Ingo Franzki 7dc2513205 zkey: Detect FIPS mode and generate PBKDF for luksFormat according to it ...

For LUKS2 volumes, zkey generates 'cryptsetup luksFormat' commands with
options '--pbkdf argon2i --pbkdf-memory 32 --pbkdf-force-iterations 4'
for low memory and time requirements. Using the default Argon2i options
might cause out-of-memory errors when multiple encrypted volumes are
unlocked automatically at boot through /etc/crypttab.

When the system runs in FIPS mode, which is indicated by file
/proc/sys/crypto/fips_enabled containing '1', the Argon2i password based
key derivation function might be disabled by a policy, and such
'cryptsetup luksFormat' commands might fail.

Generate '--pbkdf pbkdf2' instead if the system runs in FIPS mode.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

2024-03-15 15:11:43 +01:00

..

ekmfweb

zkey: man: Fix groff/troff warnings

2023-07-20 21:45:27 +02:00

initramfs

zkey: Add initramfs hook

2022-05-17 13:20:27 +02:00

kmip

zkey: Support EP11 AES keys with prepended header to retain EP11 session

2023-08-21 17:09:26 +02:00

cca.c

zkey-kmip: Configure APQNs

2021-07-07 13:53:06 +02:00

cca.h

zkey: Fix conversion of CCA DATA keys to CCA CIPHER keys

2021-06-18 13:20:08 +02:00

ep11.c

zkey: Support EP11 AES keys with prepended header to retain EP11 session

2023-08-21 17:09:26 +02:00

ep11.h

zkey: Fix EP11 host library version checking

2022-06-20 13:14:05 +02:00

keystore.c

zkey: Detect FIPS mode and generate PBKDF for luksFormat according to it

2024-03-15 15:11:43 +01:00

keystore.h

zkey: Add support to store LUKS2 dummy passphrase in key repository

2020-12-15 11:10:50 +01:00

kms-plugin.h

zkey: Allow KMS plugin to import a key of a specific type

2021-07-07 13:53:06 +02:00

kms-plugins.conf

zkey-kmip: Add new zkey KMS plugin for KMIP

2021-07-07 13:53:06 +02:00

kms.c

zkey: Support EP11 AES keys with prepended header to retain EP11 session

2023-08-21 17:09:26 +02:00

kms.h

zkey: Allow KMS plugin to import a key of a specific type

2021-07-07 13:53:06 +02:00

Makefile

Recursive Makefiles: avoid race condition in the install target

2023-07-20 21:45:27 +02:00

misc.h

zkey: Fix sparse, gcc 10, and -Wpedantic warnings

2020-10-12 13:12:55 +02:00

pkey.c

zkey: Fix typos in error message

2024-03-15 15:11:34 +01:00

pkey.h

zkey: Support EP11 AES keys with prepended header to retain EP11 session

2023-08-21 17:09:26 +02:00

plugin-utils.c

zkey-ekmfweb: Move some functions used by multiple KMS plugins to common code

2021-07-07 13:53:06 +02:00

plugin-utils.h

zkey-ekmfweb: Move some functions used by multiple KMS plugins to common code

2021-07-07 13:53:06 +02:00

properties.c

zkey: Allow comments and empty lines in properties files

2021-07-07 13:53:06 +02:00

properties.h

zkey: Store volume type property all uppercase

2019-09-06 12:44:34 +02:00

utils.c

zkey: Also check for deconfigured and check-stopped cards

2023-11-07 14:13:38 +01:00

utils.h

zkey: Add support to store LUKS2 dummy passphrase in key repository

2020-12-15 11:10:50 +01:00

zkey-cryptsetup.1

zkey-cryptsetup: Fix typo in man page

2020-08-20 17:05:39 +02:00

zkey-cryptsetup.c

zkey: Support EP11 AES keys with prepended header to retain EP11 session

2023-08-21 17:09:26 +02:00

zkey.1

zkey: Detect FIPS mode and generate PBKDF for luksFormat according to it

2024-03-15 15:11:43 +01:00

zkey.c

zkey: Fix convert command to accept only keys of type CCA-AESDATA

2024-03-15 15:11:34 +01:00