# Since: 2.6 161## 162{ 'enum': 'QCryptoBlockFormat', 163# 'prefix': 'QCRYPTO_BLOCK_FORMAT', 164 'data': ['qcow', 'luks']} 165 166## 167# @QCryptoBlockOptionsBase: 168# 169# The common options that apply to all full disk encryption formats 170# 171# @format: the encryption format 172# 173# Since: 2.6 174## 175{ 'struct': 'QCryptoBlockOptionsBase', 176 'data': { 'format': 'QCryptoBlockFormat' }} 177 178## 179# @QCryptoBlockOptionsQCow: 180# 181# The options that apply to QCow/QCow2 AES-CBC encryption format 182# 183# @key-secret: the ID of a QCryptoSecret object providing the 184# decryption key. Mandatory except when probing image for 185# metadata only. 186# 187# Since: 2.6 188## 189{ 'struct': 'QCryptoBlockOptionsQCow', 190 'data': { '*key-secret': 'str' }} 191 192## 193# @QCryptoBlockOptionsLUKS: 194# 195# The options that apply to LUKS encryption format 196# 197# @key-secret: the ID of a QCryptoSecret object providing the 198# decryption key. Mandatory except when probing image for 199# metadata only. 200# 201# Since: 2.6 202## 203{ 'struct': 'QCryptoBlockOptionsLUKS', 204 'data': { '*key-secret': 'str' }} 205 206## 207# @QCryptoBlockCreateOptionsLUKS: 208# 209# The options that apply to LUKS encryption format initialization 210# 211# @cipher-alg: the cipher algorithm for data encryption Currently 212# defaults to 'aes-256'. 213# 214# @cipher-mode: the cipher mode for data encryption Currently defaults 215# to 'xts' 216# 217# @ivgen-alg: the initialization vector generator Currently defaults 218# to 'plain64' 219# 220# @ivgen-hash-alg: the initialization vector generator hash Currently 221# defaults to 'sha256' 222# 223# @hash-alg: the master key hash algorithm Currently defaults to 224# 'sha256' 225# 226# @iter-time: number of milliseconds to spend in PBKDF passphrase 227# processing. Currently defaults to 2000. (since 2.8) 228# 229# Since: 2.6 230## 231{ 'struct': 'QCryptoBlockCreateOptionsLUKS', 232 'base': 'QCryptoBlockOptionsLUKS', 233 'data': { '*cipher-alg': 'QCryptoCipherAlgorithm', 234 '*cipher-mode': 'QCryptoCipherMode', 235 '*ivgen-alg': 'QCryptoIVGenAlgorithm', 236 '*ivgen-hash-alg': 'QCryptoHashAlgorithm', 237 '*hash-alg': 'QCryptoHashAlgorithm', 238 '*iter-time': 'int'}} 239 240## 241# @QCryptoBlockOpenOptions: 242# 243# The options that are available for all encryption formats when 244# opening an existing volume 245# 246# Since: 2.6 247## 248{ 'union': 'QCryptoBlockOpenOptions', 249 'base': 'QCryptoBlockOptionsBase', 250 'discriminator': 'format', 251 'data': { 'qcow': 'QCryptoBlockOptionsQCow', 252 'luks': 'QCryptoBlockOptionsLUKS' } } 253 254## 255# @QCryptoBlockCreateOptions: 256# 257# The options that are available for all encryption formats when 258# initializing a new volume 259# 260# Since: 2.6 261## 262{ 'union': 'QCryptoBlockCreateOptions', 263 'base': 'QCryptoBlockOptionsBase', 264 'discriminator': 'format', 265 'data': { 'qcow': 'QCryptoBlockOptionsQCow', 266 'luks': 'QCryptoBlockCreateOptionsLUKS' } } 267 268## 269# @QCryptoBlockInfoBase: 270# 271# The common information that applies to all full disk encryption 272# formats 273# 274# @format: the encryption format 275# 276# Since: 2.7 277## 278{ 'struct': 'QCryptoBlockInfoBase', 279 'data': { 'format': 'QCryptoBlockFormat' }} 280 281## 282# @QCryptoBlockInfoLUKSSlot: 283# 284# Information about the LUKS block encryption key slot options 285# 286# @active: whether the key slot is currently in use 287# 288# @key-offset: offset to the key material in bytes 289# 290# @iters: number of PBKDF2 