From e14e0aa8582f1becc29125b3c765c26372305365 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 11 Mar 2024 14:57:02 +0100 Subject: [PATCH] zkey: Can't set a sector size for HMAC keys on LUKS2 volumes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit You can only set a sector size for an HMAC key of a volume of type INTEGTRITY. For combined integrity protection with encryption, the sector size of a LUKS2 volume must be set on the AES key, but can not be set on the HMAC key. Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- zkey/keystore.c | 41 +++++++++++++++++++++++++++++++++++++---- zkey/zkey.1 | 16 ++++++++++++++++ 2 files changed, 53 insertions(+), 4 deletions(-) diff --git a/zkey/keystore.c b/zkey/keystore.c index 1d102c93..9b79000f 100644 --- a/zkey/keystore.c +++ b/zkey/keystore.c @@ -277,10 +277,17 @@ static int _keystore_set_file_permission(struct keystore *keystore, * Checks if the sector size is power of two and in range 512 - 4096 bytes. * * @param[in] sector_size the sector size + * @param[in] key_type the type of the key, or NULL if the sector size is + * to be checked independent of the key type. + * @param[in] volume_type the type of associated volume, or NULL if the + * sector size is to be checked independent of the + * volume type. * * @returns 1 if the sector size is valid, 0 otherwise */ -static int _keystore_valid_sector_size(size_t sector_size) +static int _keystore_valid_sector_size(size_t sector_size, + const char *key_type, + const char *volume_type) { if (sector_size == 0) return 1; @@ -288,6 +295,15 @@ static int _keystore_valid_sector_size(size_t sector_size) return 0; if (sector_size & (sector_size - 1)) return 0; + + /* Can not set the sector size for volume type LUKS2 on a HMAC key */ + if (sector_size != 0 && + key_type != NULL && + is_hmac_key_type(key_type) && + volume_type != NULL && + strcasecmp(volume_type, VOLUME_TYPE_LUKS2) == 0) + return 0; + return 1; } @@ -1963,7 +1979,7 @@ static int _keystore_create_info_props(struct keystore *keystore, if (rc != 0) goto out; - if (!_keystore_valid_sector_size(sector_size)) { + if (!_keystore_valid_sector_size(sector_size, key_type, volume_type)) { warnx("Invalid sector-size specified"); rc = -EINVAL; goto out; @@ -2815,7 +2831,10 @@ int keystore_change_key(struct keystore *keystore, const char *name, } if (sector_size >= 0) { - if (!_keystore_valid_sector_size(sector_size)) { + if (!_keystore_valid_sector_size(sector_size, key_type, + volume_type != NULL ? + volume_type : + old_volume_type)) { warnx("Invalid sector-size specified"); rc = -EINVAL; goto out; @@ -2875,6 +2894,19 @@ int keystore_change_key(struct keystore *keystore, const char *name, passphrase_upd = &null_ptr; } + + /* + * Reset sector-size to zero if changed to anything but + * INTEGTRITY on a HMAC key. + */ + if (strcasecmp(volume_type, VOLUME_TYPE_INTEGRITY) != 0 && + is_hmac_key_type(key_type)) { + sector_size = 0; + rc = properties_set(key_props, PROP_NAME_SECTOR_SIZE, + "0"); + if (rc != 0) + goto out; + } } if (gen_passphrase || passphrase_file != NULL) { @@ -5969,7 +6001,8 @@ static int _keystore_refresh_kms_key(struct keystore *keystore, } if (sector_size >= 0) { - if (!_keystore_valid_sector_size(sector_size)) { + if (!_keystore_valid_sector_size(sector_size, key_type, + volume_type)) { warnx("Invalid sector-size specified"); rc = -EINVAL; goto out; diff --git a/zkey/zkey.1 b/zkey/zkey.1 index fb48a0fd..6de5ace4 100644 --- a/zkey/zkey.1 +++ b/zkey/zkey.1 @@ -1388,6 +1388,10 @@ This option is only used for secure keys contained in the secure key repository. Specifies the sector size in bytes used with \fBdm\-crypt\fP. It must be a power of two and in the range of 512 to 4096 bytes. If omitted, the system default sector size is used. +You can only set a sector size for an HMAC key of a volume of type +\fBintegrity\fP. For an HMAC key that is used for combined encryption and +integrity protection (volume type \fBluks2\fP), set the sector size for the +corresponding AES key instead. This option is only used for secure keys contained in the secure key repository. .TP .BR \-t ", " \-\-volume\-type\~\fItype\fP @@ -1564,6 +1568,10 @@ This option is only used for secure keys contained in the secure key repository. Specifies the sector size in bytes used with \fBdm\-crypt\fP or \fBdm\-integrity\fP. It must be a power of two and in the range of 512 to 4096 bytes. If omitted, the system default sector size is used. +You can only set a sector size for an HMAC key of a volume of type +\fBintegrity\fP. For an HMAC key that is used for combined encryption and +integrity protection (volume type \fBluks2\fP), set the sector size for the +corresponding AES key instead. This option is only used for secure keys contained in the secure key repository. .TP .BR \-t ", " \-\-volume\-type\~\fItype\fP @@ -1737,6 +1745,10 @@ This option is only used for secure keys contained in the secure key repository. Specifies the sector size in bytes used with \fBdm\-crypt\fP or \fBdm\-integrity\fP. It must be a power of two and in the range of 512 to 4096 ytes. Specify \fI0\fP to set the sector size to the system default. +You can only set a sector size for an HMAC key of a volume of type +\fBintegrity\fP. For an HMAC key that is used for combined encryption and +integrity protection (volume type \fBluks2\fP), set the sector size for the +corresponding AES key instead. This option is only used for secure keys contained in the secure key repository. .TP .BR \-t ", " \-\-volume\-type\~\fItype\fP @@ -2247,6 +2259,10 @@ Both keys must use the \fBluks2\fP volume type. Specifies the sector size in bytes used with \fBdm\-crypt\fP or \fBdm\-integrity\fP. It must be a power of two and in the range of 512 to 4096 bytes. If omitted, the system default sector size is used. +You can only set a sector size for an HMAC key of a volume of type +\fBintegrity\fP. For an HMAC key that is used for combined encryption and +integrity protection (volume type \fBluks2\fP), set the sector size for the +corresponding AES key instead. .TP .BR \-t ", " \-\-volume\-type\~\fItype\fP Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP or