fscrypt: add Adiantum support
Add support for the Adiantum encryption mode to fscrypt. Adiantum is a tweakable, length-preserving encryption mode with security provably reducible to that of XChaCha12 and AES-256, subject to a security bound. It's also a true wide-block mode, unlike XTS. See the paper "Adiantum: length-preserving encryption for entry-level processors" (https://eprint.iacr.org/2018/720.pdf) for more details. Also see commit 059c2a4d ("crypto: adiantum - add Adiantum support"). On sufficiently long messages, Adiantum's bottlenecks are XChaCha12 and the NH hash function. These algorithms are fast even on processors without dedicated crypto instructions. Adiantum makes it feasible to enable storage encryption on low-end mobile devices that lack AES instructions; currently such devices are unencrypted. On ARM Cortex-A7, on 4096-byte messages Adiantum encryption is about 4 times faster than AES-256-XTS encryption; decryption is about 5 times faster. In fscrypt, Adiantum is suitable for encrypting both file contents and names. With filenames, it fixes a known weakness: when two filenames in a directory share a common prefix of >= 16 bytes, with CTS-CBC their encrypted filenames share a common prefix too, leaking information. Adiantum does not have this problem. Since Adiantum also accepts long tweaks (IVs), it's also safe to use the master key directly for Adiantum encryption rather than deriving per-file keys, provided that the per-file nonce is included in the IVs and the master key isn't used for any other encryption mode. This configuration saves memory and improves performance. A new fscrypt policy flag is added to allow users to opt-in to this configuration. Signed-off-by:Eric Biggers <ebiggers@google.com> Signed-off-by:
Theodore Ts'o <tytso@mit.edu>
| ... | ... | @@ -10,15 +10,21 @@ |
| */ | ||
| #include <keys/user-type.h> | ||
| #include <linux/hashtable.h> | ||
| #include <linux/scatterlist.h> | ||
| #include <linux/ratelimit.h> | ||
| #include <crypto/aes.h> | ||
| #include <crypto/algapi.h> | ||
| #include <crypto/sha.h> | ||
| #include <crypto/skcipher.h> | ||
| #include "fscrypt_private.h" | ||
| static struct crypto_shash *essiv_hash_tfm; | ||
| /* Table of keys referenced by FS_POLICY_FLAG_DIRECT_KEY policies */ | ||
| static DEFINE_HASHTABLE(fscrypt_master_keys, 6); /* 6 bits = 64 buckets */ | ||
| static DEFINE_SPINLOCK(fscrypt_master_keys_lock); | ||
| /* | ||
| * Key derivation function. This generates the derived key by encrypting the | ||
| * master key with AES-128-ECB using the inode's nonce as the AES key. | ||
| ... | ... | @@ -123,56 +129,37 @@ invalid: |
| return ERR_PTR(-ENOKEY); | ||
| } | ||
| /* Find the master key, then derive the inode's actual encryption key */ | ||
| static int find_and_derive_key(const struct inode *inode, | ||
| const struct fscrypt_context *ctx, | ||
| u8 *derived_key, unsigned int derived_keysize) | ||
| { | ||
| struct key *key; | ||
| const struct fscrypt_key *payload; | ||
| int err; | ||
| key = find_and_lock_process_key(FS_KEY_DESC_PREFIX, | ||
| ctx->master_key_descriptor, | ||
| derived_keysize, &payload); | ||
| if (key == ERR_PTR(-ENOKEY) && inode->i_sb->s_cop->key_prefix) { | ||
| key = find_and_lock_process_key(inode->i_sb->s_cop->key_prefix, | ||
| ctx->master_key_descriptor, | ||
| derived_keysize, &payload); | ||
| } | ||
| if (IS_ERR(key)) | ||
| return PTR_ERR(key); | ||
| err = derive_key_aes(payload->raw, ctx, derived_key, derived_keysize); | ||
| up_read(&key->sem); | ||
| key_put(key); | ||
| return err; | ||
| } | ||
| static struct fscrypt_mode { | ||
| const char *friendly_name; | ||
| const char *cipher_str; | ||
| int keysize; | ||
| bool logged_impl_name; | ||
| } available_modes[] = { | ||
| static struct fscrypt_mode available_modes[] = { | ||
| [FS_ENCRYPTION_MODE_AES_256_XTS] = { | ||
| .friendly_name = "AES-256-XTS", | ||
| .cipher_str = "xts(aes)", | ||
| .keysize = 64, | ||
| .ivsize = 16, | ||
| }, | ||
| [FS_ENCRYPTION_MODE_AES_256_CTS] = { | ||
| .friendly_name = "AES-256-CTS-CBC", | ||
| .cipher_str = "cts(cbc(aes))", | ||
| .keysize = 32, | ||
