kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Support LUKS2 with combined encryption and integrity

Browse Source 
The commands 'zkey cryptsetup' generates commands for formatting and
opening volumes of type PLAIN and LUKS2.

For LUKS2, if there exists an HMAC key that is associated to the same
volume as the AES key, generate a 'cryptsetup luksFormat' command for
combined encryption and integrity protection. This uses the '--integrity'
and '--integrity-key-size' options of the 'cryptsetup luksFormat'
command to specify the integrity settings.

The volume key specified with '--master-key-file' must contain the
encryption key and the integrity key concatenated to each other. The
size of the volume key specified with '--key-size' however must be the
size of the encryption key only, in bits. The 'cryptsetup luksFormat'
command will internally read the whole file, use the first part as
encryption key, and the second part as integrity key. The size of the
second part must be specified with the '--integrity-key-size'.

Note: This requires 'wrapped integrity key' support in the cryptsetup
package, as well as in the dm-crypt kernel module.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-03-13 11:02:10 +01:00
committed by Jan Höppner
parent c161c04392
commit 103a99fa34
2 changed files with 145 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/zkey.1
+12
View File
@@ -801,6 +801,18 @@ might be disabled by a policy when FIPS mode is active. Because PAES uses secure
AES keys as volume keys, the security of the key derivation function used to
encrypt the volume key in the LUKS key slots is of less relevance.
.P
For combined encryption and integrity protection of a volume, the same volume
must be assigned to an AES-type key and an HMAC-type key. Both keys must use the
\fBluks2\fP volume type. For such a volume, the generated \fBcryptsetup
luksFormat\fP command contains the \fB\-\-integrity\fP option to enable
integrity protection. An additional command is generated prior to the
\fBcryptsetup luksFormat\fP command to concatenate the encryption key and the
integrity key to each other into a temporary file. This temporary file is then
used with the \fBcryptsetup luksFormat\fP command as volume key. When the
\fP\-\-run\fP option is specified, the temporary file is removed automatically
after running the commands, otherwise a command to remove the temporary file is
generated, too.
.P
For LUKS2 volumes, a passphrase is required. You are prompted for the
passphrase when running the generated commands, unless option
.B \-\-key\-file