Commit e3b1078b authored by Eric Biggers's avatar Eric Biggers
Browse files

fscrypt: add support for IV_INO_LBLK_32 policies 

The eMMC inline crypto standard will only specify 32 DUN bits (a.k.a. IV
bits), unlike UFS's 64.  IV_INO_LBLK_64 is therefore not applicable, but
an encryption format which uses one key per policy and permits the
moving of encrypted file contents (as f2fs's garbage collector requires)
is still desirable.

To support such hardware, add a new encryption format IV_INO_LBLK_32
that makes the best use of the 32 bits: the IV is set to
'SipHash-2-4(inode_number) + file_logical_block_number mod 2^32', where
the SipHash key is derived from the fscrypt master key.  We hash only
the inode number and not also the block number, because we need to
maintain contiguity of DUNs to merge bios.

Unlike with IV_INO_LBLK_64, with this format IV reuse is possible; this
is unavoidable given the size of the DUN.  This means this format should
only be used where the requirements of the first paragraph apply.
However, the hash spreads out the IVs in the whole usable range, and the
use of a keyed hash makes it difficult for an attacker to determine
which files use which IVs.

Besides the above differences, this flag works like IV_INO_LBLK_64 in
that on ext4 it is only allowed if the stable_inodes feature has been
enabled to prevent inode numbers and the filesystem UUID from changing.

Link: https://lore.kernel.org/r/20200515204141.251098-1-ebiggers@kernel.org


Reviewed-by: default avatarTheodore Ts'o <tytso@mit.edu>
Reviewed-by: default avatarPaul Crowley <paulcrowley@google.com>
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
parent 0ca2ddb0

Documentation/filesystems/fscrypt.rst

+29 −4
Original line number Diff line number Diff line
@@ -292,8 +292,22 @@ files' data differently, inode numbers are included in the IVs. 
Consequently, shrinking the filesystem may not be allowed.



This format is optimized for use with inline encryption hardware

compliant with the UFS or eMMC standards, which support only 64 IV

bits per I/O request and may have only a small number of keyslots.

compliant with the UFS standard, which supports only 64 IV bits per

I/O request and may have only a small number of keyslots.



IV_INO_LBLK_32 policies

-----------------------



IV_INO_LBLK_32 policies work like IV_INO_LBLK_64, except that for

IV_INO_LBLK_32, the inode number is hashed with SipHash-2-4 (where the

SipHash key is derived from the master key) and added to the file

logical block number mod 2^32 to produce a 32-bit IV.



This format is optimized for use with inline encryption hardware

compliant with the eMMC v5.2 standard, which supports only 32 IV bits

per I/O request and may have only a small number of keyslots.  This

format results in some level of IV reuse, so it should only be used

when necessary due to hardware limitations.



Key identifiers

---------------
@@ -369,6 +383,10 @@ a little endian number, except that: 
  to 32 bits and is placed in bits 0-31 of the IV.  The inode number

  (which is also limited to 32 bits) is placed in bits 32-63.



- With `IV_INO_LBLK_32 policies`_, the logical block number is limited

  to 32 bits and is placed in bits 0-31 of the IV.  The inode number

  is then hashed and added mod 2^32.



Note that because file logical block numbers are included in the IVs,

filesystems must enforce that blocks are never shifted around within

encrypted files, e.g. via "collapse range" or "insert range".
@@ -465,8 +483,15 @@ This structure must be initialized as follows: 
    (0x3).

  - FSCRYPT_POLICY_FLAG_DIRECT_KEY: See `DIRECT_KEY policies`_.

  - FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64: See `IV_INO_LBLK_64

    policies`_.  This is mutually exclusive with DIRECT_KEY and is not

    supported on v1 policies.

    policies`_.

  - FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32: See `IV_INO_LBLK_32

    policies`_.



  v1 encryption policies only support the PAD_* and DIRECT_KEY flags.

  The other flags are only supported by v2 encryption policies.



  The DIRECT_KEY, IV_INO_LBLK_64, and IV_INO_LBLK_32 flags are

  mutually exclusive.



