1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2005-2011 Pawel Jakub Dawidek <pawel@dawidek.net>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/param.h>
30 #ifdef _KERNEL
31 #include <sys/malloc.h>
32 #include <sys/systm.h>
33 #include <geom/geom.h>
34 #else
35 #include <stdio.h>
36 #include <stdint.h>
37 #include <stdlib.h>
38 #include <string.h>
39 #include <strings.h>
40 #include <errno.h>
41 #endif
42
43 #include <geom/eli/g_eli.h>
44
45 #ifdef _KERNEL
46 MALLOC_DECLARE(M_ELI);
47 #endif
48
49 /*
50 * Verify if the given 'key' is correct.
51 * Return 1 if it is correct and 0 otherwise.
52 */
53 static int
g_eli_mkey_verify(const unsigned char * mkey,const unsigned char * key)54 g_eli_mkey_verify(const unsigned char *mkey, const unsigned char *key)
55 {
56 const unsigned char *odhmac; /* On-disk HMAC. */
57 unsigned char chmac[SHA512_MDLEN]; /* Calculated HMAC. */
58 unsigned char hmkey[SHA512_MDLEN]; /* Key for HMAC. */
59
60 /*
61 * The key for HMAC calculations is: hmkey = HMAC_SHA512(Derived-Key, 0)
62 */
63 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x00", 1, hmkey, 0);
64
65 odhmac = mkey + G_ELI_DATAIVKEYLEN;
66
67 /* Calculate HMAC from Data-Key and IV-Key. */
68 g_eli_crypto_hmac(hmkey, sizeof(hmkey), mkey, G_ELI_DATAIVKEYLEN,
69 chmac, 0);
70
71 explicit_bzero(hmkey, sizeof(hmkey));
72
73 /*
74 * Compare calculated HMAC with HMAC from metadata.
75 * If two HMACs are equal, 'key' is correct.
76 */
77 return (!bcmp(odhmac, chmac, SHA512_MDLEN));
78 }
79
80 /*
81 * Calculate HMAC from Data-Key and IV-Key.
82 */
83 void
g_eli_mkey_hmac(unsigned char * mkey,const unsigned char * key)84 g_eli_mkey_hmac(unsigned char *mkey, const unsigned char *key)
85 {
86 unsigned char hmkey[SHA512_MDLEN]; /* Key for HMAC. */
87 unsigned char *odhmac; /* On-disk HMAC. */
88
89 /*
90 * The key for HMAC calculations is: hmkey = HMAC_SHA512(Derived-Key, 0)
91 */
92 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x00", 1, hmkey, 0);
93
94 odhmac = mkey + G_ELI_DATAIVKEYLEN;
95 /* Calculate HMAC from Data-Key and IV-Key. */
96 g_eli_crypto_hmac(hmkey, sizeof(hmkey), mkey, G_ELI_DATAIVKEYLEN,
97 odhmac, 0);
98
99 explicit_bzero(hmkey, sizeof(hmkey));
100 }
101
102 /*
103 * Find and decrypt Master Key encrypted with 'key' at slot 'nkey'.
104 * Return 0 on success, > 0 on failure, -1 on bad key.
105 */
106 int
g_eli_mkey_decrypt(const struct g_eli_metadata * md,const unsigned char * key,unsigned char * mkey,unsigned nkey)107 g_eli_mkey_decrypt(const struct g_eli_metadata *md, const unsigned char *key,
108 unsigned char *mkey, unsigned nkey)
109 {
110 unsigned char tmpmkey[G_ELI_MKEYLEN];
111 unsigned char enckey[SHA512_MDLEN]; /* Key for encryption. */
112 const unsigned char *mmkey;
113 int bit, error;
114
115 if (nkey > G_ELI_MKEYLEN)
116 return (-1);
117
118 /*
119 * The key for encryption is: enckey = HMAC_SHA512(Derived-Key, 1)
120 */
121 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x01", 1, enckey, 0);
122
123 mmkey = md->md_mkeys + G_ELI_MKEYLEN * nkey;
124 bit = (1 << nkey);
125 if (!(md->md_keys & bit))
126 return (-1);
127 bcopy(mmkey, tmpmkey, G_ELI_MKEYLEN);
128 error = g_eli_crypto_decrypt(md->md_ealgo, tmpmkey,
129 G_ELI_MKEYLEN, enckey, md->md_keylen);
130 if (error != 0) {
131 explicit_bzero(tmpmkey, sizeof(tmpmkey));
132 explicit_bzero(enckey, sizeof(enckey));
133 return (error);
134 }
135 if (g_eli_mkey_verify(tmpmkey, key)) {
136 bcopy(tmpmkey, mkey, G_ELI_DATAIVKEYLEN);
137 explicit_bzero(tmpmkey, sizeof(tmpmkey));
138 explicit_bzero(enckey, sizeof(enckey));
139 return (0);
140 }
141 explicit_bzero(enckey, sizeof(enckey));
142 explicit_bzero(tmpmkey, sizeof(tmpmkey));
143
144 return (-1);
145 }
146
147 /*
148 * Find and decrypt Master Key encrypted with 'key'.
