From ddf30feb8918481b9b6f8b7b49d1af7b898bc08d Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 11 Mar 2024 13:44:38 +0100 Subject: [PATCH] zkey: Only allow to set a dummy passphrase for AES-type keys MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Although HMAC keys can be associated to volumes of type 'LUKS2', the dummy passphrase can only be set to AES-type keys, i.e. to keys that encrypt the volume. Reject trying to set a dummy passphrase for an HMAC key with a volume type of 'LUKS2'. Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- zkey/keystore.c | 15 ++++++++++++++- zkey/zkey.1 | 13 +++++++------ 2 files changed, 21 insertions(+), 7 deletions(-) diff --git a/zkey/keystore.c b/zkey/keystore.c index 04661361..ccb8015a 100644 --- a/zkey/keystore.c +++ b/zkey/keystore.c @@ -1727,7 +1727,7 @@ static int _keystore_set_passphrase(struct keystore *keystore, struct properties *properties, bool prompt) { - char *volume_type; + char *volume_type, *key_type; int rc; if (_keystore_passphrase_file_exists((struct key_filenames *)filenames) @@ -1756,6 +1756,19 @@ static int _keystore_set_passphrase(struct keystore *keystore, } free(volume_type); + key_type = _keystore_get_key_type(properties); + if (key_type == NULL) { + pr_verbose(keystore, "No key type available"); + return -EINVAL; + } + if (!is_aes_key_type(key_type)) { + warnx("The LUKS2 dummy passphrase can only be set for AES-type " + "keys"); + free(key_type); + return -EINVAL; + } + free(key_type); + if (passphrase_file != NULL) { rc = copy_file(passphrase_file, filenames->pass_filename, 0); if (rc != 0) { diff --git a/zkey/zkey.1 b/zkey/zkey.1 index a59cc154..b6f94edd 100644 --- a/zkey/zkey.1 +++ b/zkey/zkey.1 @@ -1752,9 +1752,9 @@ is of less or no relevance for the security of the volume(s), when an secure AES key is used to encrypt the volume(s), and can therefore be stored insecurely inside the secure key repository. If for a certain usage the passphrase is of relevance for security, then do not use this option. This option can only be -specified for keys with a volume type of \fBluks2\fP. When there is already a -dummy passphrase associated with the key, you must first remove the dummy -passphrase with option \fB\-\-remove\-dummy\-passphrase\fP before you can +specified for AES-type keys with a volume type of \fBluks2\fP. When there is +already a dummy passphrase associated with the key, you must first remove the +dummy passphrase with option \fB\-\-remove\-dummy\-passphrase\fP before you can associate a new dummy passphrase. This option is only used for secure keys contained in the secure key repository. .TP @@ -2247,7 +2247,8 @@ of less or no relevance for the security of the volume(s), when a protected virtualization secret is used to encrypt the volume(s), and can therefore be stored insecurely inside the key repository. If for a certain usage the passphrase is of relevance for security, then do not use this option. This -option can only be specified for keys with a volume type of \fBluks2\fP. +option can only be specified for AES-type keys with a volume type of +\fBluks2\fP. .TP .BR \-\-set\-dummy\-passphrase\~\fIpassphrase\-file\fP Set a dummy passphrase that is read from the specified file and associate it @@ -2256,8 +2257,8 @@ The LUKS2 passphrase is of less or no relevance for the security of the volume(s), when an protected virtualization secret is used to encrypt the volume(s), and can therefore be stored insecurely inside the key repository. If for a certain usage the passphrase is of relevance for security, then do -not use this option. This option can only be specified for keys with a volume -type of \fBluks2\fP. +not use this option. This option can only be specified for AES-type keys with +a volume type of \fBluks2\fP. . . .