- For v2 encryption policies, ``__reserved`` must be zeroed.

fs/crypto/crypto.c

+5 −1
Original line number Diff line number Diff line
@@ -77,8 +77,12 @@ void fscrypt_generate_iv(union fscrypt_iv *iv, u64 lblk_num, 
	memset(iv, 0, ci->ci_mode->ivsize);



	if (flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) {

		WARN_ON_ONCE((u32)lblk_num != lblk_num);

		WARN_ON_ONCE(lblk_num > U32_MAX);

		WARN_ON_ONCE(ci->ci_inode->i_ino > U32_MAX);

		lblk_num |= (u64)ci->ci_inode->i_ino << 32;

	} else if (flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) {

		WARN_ON_ONCE(lblk_num > U32_MAX);

		lblk_num = (u32)(ci->ci_hashed_ino + lblk_num);

	} else if (flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) {

		memcpy(iv->nonce, ci->ci_nonce, FS_KEY_DERIVATION_NONCE_SIZE);

	}

fs/crypto/fscrypt_private.h

+14 −6
Original line number Diff line number Diff line
@@ -222,6 +222,9 @@ struct fscrypt_info { 


	/* This inode's nonce, copied from the fscrypt_context */

	u8 ci_nonce[FS_KEY_DERIVATION_NONCE_SIZE];



	/* Hashed inode number.  Only set for IV_INO_LBLK_32 */

	u32 ci_hashed_ino;

};



typedef enum {
@@ -290,6 +293,8 @@ int fscrypt_init_hkdf(struct fscrypt_hkdf *hkdf, const u8 *master_key, 
#define HKDF_CONTEXT_DIRECT_KEY		3

#define HKDF_CONTEXT_IV_INO_LBLK_64_KEY	4

#define HKDF_CONTEXT_DIRHASH_KEY	5

#define HKDF_CONTEXT_IV_INO_LBLK_32_KEY	6

#define HKDF_CONTEXT_INODE_HASH_KEY	7



int fscrypt_hkdf_expand(const struct fscrypt_hkdf *hkdf, u8 context,

			const u8 *info, unsigned int infolen,
@@ -386,14 +391,17 @@ struct fscrypt_master_key { 
	struct list_head	mk_decrypted_inodes;

	spinlock_t		mk_decrypted_inodes_lock;



	/* Crypto API transforms for DIRECT_KEY policies, allocated on-demand */

	struct crypto_skcipher	*mk_direct_tfms[__FSCRYPT_MODE_MAX + 1];



	/*

	 * Crypto API transforms for filesystem-layer implementation of

	 * IV_INO_LBLK_64 policies, allocated on-demand.

	 * Per-mode encryption keys for the various types of encryption policies

	 * that use them.  Allocated and derived on-demand.

	 */

	struct crypto_skcipher	*mk_iv_ino_lblk_64_tfms[__FSCRYPT_MODE_MAX + 1];

	struct crypto_skcipher *mk_direct_keys[__FSCRYPT_MODE_MAX + 1];

	struct crypto_skcipher *mk_iv_ino_lblk_64_keys[__FSCRYPT_MODE_MAX + 1];

	struct crypto_skcipher *mk_iv_ino_lblk_32_keys[__FSCRYPT_MODE_MAX + 1];



	/* Hash key for inode numbers.  Initialized only when needed. */

	siphash_key_t		mk_ino_hash_key;

	bool			mk_ino_hash_key_initialized;



} __randomize_layout;

fs/crypto/keyring.c

+3 −2
Original line number Diff line number Diff line
@@ -45,8 +45,9 @@ static void free_master_key(struct fscrypt_master_key *mk) 
	wipe_master_key_secret(&mk->mk_secret);



	for (i = 0; i <= __FSCRYPT_MODE_MAX; i++) {

		crypto_free_skcipher(mk->mk_direct_tfms[i]);

		crypto_free_skcipher(mk->mk_iv_ino_lblk_64_tfms[i]);

		crypto_free_skcipher(mk->mk_direct_keys[i]);

		crypto_free_skcipher(mk->mk_iv_ino_lblk_64_keys[i]);

		crypto_free_skcipher(mk->mk_iv_ino_lblk_32_keys[i]);

	}



	key_put(mk->mk_users);

fs/crypto/keysetup.c

+67 −18
Original line number Diff line number Diff line
@@ -46,6 +46,8 @@ struct fscrypt_mode fscrypt_modes[] = { 
	},