iterations for key material 291# 292# @stripes: number of stripes for splitting key material 293# 294# Since: 2.7 295## 296{ 'struct': 'QCryptoBlockInfoLUKSSlot', 297 'data': {'active': 'bool', 298 '*iters': 'int', 299 '*stripes': 'int', 300 'key-offset': 'int' } } 301 302## 303# @QCryptoBlockInfoLUKS: 304# 305# Information about the LUKS block encryption options 306# 307# @cipher-alg: the cipher algorithm for data encryption 308# 309# @cipher-mode: the cipher mode for data encryption 310# 311# @ivgen-alg: the initialization vector generator 312# 313# @ivgen-hash-alg: the initialization vector generator hash 314# 315# @hash-alg: the master key hash algorithm 316# 317# @payload-offset: offset to the payload data in bytes 318# 319# @master-key-iters: number of PBKDF2 iterations for key material 320# 321# @uuid: unique identifier for the volume 322# 323# @slots: information about each key slot 324# 325# Since: 2.7 326## 327{ 'struct': 'QCryptoBlockInfoLUKS', 328 'data': {'cipher-alg': 'QCryptoCipherAlgorithm', 329 'cipher-mode': 'QCryptoCipherMode', 330 'ivgen-alg': 'QCryptoIVGenAlgorithm', 331 '*ivgen-hash-alg': 'QCryptoHashAlgorithm', 332 'hash-alg': 'QCryptoHashAlgorithm', 333 'payload-offset': 'int', 334 'master-key-iters': 'int', 335 'uuid': 'str', 336 'slots': [ 'QCryptoBlockInfoLUKSSlot' ] }} 337 338## 339# @QCryptoBlockInfo: 340# 341# Information about the block encryption options 342# 343# Since: 2.7 344## 345{ 'union': 'QCryptoBlockInfo', 346 'base': 'QCryptoBlockInfoBase', 347 'discriminator': 'format', 348 'data': { 'luks': 'QCryptoBlockInfoLUKS' } } 349 350## 351# @QCryptoBlockLUKSKeyslotState: 352# 353# Defines state of keyslots that are affected by the update 354# 355# @active: The slots contain the given password and marked as active 356# 357# @inactive: The slots are erased (contain garbage) and marked as 358# inactive 359# 360# Since: 5.1 361## 362{ 'enum': 'QCryptoBlockLUKSKeyslotState', 363 'data': [ 'active', 'inactive' ] } 364 365## 366# @QCryptoBlockAmendOptionsLUKS: 367# 368# This struct defines the update parameters that activate/de-activate 369# set of keyslots 370# 371# @state: the desired state of the keyslots 372# 373# @new-secret: The ID of a QCryptoSecret object providing the password 374# to be written into added active keyslots 375# 376# @old-secret: Optional (for deactivation only) If given will 377# deactivate all keyslots that match password located in 378# QCryptoSecret with this ID 379# 380# @iter-time: Optional (for activation only) Number of milliseconds to 381# spend in PBKDF passphrase processing for the newly activated 382# keyslot. Currently defaults to 2000. 383# 384# @keyslot: Optional. ID of the keyslot to activate/deactivate. For 385# keyslot activation, keyslot should not be active already (this 386# is unsafe to update an active keyslot), but possible if 'force' 387# parameter is given. If keyslot is not given, first free keyslot 388# will be written. 389# 390# For keyslot deactivation, this parameter specifies the exact 391# keyslot to deactivate 392# 393# @secret: Optional. The ID of a QCryptoSecret object providing the 394# password to use to retrieve current master key. Defaults to the 395# same secret that was used to open the image 396# 397# Since: 5.1 398## 399{ 'struct': 'QCryptoBlockAmendOptionsLUKS', 400 'data': { 'state': 'QCryptoBlockLUKSKeyslotState', 401 '*new-secret': 'str', 402 '*old-secret': 'str', 403 '*keyslot': 'int', 404 '*iter-time': 'int', 405 '*secret': 'str' } } 406 407## 408# @QCryptoBlockAmendOptions: 409# 410# The options that are available for all encryption formats when 411# amending encryption settings 412# 413# Since: 5.1 414## 415{ 'union': 'QCryptoBlockAmendOptions', 416 'base': 'QCryptoBlockOptionsBase', 417 'discriminator': 'format', 418 'data': { 419 'luks': 'QCryptoBlockAmendOptionsLUKS' } } 420 421## 422# @SecretCommonProperties: 423# 424# Properties for objects of classes derived from secret-common. 