kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Add --pbkdf pbkdf2 to generated crptsetup luksFormat command

Browse Source 
LUKS2 encrypted volumes use Argon2i as default password based key
derivation function (PBKDF). Argon2i is a so-called memory-hard
function. It requires a certain amount of physical memory to make
dictionary attacks more costly.

Unfortunately, when multiple encrypted volumes are unlocked
automatically during system startup via /etc/crypttab, the use of
Argon2i will most likely cause an out-of-memory error in systemd.

To avoid the out-of-memory error, use PBKDF2 instead. Because PAES
uses secure keys as volume keys, the security of the key derivation
function used to derive the key to encrypt the volume key in the LUKS
key slots is of less relevance. Thus it is safe to use a weaker key
derivation function.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-02-04 14:22:15 +01:00
committed by Jan Höppner
parent d95dc6d698
commit b26dbfe832
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
zkey/keystore.c
View File

@@ -3301,10 +3301,16 @@ static int _keystore_process_cryptsetup(struct keystore *keystore,
printf("%s\n", cmd);
}
} else if (strcasecmp(volume_type, VOLUME_TYPE_LUKS2) == 0) {
/*
* Use PBKDF2 as key derivation function for LUKS2 volumes.
* LUKS2 uses Argon2i as default, but this might cause
* out-of-memory errors when multiple LUKS2 volumes are opened
* automatically via /etc/crypttab
*/
util_asprintf(&cmd,
"cryptsetup luksFormat %s--type luks2 "
"--master-key-file '%s' --key-size %lu "
"--cipher %s %s%s",
"--cipher %s --pbkdf pbkdf2 %s%s",
keystore->verbose ? "-v " : "", key_file_name,
key_file_size * 8, cipher_spec,
sector_size > 0 ? temp : "", volume);

9
zkey/zkey.1
View File

@@ -567,6 +567,15 @@ option to generate cryptsetup commands for the specified volume type only.
Specify the
.B \-\-run
option to run the generated cryptsetup commands.
.P
For LUKS2 volumes, the generated \fBcryptsetup luksFormat\fP contains
option \fB\-\-pbkdf pbkdf2\fP to set \fBPBKDF2\fP as password based key
derivation function. LUKS2 volumes typically default to \fBArgon2i\fP as
password based key derivation function, but this might cause out-of-memory
errors when multiple encrypted volumes are unlocked automatically at boot
through /etc/crypttab. Because PAES uses secure AES keys as volume keys, the
security of the key derivation function used to encrypt the volume key in the
LUKS key slots is of less relevance.
.
.
.