kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Detect FIPS mode and generate PBKDF for luksFormat according to it

Browse Source 
For LUKS2 volumes, zkey generates 'cryptsetup luksFormat' commands with
options '--pbkdf argon2i --pbkdf-memory 32 --pbkdf-force-iterations 4'
for low memory and time requirements. Using the default Argon2i options
might cause out-of-memory errors when multiple encrypted volumes are
unlocked automatically at boot through /etc/crypttab.

When the system runs in FIPS mode, which is indicated by file
/proc/sys/crypto/fips_enabled containing '1', the Argon2i password based
key derivation function might be disabled by a policy, and such
'cryptsetup luksFormat' commands might fail.

Generate '--pbkdf pbkdf2' instead if the system runs in FIPS mode.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-03-06 15:02:55 +01:00
committed by Steffen Eiden
parent 0748d365a6
commit 7dc2513205
2 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
zkey/keystore.c
View File

@@ -25,6 +25,7 @@
#include <sys/types.h>
#include "lib/util_base.h"
#include "lib/util_file.h"
#include "lib/util_libc.h"
#include "lib/util_panic.h"
#include "lib/util_path.h"
@@ -4202,6 +4203,7 @@ struct crypt_info {
size_t tries;
bool open;
bool format;
int fips;
char **volume_filter;
int (*process_func)(struct keystore *keystore,
const char *volume,
@@ -4319,16 +4321,22 @@ static int _keystore_process_cryptsetup(struct keystore *keystore,
* Using the default Argon2i options might cause out-of-memory
* errors when multiple LUKS2 volumes are opened automatically
* via /etc/crypttab
* In case the system runs in FIPS mode, use PBKDF2
* instead, because Argon2i might be disabled by a
* policy when FIPS mode is active.
*/
util_asprintf(&cmd,
"cryptsetup luksFormat %s%s--type luks2 "
"--master-key-file '%s' --key-size %lu "
"--cipher %s --pbkdf argon2i --pbkdf-memory 32 "
"--pbkdf-force-iterations 4 %s%s%s",
"--cipher %s --pbkdf %s %s%s%s",
info->batch_mode ? "-q " : "",
keystore->verbose ? "-v " : "",
key_file_name, key_file_size * 8,
cipher_spec, common_len > 0 ?
cipher_spec,
info->fips ? "pbkdf2" :
"argon2i --pbkdf-memory 32 "
"--pbkdf-force-iterations 4",
common_len > 0 ?
common_passphrase_options : "",
sector_size > 0 ? temp : "", volume);
@@ -4605,6 +4613,8 @@ int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
return -EINVAL;
}
util_file_read_i(&info.fips, 10, "/proc/sys/crypto/fips_enabled");
info.execute = execute;
info.open = open;
info.format = format;

8
zkey/zkey.1
View File

@@ -734,10 +734,12 @@ type, this is the default. If specified for the plain volume type, then no
command is generated.
.P
For LUKS2 volumes, the generated \fBcryptsetup luksFormat\fP contains
options \fB-\-pbkdf argon2i \-\-pbkdf\-memory 32 \-\-pbkdf\-force\-iterations 4
\fP for low memory and time requirements. Using the default \fBArgon2i\fP
options \fB-\-pbkdf argon2i \-\-pbkdf\-memory 32 \-\-pbkdf\-force\-iterations
4\fP for low memory and time requirements. Using the default \fBArgon2i\fP
options might cause out-of-memory errors when multiple encrypted volumes are
unlocked automatically at boot through /etc/crypttab. Because PAES uses secure
unlocked automatically at boot through \fB/etc/crypttab\fP. In case the system
runs in FIPS mode, \fB-\-pbkdf pbkdf2\fP is used instead, because \fBArgon2i\fP
might be disabled by a policy when FIPS mode is active. Because PAES uses secure
AES keys as volume keys, the security of the key derivation function used to encrypt
the volume key in the LUKS key slots is of less relevance.
.P