425# 426# @loaded: if true, the secret is loaded immediately when applying 427# this option and will probably fail when processing the next 428# option. Don't use; only provided for compatibility. 429# (default: false) 430# 431# @format: the data format that the secret is provided in 432# (default: raw) 433# 434# @keyid: the name of another secret that should be used to decrypt 435# the provided data. If not present, the data is assumed to be 436# unencrypted. 437# 438# @iv: the random initialization vector used for encryption of this 439# particular secret. Should be a base64 encrypted string of the 440# 16-byte IV. Mandatory if @keyid is given. Ignored if @keyid is 441# absent. 442# 443# Features: 444# 445# @deprecated: Member @loaded is deprecated. Setting true doesn't 446# make sense, and false is already the default. 447# 448# Since: 2.6 449## 450{ 'struct': 'SecretCommonProperties', 451 'data': { '*loaded': { 'type': 'bool', 'features': ['deprecated'] }, 452 '*format': 'QCryptoSecretFormat', 453 '*keyid': 'str', 454 '*iv': 'str' } } 455 456## 457# @SecretProperties: 458# 459# Properties for secret objects. 460# 461# Either @data or @file must be provided, but not both. 462# 463# @data: the associated with the secret from 464# 465# @file: the filename to load the data associated with the secret from 466# 467# Since: 2.6 468## 469{ 'struct': 'SecretProperties', 470 'base': 'SecretCommonProperties', 471 'data': { '*data': 'str', 472 '*file': 'str' } } 473 474## 475# @SecretKeyringProperties: 476# 477# Properties for secret_keyring objects. 478# 479# @serial: serial number that identifies a key to get from the kernel 480# 481# Since: 5.1 482## 483{ 'struct': 'SecretKeyringProperties', 484 'base': 'SecretCommonProperties', 485 'data': { 'serial': 'int32' } } 486 487## 488# @TlsCredsProperties: 489# 490# Properties for objects of classes derived from tls-creds. 491# 492# @verify-peer: if true the peer credentials will be verified once the 493# handshake is completed. This is a no-op for anonymous 494# credentials. (default: true) 495# 496# @dir: the path of the directory that contains the credential files 497# 498# @endpoint: whether the QEMU network backend that uses the 499# credentials will be acting as a client or as a server 500# (default: client) 501# 502# @priority: a gnutls priority string as described at 503# https://gnutls.org/manual/html_node/Priority-Strings.html 504# 505# Since: 2.5 506## 507{ 'struct': 'TlsCredsProperties', 508 'data': { '*verify-peer': 'bool', 509 '*dir': 'str', 510 '*endpoint': 'QCryptoTLSCredsEndpoint', 511 '*priority': 'str' } } 512 513## 514# @TlsCredsAnonProperties: 515# 516# Properties for tls-creds-anon objects. 517# 518# @loaded: if true, the credentials are loaded immediately when 519# applying this option and will ignore options that are processed 520# later. Don't use; only provided for compatibility. 521# (default: false) 522# 523# Features: 524# 525# @deprecated: Member @loaded is deprecated. Setting true doesn't 526# make sense, and false is already the default. 