From b26dbfe8320c9ddb72b86efbe532b616243e0e3f Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Mon, 4 Feb 2019 14:22:15 +0100
Subject: [PATCH] zkey: Add --pbkdf pbkdf2 to generated crptsetup luksFormat
 command
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

LUKS2 encrypted volumes use Argon2i as default password based key
derivation function (PBKDF). Argon2i is a so-called memory-hard
function. It requires a certain amount of physical memory to make
dictionary attacks more costly.

Unfortunately, when multiple encrypted volumes are unlocked
automatically during system startup via /etc/crypttab, the use of
Argon2i will most likely cause an out-of-memory error in systemd.

To avoid the out-of-memory error, use PBKDF2 instead. Because PAES
uses secure keys as volume keys, the security of the key derivation
function used to derive the key to encrypt the volume key in the LUKS
key slots is of less relevance. Thus it is safe to use a weaker key
derivation function.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
 zkey/keystore.c | 8 +++++++-
 zkey/zkey.1     | 9 +++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/zkey/keystore.c b/zkey/keystore.c
index ee0fb8b3..9dcac075 100644
--- a/zkey/keystore.c
+++ b/zkey/keystore.c
@@ -3301,10 +3301,16 @@ static int _keystore_process_cryptsetup(struct keystore *keystore,
 			printf("%s\n", cmd);
 		}
 	} else if (strcasecmp(volume_type, VOLUME_TYPE_LUKS2) == 0) {
+		/*
+		 * Use PBKDF2 as key derivation function for LUKS2 volumes.
+		 * LUKS2 uses Argon2i as default, but this might cause
+		 * out-of-memory errors when multiple LUKS2 volumes are opened
+		 * automatically via /etc/crypttab
+		 */
 		util_asprintf(&cmd,
 			      "cryptsetup luksFormat %s--type luks2 "
 			      "--master-key-file '%s' --key-size %lu "
-			      "--cipher %s %s%s",
+			      "--cipher %s --pbkdf pbkdf2 %s%s",
 			      keystore->verbose ? "-v " : "", key_file_name,
 			      key_file_size * 8, cipher_spec,
 			      sector_size > 0 ? temp : "", volume);
diff --git a/zkey/zkey.1 b/zkey/zkey.1
index 19ef1a4a..93595dc0 100644
--- a/zkey/zkey.1
+++ b/zkey/zkey.1
@@ -567,6 +567,15 @@ option to generate cryptsetup commands for the specified volume type only.
 Specify the
 .B \-\-run
 option to run the generated cryptsetup commands.
+.P
+For LUKS2 volumes, the generated \fBcryptsetup luksFormat\fP contains
+option \fB\-\-pbkdf pbkdf2\fP to set \fBPBKDF2\fP as password based key
+derivation function. LUKS2 volumes typically default to \fBArgon2i\fP as
+password based key derivation function, but this might cause out-of-memory
+errors when multiple encrypted volumes are unlocked automatically at boot
+through /etc/crypttab. Because PAES uses secure AES keys as volume keys, the
+security of the key derivation function used to encrypt the volume key in the
+LUKS key slots is of less relevance. 
 .
 .
 .