| /linux/tools/perf/pmu-events/arch/s390/cf_z16/ |
| H A D | pai_crypto.json | 34 "BriefDescription": "KM ENCRYPTED DEA",
35 "PublicDescription": "KM-Encrypted-DEA function ending with CC=0"
41 "BriefDescription": "KM ENCRYPTED TDEA 128",
42 "PublicDescription": "KM-Encrypted-TDEA-128 function ending with CC=0"
48 "BriefDescription": "KM ENCRYPTED TDEA 192",
49 "PublicDescription": "KM-Encrypted-TDEA-192 function ending with CC=0"
76 "BriefDescription": "KM ENCRYPTED AES 128",
77 "PublicDescription": "KM-Encrypted-AES-128 function ending with CC=0"
83 "BriefDescription": "KM ENCRYPTED AES 192",
84 "PublicDescription": "KM-Encrypted-AES-192 function ending with CC=0"
[all …]
|
| /linux/tools/perf/pmu-events/arch/s390/cf_z17/ |
| H A D | pai_crypto.json | 34 "BriefDescription": "KM ENCRYPTED DEA",
35 "PublicDescription": "KM-Encrypted-DEA function ending with CC=0"
41 "BriefDescription": "KM ENCRYPTED TDEA 128",
42 "PublicDescription": "KM-Encrypted-TDEA-128 function ending with CC=0"
48 "BriefDescription": "KM ENCRYPTED TDEA 192",
49 "PublicDescription": "KM-Encrypted-TDEA-192 function ending with CC=0"
76 "BriefDescription": "KM ENCRYPTED AES 128",
77 "PublicDescription": "KM-Encrypted-AES-128 function ending with CC=0"
83 "BriefDescription": "KM ENCRYPTED AES 192",
84 "PublicDescription": "KM-Encrypted-AES-192 function ending with CC=0"
[all …]
|
| /linux/Documentation/security/keys/ |
| H A D | ecryptfs.rst | 2 Encrypted keys for the eCryptfs filesystem
8 Each FEK is in turn encrypted with a File Encryption Key Encryption Key (FEKEK)
12 the FEK is encrypted by 'ecryptfsd' with the help of external libraries in order
22 The 'encrypted' key type has been extended with the introduction of the new
24 filesystem. Encrypted keys of the newly introduced format store an
31 encrypted form.
33 The eCryptfs filesystem may really benefit from using encrypted keys in that the
42 keyctl add encrypted name "new ecryptfs key-type:master-key-name keylen" ring
43 keyctl add encrypted name "load hex_blob" ring
53 Example of encrypted key usage with the eCryptfs filesystem:
[all …]
|
| H A D | trusted-encrypted.rst | 2 Trusted and Encrypted Keys
5 Trusted and Encrypted Keys are two new key types added to the existing kernel
8 stores, and loads only encrypted blobs. Trusted Keys require the availability
9 of a Trust Source for greater security, while Encrypted Keys can be used on any
133 New keys are created from random numbers. They are encrypted/decrypted using
166 Encrypted Keys
169 Encrypted keys do not depend on a trust source, and are faster, as they use AES
171 random numbers or user-provided decrypted data, and are encrypted/decrypted
173 user-key type. The main disadvantage of encrypted keys is that if they are not
278 Encrypted Keys usage
[all …]
|
| /linux/fs/crypto/ |
| H A D | hooks.c | 13 * fscrypt_file_open() - prepare to open a possibly-encrypted regular file
17 * Currently, an encrypted regular file can only be opened if its encryption key
18 * is available; access to the raw encrypted contents is not supported.
23 * is being opened) is encrypted, then the inode being opened uses the same
25 * in an encrypted directory tree use the same encryption policy, as a
28 * an unencrypted file in an encrypted directory.