527# 528# Since: 2.5 529## 530{ 'struct': 'TlsCredsAnonProperties', 531 'base': 'TlsCredsProperties', 532 'data': { '*loaded': { 'type': 'bool', 'features': ['deprecated'] } } } 533 534## 535# @TlsCredsPskProperties: 536# 537# Properties for tls-creds-psk objects. 538# 539# @loaded: if true, the credentials are loaded immediately when 540# applying this option and will ignore options that are processed 541# later. Don't use; only provided for compatibility. 542# (default: false) 543# 544# @username: the username which will be sent to the server. For 545# clients only. If absent, "qemu" is sent and the property will 546# read back as an empty string. 547# 548# Features: 549# 550# @deprecated: Member @loaded is deprecated. Setting true doesn't 551# make sense, and false is already the default. 552# 553# Since: 3.0 554## 555{ 'struct': 'TlsCredsPskProperties', 556 'base': 'TlsCredsProperties', 557 'data': { '*loaded': { 'type': 'bool', 'features': ['deprecated'] }, 558 '*username': 'str' } } 559 560## 561# @TlsCredsX509Properties: 562# 563# Properties for tls-creds-x509 objects. 564# 565# @loaded: if true, the credentials are loaded immediately when 566# applying this option and will ignore options that are processed 567# later. Don't use; only provided for compatibility. 568# (default: false) 569# 570# @sanity-check: if true, perform some sanity checks before using the 571# credentials (default: true) 572# 573# @passwordid: For the server-key.pem and client-key.pem files which 574# contain sensitive private keys, it is possible to use an 575# encrypted version by providing the @passwordid parameter. This 576# provides the ID of a previously created secret object containing 577# the password for decryption. 578# 579# Features: 580# 581# @deprecated: Member @loaded is deprecated. Setting true doesn't 582# make sense, and false is already the default. 583# 584# Since: 2.5 585## 586{ 'struct': 'TlsCredsX509Properties', 587 'base': 'TlsCredsProperties', 588 'data': { '*loaded': { 'type': 'bool', 'features': ['deprecated'] }, 589 '*sanity-check': 'bool', 590 '*passwordid': 'str' } } 591## 592# @QCryptoAkCipherAlgorithm: 593# 594# The supported algorithms for asymmetric encryption ciphers 595# 596# @rsa: RSA algorithm 597# 598# Since: 7.1 599## 600{ 'enum': 'QCryptoAkCipherAlgorithm', 601 'prefix': 'QCRYPTO_AKCIPHER_ALG', 602 'data': ['rsa']} 603 604## 605# @QCryptoAkCipherKeyType: 606# 607# The type of asymmetric keys. 608# 609# Since: 7.1 610## 611{ 'enum': 'QCryptoAkCipherKeyType', 612 'prefix': 'QCRYPTO_AKCIPHER_KEY_TYPE', 613 'data': ['public', 'private']} 614 615## 616# @QCryptoRSAPaddingAlgorithm: 617# 618# The padding algorithm for RSA. 619# 620# @raw: no padding used 621# 622# @pkcs1: pkcs1#v1.5 623# 624# Since: 7.1 625## 626{ 'enum': 'QCryptoRSAPaddingAlgorithm', 627 'prefix': 'QCRYPTO_RSA_PADDING_ALG', 628 'data': ['raw', 'pkcs1']} 629 630## 631# @QCryptoAkCipherOptionsRSA: 632# 633# Specific parameters for RSA algorithm. 634# 635# @hash-alg: QCryptoHashAlgorithm 636# 637# @padding-alg: QCryptoRSAPaddingAlgorithm 638# 639# Since: 7.1 640## 641{ 'struct': 'QCryptoAkCipherOptionsRSA', 642 'data': { 'hash-alg':'QCryptoHashAlgorithm', 643 'padding-alg': 'QCryptoRSAPaddingAlgorithm'}} 644 645## 646# @QCryptoAkCipherOptions: 647# 648# The options that are available for all asymmetric key algorithms 649# when creating a new QCryptoAkCipher. 650# 651# Since: 7.1 652## 653{ 'union': 'QCryptoAkCipherOptions', 654 'base': { 'alg': 'QCryptoAkCipherAlgorithm' }, 655 'discriminator': 'alg', 656 'data': { 'rsa': 'QCryptoAkCipherOptionsRSA' }} 657