| .ivsize = 16, | ||
| }, | ||
| [FS_ENCRYPTION_MODE_AES_128_CBC] = { | ||
| .friendly_name = "AES-128-CBC", | ||
| .cipher_str = "cbc(aes)", | ||
| .keysize = 16, | ||
| .ivsize = 16, | ||
| .needs_essiv = true, | ||
| }, | ||
| [FS_ENCRYPTION_MODE_AES_128_CTS] = { | ||
| .friendly_name = "AES-128-CTS-CBC", | ||
| .cipher_str = "cts(cbc(aes))", | ||
| .keysize = 16, | ||
| .ivsize = 16, | ||
| }, | ||
| [FS_ENCRYPTION_MODE_ADIANTUM] = { | ||
| .friendly_name = "Adiantum", | ||
| .cipher_str = "adiantum(xchacha12,aes)", | ||
| .keysize = 32, | ||
| .ivsize = 32, | ||
| }, | ||
| }; | ||
| ... | ... | @@ -198,14 +185,196 @@ select_encryption_mode(const struct fscrypt_info *ci, const struct inode *inode) |
| return ERR_PTR(-EINVAL); | ||
| } | ||
| static void put_crypt_info(struct fscrypt_info *ci) | ||
| /* Find the master key, then derive the inode's actual encryption key */ | ||
| static int find_and_derive_key(const struct inode *inode, | ||
| const struct fscrypt_context *ctx, | ||
| u8 *derived_key, const struct fscrypt_mode *mode) | ||
| { | ||
| if (!ci) | ||
| struct key *key; | ||
| const struct fscrypt_key *payload; | ||
| int err; | ||
| key = find_and_lock_process_key(FS_KEY_DESC_PREFIX, | ||
| ctx->master_key_descriptor, | ||
| mode->keysize, &payload); | ||
| if (key == ERR_PTR(-ENOKEY) && inode->i_sb->s_cop->key_prefix) { | ||
| key = find_and_lock_process_key(inode->i_sb->s_cop->key_prefix, | ||
| ctx->master_key_descriptor, | ||
| mode->keysize, &payload); | ||
| } | ||
| if (IS_ERR(key)) | ||
| return PTR_ERR(key); | ||
| if (ctx->flags & FS_POLICY_FLAG_DIRECT_KEY) { | ||
| if (mode->ivsize < offsetofend(union fscrypt_iv, nonce)) { | ||
| fscrypt_warn(inode->i_sb, | ||
| "direct key mode not allowed with %s", | ||
| mode->friendly_name); | ||
| err = -EINVAL; | ||
| } else if (ctx->contents_encryption_mode != | ||
| ctx->filenames_encryption_mode) { | ||
| fscrypt_warn(inode->i_sb, | ||
| "direct key mode not allowed with different contents and filenames modes"); | ||
| err = -EINVAL; | ||
| } else { | ||
| memcpy(derived_key, payload->raw, mode->keysize); | ||
| err = 0; | ||
| } | ||
| } else { | ||
| err = derive_key_aes(payload->raw, ctx, derived_key, | ||
| mode->keysize); | ||
| } | ||
| up_read(&key->sem); | ||
| key_put(key); | ||
| return err; | ||
| } | ||
| /* Allocate and key a symmetric cipher object for the given encryption mode */ | ||
| static struct crypto_skcipher * | ||
| allocate_skcipher_for_mode(struct fscrypt_mode *mode, const u8 *raw_key, | ||
| const struct inode *inode) | ||
| { | ||
| struct crypto_skcipher *tfm; | ||
| int err; | ||
| tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); | ||
| if (IS_ERR(tfm)) { | ||
| fscrypt_warn(inode->i_sb, | ||
| "error allocating '%s' transform for inode %lu: %ld", | ||
| mode->cipher_str, inode->i_ino, PTR_ERR(tfm)); | ||
| return tfm; | ||
| } | ||
| if (unlikely(!mode->logged_impl_name)) { | ||
| /* | ||
| * fscrypt performance can vary greatly depending on which | ||
| * crypto algorithm implementation is used. Help people debug | ||
| * performance problems by logging the ->cra_driver_name the | ||
| * first time a mode is used. Note that multiple threads can | ||
| * race here, but it doesn't really matter. | ||
| */ | ||
| mode->logged_impl_name = true; | ||
| pr_info("fscrypt: %s using implementation \"%s\"\n", | ||
| mode->friendly_name, | ||
| crypto_skcipher_alg(tfm)->base.cra_driver_name); | ||
| } | ||
| crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_WEAK_KEY); | ||
| err = crypto_skcipher_setkey(tfm, raw_key, mode->keysize); | ||
| if (err) | ||
| goto err_free_tfm; | ||
| return tfm; | ||
| err_free_tfm: | ||
| crypto_free_skcipher(tfm); | ||
| return ERR_PTR(err); | ||
| } | ||
| /* Master key referenced by FS_POLICY_FLAG_DIRECT_KEY policy */ | ||
| struct fscrypt_master_key { | ||
| struct hlist_node mk_node; | ||
| refcount_t mk_refcount; | ||
| const struct fscrypt_mode *mk_mode; | ||
| struct crypto_skcipher *mk_ctfm; | ||
| u8 mk_descriptor[FS_KEY_DESCRIPTOR_SIZE]; | ||
| u8 mk_raw[FS_MAX_KEY_SIZE]; | ||
| }; | ||
| < |