1/*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2005-2011 Pawel Jakub Dawidek <pawel@dawidek.net> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29#include <sys/param.h> 30#ifdef _KERNEL 31#include <sys/malloc.h> 32#include <sys/systm.h> 33#include <geom/geom.h> 34#else 35#include <stdio.h> 36#include <stdint.h> 37#include <stdlib.h> 38#include <string.h> 39#include <strings.h> 40#include <errno.h> 41#endif 42 43#include <geom/eli/g_eli.h> 44 45#ifdef _KERNEL 46MALLOC_DECLARE(M_ELI); 47#endif 48 49/* 50 * Verify if the given 'key' is correct. 51 * Return 1 if it is correct and 0 otherwise. 52 */ 53static int 54g_eli_mkey_verify(const unsigned char *mkey, const unsigned char *key) 55{ 56 const unsigned char *odhmac; /* On-disk HMAC. */ 57 unsigned char chmac[SHA512_MDLEN]; /* Calculated HMAC. */ 58 unsigned char hmkey[SHA512_MDLEN]; /* Key for HMAC. */ 59 60 /* 61 * The key for HMAC calculations is: hmkey = HMAC_SHA512(Derived-Key, 0) 62 */ 63 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x00", 1, hmkey, 0); 64 65 odhmac = mkey + G_ELI_DATAIVKEYLEN; 66 67 /* Calculate HMAC from Data-Key and IV-Key. */ 68 g_eli_crypto_hmac(hmkey, sizeof(hmkey), mkey, G_ELI_DATAIVKEYLEN, 69 chmac, 0); 70 71 explicit_bzero(hmkey, sizeof(hmkey)); 72 73 /* 74 * Compare calculated HMAC with HMAC from metadata. 75 * If two HMACs are equal, 'key' is correct. 76 */ 77 return (!bcmp(odhmac, chmac, SHA512_MDLEN)); 78} 79 80/* 81 * Calculate HMAC from Data-Key and IV-Key. 82 */ 83void 84g_eli_mkey_hmac(unsigned char *mkey, const unsigned char *key) 85{ 86 unsigned char hmkey[SHA512_MDLEN]; /* Key for HMAC. */ 87 unsigned char *odhmac; /* On-disk HMAC. */ 88 89 /* 90 * The key for HMAC calculations is: hmkey = HMAC_SHA512(Derived-Key, 0) 91 */ 92 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x00", 1, hmkey, 0); 93 94 odhmac = mkey + G_ELI_DATAIVKEYLEN; 95 /* Calculate HMAC from Data-Key and IV-Key. */ 96 g_eli_crypto_hmac(hmkey, sizeof(hmkey), mkey, G_ELI_DATAIVKEYLEN, 97 odhmac, 0); 98 99 explicit_bzero(hmkey, sizeof(hmkey)); 100} 101 102/* 103 * Find and decrypt Master Key encrypted with 'key' at slot 'nkey'. 104 * Return 0 on success, > 0 on failure, -1 on bad key. 105 */ 106int 107g_eli_mkey_decrypt(const struct g_eli_metadata *md, const unsigned char *key, 108 unsigned char *mkey, unsigned nkey) 109{ 110 unsigned char tmpmkey[G_ELI_MKEYLEN]; 111 unsigned char enckey[SHA512_MDLEN]; /* Key for encryption. */ 112 const unsigned char *mmkey; 113 int bit, error; 114 115 if (nkey > G_ELI_MKEYLEN) 116 return (-1); 117 118 /* 119 * The key for encryption is: enckey = HMAC_SHA512(Derived-Key, 1) 120 */ 121 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x01", 1, enckey, 0); 122 123 mmkey = md->md_mkeys + G_ELI_MKEYLEN * nkey; 124 bit = (1 << nkey); 125 if (!(md->md_keys & bit)) 126 return (-1); 127 bcopy(mmkey, tmpmkey, G_ELI_MKEYLEN); 128 error = g_eli_crypto_decrypt(md->md_ealgo, tmpmkey, 129 G_ELI_MKEYLEN, enckey, md->md_keylen); 130 if (error != 0) { 131 explicit_bzero(tmpmkey, sizeof(tmpmkey)); 132 explicit_bzero(enckey, sizeof(enckey)); 133 return (error); 134 } 135 if (g_eli_mkey_verify(tmpmkey, key)) { 136 bcopy(tmpmkey, mkey, G_ELI_DATAIVKEYLEN); 137 explicit_bzero(tmpmkey, sizeof(tmpmkey)); 138 explicit_bzero(enckey, sizeof(enckey)); 139 return (0); 140 } 141 explicit_bzero(enckey, sizeof(enckey)); 142 explicit_bzero(tmpmkey, sizeof(tmpmkey)); 143 144 return (-1); 145} 146 147/* 148 * Find and decrypt Master Key encrypted with 'key'. 