50 * unencrypted, or encrypted with any policy). Only continue on to the in fscrypt_file_open()
51 * full policy check if the parent directory is actually encrypted. in fscrypt_file_open()
135 * @dir: the encrypted directory being searched
194 * When the CASEFOLD flag is set on an encrypted directory, we must in fscrypt_prepare_setflags()
[all …]
|
| H A D | fname.c | 25 * before being encrypted.
32 * When userspace lists an encrypted directory without access to the key, the
87 * @out: (output) the encrypted filename
88 * @olen: size of the encrypted filename. It must be at least @iname->len.
130 * @iname: the encrypted filename to decrypt
260 * fscrypt_fname_encrypted_size() - calculate length of encrypted filename
261 * @inode: parent inode of dentry name being encrypted. Key must
285 * @max_encrypted_len: maximum length of encrypted filenames the buffer will be
290 * filename (null-terminated), for the given maximum encrypted filename length.
324 * fscrypt_fname_disk_to_usr() - convert an encrypted filename to
[all …]
|
| /linux/arch/x86/mm/ |
| H A D | mem_encrypt_boot.S | 23 * RDI - virtual address for the encrypted mapping
36 /* Set up a one page stack in the non-encrypted memory area */
42 movq %rdi, %r10 /* Encrypted area */
53 movq %r10, %rdi /* Encrypted area */
79 * the kernel will be encrypted during the process. So this
85 * RDI - virtual address for the encrypted mapping
93 * The area will be encrypted by copying from the non-encrypted
95 * intermediate buffer back to the encrypted memory space. The physical
97 * being encrypted "in place".
113 movq %rdi, %r10 /* Save encrypted area address */
[all …]
|
| /linux/Documentation/filesystems/ |
| H A D | fscrypt.rst | 35 and CephFS. This allows encrypted files to be read and written
36 without caching both the decrypted and encrypted pages in the
39 inodes are needed. eCryptfs also limits encrypted filenames to 143
45 supports marking an empty directory as encrypted. Then, after
48 encrypted.
125 "locked", i.e. in ciphertext or encrypted form.
131 encrypted files and directories before removing a master key, as
133 encrypted directory.
179 with another user's encrypted files to which they have read-only
192 policies on all new encrypted directories.
[all …]
|
| /linux/security/keys/encrypted-keys/ |
| H A D | Makefile | 3 # Makefile for encrypted keys
6 obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted-keys.o
8 encrypted-keys-y := encrypted.o ecryptfs_format.o
11 encrypted-keys-y += $(masterkey-y) $(masterkey-m-m)
|
| H A D | masterkey_trusted.c | 11 * See Documentation/security/keys/trusted-encrypted.rst
17 #include <keys/encrypted-type.h>
18 #include "encrypted.h"
24 * manages both trusted/encrypted key-types, like the encrypted key type
|
| H A D | encrypted.c | 11 * See Documentation/security/keys/trusted-encrypted.rst
23 #include <keys/encrypted-type.h>
34 #include "encrypted.h"
79 "Allow instantiation of encrypted keys using provided decrypted data");
98 * valid_ecryptfs_desc - verify the description of a new/loaded encrypted key in aes_get_sizes()
100 * The description of a encrypted key with format 'ecryptfs' must contain in aes_get_sizes()
163 * <encrypted iv + data>
289 /* convert the hex encoded iv, encrypted-data and HMAC to ascii */ in datablob_format()
300 * Use a user provided key to encrypt/decrypt an encrypted-key. in datablob_format()
488 /* verify HMAC before decrypting encrypted ke in derived_key_encrypt()
[all...] |
| /linux/security/keys/ |
| H A D | Kconfig | 76 Userspace will only ever see encrypted blobs.
85 tristate "ENCRYPTED KEYS"
93 in the kernel. Encrypted keys are instantiated using kernel
95 encrypted/decrypted with a 'master' symmetric key. The 'master'
96 key can be either a trusted-key or user-key type. Only encrypted
102 bool "Allow encrypted keys with user decrypted data"
105 This option provides support for instantiating encrypted keys using
|
| /linux/Documentation/driver-api/nvdimm/ |
| H A D | security.rst | 51 A nvdimm encrypted-key of format enc32 has the description format of:
54 See file ``Documentation/security/keys/trusted-encrypted.rst`` for creating
55 encrypted-keys of enc32 format. TPM usage with a master trusted key is
56 preferred for sealing the encrypted-keys.
64 relevant encrypted-keys into the kernel user keyring during the initramfs phase.
115 An encrypted-key with the current user passphrase that is tied to the nvdimm
125 is just another encrypted-key.
136 another encrypted-key.
|
| /linux/Documentation/virt/kvm/s390/ |
| H A D | s390-pv-boot.rst | 12 Memory made accessible to the hypervisor will be encrypted. See
16 information about the encrypted components and necessary metadata to
27 switch into PV mode itself, the user can load encrypted guest
59 The components are for instance an encrypted kernel, kernel parameters
62 After the initial import of the encrypted data, all defined pages will
82 encrypted images.
|
| H A D | s390-pv-dump.rst | 20 provides an interface to KVM over which encrypted CPU and memory data
34 and extracts dump keys with which the VM dump data will be encrypted.
46 write out the encrypted vcpu state, but also the unencrypted state
49 The memory state is further divided into the encrypted memory and its
51 encrypted memory can simply be read once it has been exported. The
|
| /linux/net/tls/ |
| H A D | trace.h | 47 bool encrypted, bool decrypted),
49 TP_ARGS(sk, tcp_seq, rec_no, rec_len, encrypted, decrypted),
56 __field( bool, encrypted )
65 __entry->encrypted = encrypted;
70 "sk=%p tcp_seq=%u rec_no=%llu len=%u encrypted=%d decrypted=%d",
73 __entry->encrypted, __entry->decrypted
|
| /linux/Documentation/admin-guide/device-mapper/ |
| H A D | dm-crypt.rst | 70 Either 'logon', 'user', 'encrypted' or 'trusted' kernel key type.
78 then sectors are encrypted according to their offsets (sector 0 uses key0;
87 encrypted data. You can specify it as a path like /dev/xxx or a device
91 Starting sector within the device where the encrypted data begins.
106 option. For example, allowing discards on encrypted devices may lead to
146 integrity for the encrypted device. The additional space is then
177 concurrency (the split requests could be encrypted in parallel by multiple
184 concurrency (the split requests could be encrypted in parallel by multiple
|
| /linux/net/rxrpc/ |
| H A D | rxkad.c | 716 response->encrypted.checksum = htonl(csum); in rxkad_send_response()
729 size_t encsize = sizeof(((struct rxkad_response *)0)->encrypted); in rxkad_send_response()
735 offsetof(struct rxkad_response, encrypted), encsize); in rxkad_send_response()
838 h.resp.encrypted.epoch = htonl(conn->proto.epoch); in rxkad_respond_to_challenge()
839 h.resp.encrypted.cid = htonl(conn->proto.cid); in rxkad_respond_to_challenge()
840 h.resp.encrypted.checksum = 0; in rxkad_respond_to_challenge()
841 h.resp.encrypted.securityIndex = htonl(conn->security_ix); in rxkad_respond_to_challenge()
842 h.resp.encrypted.call_id[0] = htonl(conn->channels[0].call_counter); in rxkad_respond_to_challenge()
843 h.resp.encrypted.call_id[1] = htonl(conn->channels[1].call_counter); in rxkad_respond_to_challenge()
844 h.resp.encrypted in rxkad_respond_to_challenge()
[all...] |
| /linux/Documentation/process/ |
| H A D | embargoed-hardware-issues.rst | 38 The list is encrypted and email to the list can be sent by either PGP or
39 S/MIME encrypted and must be signed with the reporter's PGP key or S/MIME
62 The encrypted mailing-lists which are used in our process are hosted on
120 other factors and should be only used when absolutely necessary. Encrypted
135 The hardware security team will provide an incident-specific encrypted
172 team via the specific encrypted mailing-list.