149 * Return decrypted Master Key number in 'nkeyp' if not NULL.
150 * Return 0 on success, > 0 on failure, -1 on bad key.
151 */
152 int
g_eli_mkey_decrypt_any(const struct g_eli_metadata * md,const unsigned char * key,unsigned char * mkey,unsigned * nkeyp)153 g_eli_mkey_decrypt_any(const struct g_eli_metadata *md,
154 const unsigned char *key, unsigned char *mkey, unsigned *nkeyp)
155 {
156 int error, nkey;
157
158 if (nkeyp != NULL)
159 *nkeyp = -1;
160
161 error = -1;
162 for (nkey = 0; nkey < G_ELI_MAXMKEYS; nkey++) {
163 error = g_eli_mkey_decrypt(md, key, mkey, nkey);
164 if (error == 0) {
165 if (nkeyp != NULL)
166 *nkeyp = nkey;
167 break;
168 } else if (error > 0) {
169 break;
170 }
171 }
172
173 return (error);
174 }
175
176 /*
177 * Encrypt the Master-Key and calculate HMAC to be able to verify it in the
178 * future.
179 */
180 int
g_eli_mkey_encrypt(unsigned algo,const unsigned char * key,unsigned keylen,unsigned char * mkey)181 g_eli_mkey_encrypt(unsigned algo, const unsigned char *key, unsigned keylen,
182 unsigned char *mkey)
183 {
184 unsigned char enckey[SHA512_MDLEN]; /* Key for encryption. */
185 int error;
186
187 /*
188 * To calculate HMAC, the whole key (G_ELI_USERKEYLEN bytes long) will
189 * be used.
190 */
191 g_eli_mkey_hmac(mkey, key);
192 /*
193 * The key for encryption is: enckey = HMAC_SHA512(Derived-Key, 1)
194 */
195 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x01", 1, enckey, 0);
196 /*
197 * Encrypt the Master-Key and HMAC() result with the given key (this
198 * time only 'keylen' bits from the key are used).
199 */
200 error = g_eli_crypto_encrypt(algo, mkey, G_ELI_MKEYLEN, enckey, keylen);
201
202 explicit_bzero(enckey, sizeof(enckey));
203
204 return (error);
205 }
206
207 #ifdef _KERNEL
208 /*
209 * When doing encryption only, copy IV key and encryption key.
210 * When doing encryption and authentication, copy IV key, generate encryption
211 * key and generate authentication key.
212 */
213 void
g_eli_mkey_propagate(struct g_eli_softc * sc,const unsigned char * mkey)214 g_eli_mkey_propagate(struct g_eli_softc *sc, const unsigned char *mkey)
215 {
216
217 /* Remember the Master Key. */
218 bcopy(mkey, sc->sc_mkey, sizeof(sc->sc_mkey));
219
220 bcopy(mkey, sc->sc_ivkey, sizeof(sc->sc_ivkey));
221 mkey += sizeof(sc->sc_ivkey);
222
223 /*
224 * The authentication key is: akey = HMAC_SHA512(Data-Key, 0x11)
225 */
226 if ((sc->sc_flags & G_ELI_FLAG_AUTH) != 0) {
227 g_eli_crypto_hmac(mkey, G_ELI_MAXKEYLEN, "\x11", 1,
228 sc->sc_akey, 0);
229 } else {
230 arc4rand(sc->sc_akey, sizeof(sc->sc_akey), 0);
231 }
232
233 /* Initialize encryption keys. */
234 g_eli_key_init(sc);
235
236 if ((sc->sc_flags & G_ELI_FLAG_AUTH) != 0) {
237 /*
238 * Precalculate SHA256 for HMAC key generation.
239 * This is expensive operation and we can do it only once now or
240 * for every access to sector, so now will be much better.
241 */
242 SHA256_Init(&sc->sc_akeyctx);
243 SHA256_Update(&sc->sc_akeyctx, sc->sc_akey,
244 sizeof(sc->sc_akey));
245 }
246 /*
247 * Precalculate SHA256 for IV generation.
248 * This is expensive operation and we can do it only once now or for
249 * every access to sector, so now will be much better.
250 */
251 switch (sc->sc_ealgo) {
252 case CRYPTO_AES_XTS:
253 break;
254 default:
255 SHA256_Init(&sc->sc_ivctx);
256 SHA256_Update(&sc->sc_ivctx, sc->sc_ivkey,
257 sizeof(sc->sc_ivkey));
258 break;
259 }
260 }
261 #endif
262