149 * Return decrypted Master Key number in 'nkeyp' if not NULL. 150 * Return 0 on success, > 0 on failure, -1 on bad key. 151 */ 152int 153g_eli_mkey_decrypt_any(const struct g_eli_metadata *md, 154 const unsigned char *key, unsigned char *mkey, unsigned *nkeyp) 155{ 156 int error, nkey; 157 158 if (nkeyp != NULL) 159 *nkeyp = -1; 160 161 error = -1; 162 for (nkey = 0; nkey < G_ELI_MAXMKEYS; nkey++) { 163 error = g_eli_mkey_decrypt(md, key, mkey, nkey); 164 if (error == 0) { 165 if (nkeyp != NULL) 166 *nkeyp = nkey; 167 break; 168 } else if (error > 0) { 169 break; 170 } 171 } 172 173 return (error); 174} 175 176/* 177 * Encrypt the Master-Key and calculate HMAC to be able to verify it in the 178 * future. 179 */ 180int 181g_eli_mkey_encrypt(unsigned algo, const unsigned char *key, unsigned keylen, 182 unsigned char *mkey) 183{ 184 unsigned char enckey[SHA512_MDLEN]; /* Key for encryption. */ 185 int error; 186 187 /* 188 * To calculate HMAC, the whole key (G_ELI_USERKEYLEN bytes long) will 189 * be used. 190 */ 191 g_eli_mkey_hmac(mkey, key); 192 /* 193 * The key for encryption is: enckey = HMAC_SHA512(Derived-Key, 1) 194 */ 195 g_eli_crypto_hmac(key, G_ELI_USERKEYLEN, "\x01", 1, enckey, 0); 196 /* 197 * Encrypt the Master-Key and HMAC() result with the given key (this 198 * time only 'keylen' bits from the key are used). 199 */ 200 error = g_eli_crypto_encrypt(algo, mkey, G_ELI_MKEYLEN, enckey, keylen); 201 202 explicit_bzero(enckey, sizeof(enckey)); 203 204 return (error); 205} 206 207#ifdef _KERNEL 208/* 209 * When doing encryption only, copy IV key and encryption key. 210 * When doing encryption and authentication, copy IV key, generate encryption 211 * key and generate authentication key. 212 */ 213void 214g_eli_mkey_propagate(struct g_eli_softc *sc, const unsigned char *mkey) 215{ 216 217 /* Remember the Master Key. */ 218 bcopy(mkey, sc->sc_mkey, sizeof(sc->sc_mkey)); 219 220 bcopy(mkey, sc->sc_ivkey, sizeof(sc->sc_ivkey)); 221 mkey += sizeof(sc->sc_ivkey); 222 223 /* 224 * The authentication key is: akey = HMAC_SHA512(Data-Key, 0x11) 225 */ 226 if ((sc->sc_flags & G_ELI_FLAG_AUTH) != 0) { 227 g_eli_crypto_hmac(mkey, G_ELI_MAXKEYLEN, "\x11", 1, 228 sc->sc_akey, 0); 229 } else { 230 arc4rand(sc->sc_akey, sizeof(sc->sc_akey), 0); 231 } 232 233 /* Initialize encryption keys. */ 234 g_eli_key_init(sc); 235 236 if ((sc->sc_flags & G_ELI_FLAG_AUTH) != 0) { 237 /* 238 * Precalculate SHA256 for HMAC key generation. 239 * This is expensive operation and we can do it only once now or 240 * for every access to sector, so now will be much better. 241 */ 242 SHA256_Init(&sc->sc_akeyctx); 243 SHA256_Update(&sc->sc_akeyctx, sc->sc_akey, 244 sizeof(sc->sc_akey)); 245 } 246 /* 247 * Precalculate SHA256 for IV generation. 248 * This is expensive operation and we can do it only once now or for 249 * every access to sector, so now will be much better. 250 */ 251 switch (sc->sc_ealgo) { 252 case CRYPTO_AES_XTS: 253 break; 254 default: 255 SHA256_Init(&sc->sc_ivctx); 256 SHA256_Update(&sc->sc_ivctx, sc->sc_ivkey, 257 sizeof(sc->sc_ivkey)); 258 break; 259 } 260} 261#endif 262