From f11c71237e535fb497a7aeee21a5a63dea32dc51 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Fri, 15 Mar 2024 11:01:09 +0100 Subject: [PATCH] zkey-cryptsetup: Support PHMAC integrity with setvp command MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In case the volume is integrity protected, and the integrity algorithm is PHMAC, then the setvp command also adds the verification pattern of the integrity key into the token. Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- zkey/zkey-cryptsetup.c | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/zkey/zkey-cryptsetup.c b/zkey/zkey-cryptsetup.c index 256b0347..9b89decf 100644 --- a/zkey/zkey-cryptsetup.c +++ b/zkey/zkey-cryptsetup.c @@ -2373,9 +2373,12 @@ out: */ static int command_setvp(void) { - size_t integrity_keysize = 0; + size_t integrity_keysize = 0, seckeysize; + char *integrity_spec = NULL; struct vp_token vp_tok; + int is_phmac_integrity; size_t keysize = 0; + u8 *integrity_key; u8 *key = NULL; char *prompt; int token; @@ -2383,8 +2386,8 @@ static int command_setvp(void) util_asprintf(&prompt, "Enter passphrase for '%s': ", g.pos_arg); rc = validate_keyslot(CRYPT_ANY_SLOT, &key, &keysize, - &integrity_keysize, NULL, NULL, NULL, NULL, NULL, - NULL, NULL, prompt, NULL, NULL); + &integrity_keysize, &integrity_spec, NULL, NULL, + NULL, NULL, NULL, NULL, prompt, NULL, NULL); free(prompt); if (rc < 0) goto out; @@ -2395,7 +2398,11 @@ static int command_setvp(void) token = find_token(g.cd, PAES_VP_TOKEN_NAME); - rc = generate_key_verification_pattern(key, keysize - integrity_keysize, + is_phmac_integrity = is_integrity_phmac(integrity_spec, + integrity_keysize); + seckeysize = keysize - integrity_keysize; + + rc = generate_key_verification_pattern(key, seckeysize, vp_tok.verification_pattern, sizeof(vp_tok.verification_pattern), g.verbose); @@ -2407,6 +2414,23 @@ static int command_setvp(void) goto out; } + if (is_phmac_integrity) { + integrity_key = key + seckeysize; + + rc = generate_key_verification_pattern(integrity_key, + integrity_keysize, + vp_tok.int_verification_pattern, + sizeof(vp_tok.int_verification_pattern), + g.verbose); + if (rc != 0) { + warnx("Failed to generate the verification pattern: %s", + strerror(-rc)); + warnx("Make sure that kernel module 'phmac_s390' is " + "loaded and that the 'phmac' cipher is available"); + goto out; + } + } + rc = put_vp_token(g.cd, token, &vp_tok); if (rc < 0) goto out; @@ -2415,6 +2439,8 @@ static int command_setvp(void) out: secure_free(key, keysize); + if (integrity_spec != NULL) + free(integrity_spec); return rc < 0 ? EXIT_FAILURE : EXIT_SUCCESS; }