181 The initial response team sets up an encrypted mailing-list or repurposes
319 Encrypted mailing-lists
322 We use encrypted mailing lists for communication. The operating principle
323 of these lists is that email sent to the list is encrypted either with the
[all …]
|
| /linux/include/linux/ |
| H A D | fscrypt.h | 185 * filesystem may write encrypted file contents, NULL if the filesystem
193 * devices that aren't used for encrypted file contents, such as
249 * Return: %true iff the inode is an encrypted regular file and the kernel was
291 * dentry that was created in an encrypted directory that hasn't had its
294 * When a filesystem is asked to create a new filename in an encrypted directory
333 * Unencrypted dentries and encrypted dentries where the in fscrypt_prepare_dentry()
930 * @inode: an inode. If encrypted, its key must be set up.
945 * @inode: an inode. If encrypted, its key must be set up.
972 * fscrypt_prepare_link() - prepare to link an inode into a possibly-encrypted
978 * A new link can only be added to an encrypted directory if the directory's
[all …]
|
| /linux/arch/x86/kvm/ |
| H A D | Kconfig | 156 bool "AMD Secure Encrypted Virtualization (SEV) support"
166 Provides support for launching encrypted VMs which use Secure
167 Encrypted Virtualization (SEV), Secure Encrypted Virtualization with
168 Encrypted State (SEV-ES), and Secure Encrypted Virtualization with
|
| /linux/arch/x86/boot/startup/ |
| H A D | sme.c | 86 * By using this section, the kernel can be encrypted in place and it
309 * by the kernel and initrd as encrypted. in sme_encrypt_kernel()
350 * One PGD for both encrypted and decrypted mappings and a set of in sme_encrypt_kernel()
351 * PUDs and PMDs for each of the encrypted and decrypted mappings. in sme_encrypt_kernel()
375 * pagetables and when the new encrypted and decrypted kernel in sme_encrypt_kernel()
395 * and initrd to be encrypted. It starts with an empty PGD that will in sme_encrypt_kernel()
396 * then be populated with new PUDs and PMDs as the encrypted and in sme_encrypt_kernel()
418 /* Add encrypted kernel (identity) mappings */ in sme_encrypt_kernel()
431 /* Add encrypted initrd (identity) mappings */ in sme_encrypt_kernel()
466 * At this point we are running encrypted. Remove the mappings for in sme_encrypt_kernel()
[all …]
|
| /linux/Documentation/power/ |
| H A D | swsusp-dmcrypt.rst | 16 Now your system is properly set up, your disk is encrypted except for
26 up dm-crypt and then asks swsusp to resume from the encrypted
56 card contains at least the encrypted swap setup in a file
67 initrd that allows you to resume from encrypted swap and that
133 Otherwise we just remove the encrypted swap device and leave it to the
|
| /linux/arch/x86/coco/ |
| H A D | core.c | 66 * will access all memory as encrypted. So, when APs are being brought
67 * up under SME the trampoline area cannot be encrypted, whereas under SEV
68 * the trampoline area must be encrypted.
137 * - for AMD, bit *set* means the page is encrypted in cc_mkenc()
138 * - for AMD with vTOM and for Intel, *clear* means encrypted in cc_mkenc()
|
| /linux/Documentation/networking/ |
| H A D | tls.rst | 70 socket is encrypted using TLS and the parameters provided in the socket option.
71 For example, we can send an encrypted hello world record as follows:
78 send() data is directly encrypted from the userspace buffer provided
79 to the encrypted kernel send buffer if possible.
94 The kernel will need to allocate a buffer for the encrypted data.
164 encrypted by the kernel.
210 encrypted using the new key. The userspace library can pass the new
|