};



static DEFINE_MUTEX(fscrypt_mode_key_setup_mutex);



static struct fscrypt_mode *

select_encryption_mode(const union fscrypt_policy *policy,

		       const struct inode *inode)
@@ -130,7 +132,7 @@ static int setup_per_mode_enc_key(struct fscrypt_info *ci, 
	const struct super_block *sb = inode->i_sb;

	struct fscrypt_mode *mode = ci->ci_mode;

	const u8 mode_num = mode - fscrypt_modes;

	struct crypto_skcipher *tfm, *prev_tfm;

	struct crypto_skcipher *tfm;

	u8 mode_key[FSCRYPT_MAX_KEY_SIZE];

	u8 hkdf_info[sizeof(mode_num) + sizeof(sb->s_uuid)];

	unsigned int hkdf_infolen = 0;
@@ -139,10 +141,17 @@ static int setup_per_mode_enc_key(struct fscrypt_info *ci, 
	if (WARN_ON(mode_num > __FSCRYPT_MODE_MAX))

		return -EINVAL;



	/* pairs with cmpxchg() below */

	/* pairs with smp_store_release() below */

	tfm = READ_ONCE(tfms[mode_num]);

	if (likely(tfm != NULL))

		goto done;

	if (likely(tfm != NULL)) {

		ci->ci_ctfm = tfm;

		return 0;

	}



	mutex_lock(&fscrypt_mode_key_setup_mutex);



	if (tfms[mode_num])

		goto done_unlock;



	BUILD_BUG_ON(sizeof(mode_num) != 1);

	BUILD_BUG_ON(sizeof(sb->s_uuid) != 16);
@@ -157,21 +166,21 @@ static int setup_per_mode_enc_key(struct fscrypt_info *ci, 
				  hkdf_context, hkdf_info, hkdf_infolen,

				  mode_key, mode->keysize);

	if (err)

		return err;

		goto out_unlock;

	tfm = fscrypt_allocate_skcipher(mode, mode_key, inode);

	memzero_explicit(mode_key, mode->keysize);

	if (IS_ERR(tfm))

		return PTR_ERR(tfm);



	/* pairs with READ_ONCE() above */

	prev_tfm = cmpxchg(&tfms[mode_num], NULL, tfm);

	if (prev_tfm != NULL) {

		crypto_free_skcipher(tfm);

		tfm = prev_tfm;

	if (IS_ERR(tfm)) {

		err = PTR_ERR(tfm);

		goto out_unlock;

	}

done:

	/* pairs with READ_ONCE() above */

	smp_store_release(&tfms[mode_num], tfm);

done_unlock:

	ci->ci_ctfm = tfm;

	return 0;

	err = 0;

out_unlock:

	mutex_unlock(&fscrypt_mode_key_setup_mutex);

	return err;

}



int fscrypt_derive_dirhash_key(struct fscrypt_info *ci,
@@ -189,6 +198,43 @@ int fscrypt_derive_dirhash_key(struct fscrypt_info *ci, 
	return 0;

}



static int fscrypt_setup_iv_ino_lblk_32_key(struct fscrypt_info *ci,

					    struct fscrypt_master_key *mk)

{

	int err;



	err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_32_keys,

				     HKDF_CONTEXT_IV_INO_LBLK_32_KEY, true);

	if (err)

		return err;



	/* pairs with smp_store_release() below */

	if (!smp_load_acquire(&mk->mk_ino_hash_key_initialized)) {



		mutex_lock(&fscrypt_mode_key_setup_mutex);



		if (mk->mk_ino_hash_key_initialized)

			goto unlock;



		err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf,

					  HKDF_CONTEXT_INODE_HASH_KEY, NULL, 0,

					  (u8 *)&mk->mk_ino_hash_key,

					  sizeof(mk->mk_ino_hash_key));

		if (err)

			goto unlock;

		/* pairs with smp_load_acquire() above */

		smp_store_release(&mk->mk_ino_hash_key_initialized, true);

unlock:

		mutex_unlock(&fscrypt_mode_key_setup_mutex);

		if (err)

			return err;

	}



	ci->ci_hashed_ino = (u32)siphash_1u64(ci->ci_inode->i_ino,

					      &mk->mk_ino_hash_key);

	return 0;

}



static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci,

				     struct fscrypt_master_key *mk)

{
@@ -203,7 +249,7 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci, 
		 * encryption key.  This ensures that the master key is

		 * consistently used only for HKDF, avoiding key reuse issues.

		 */

		err = setup_per_mode_enc_key(ci, mk, mk->mk_direct_tfms,

		err = setup_per_mode_enc_key(ci, mk, mk->mk_direct_keys,

					     HKDF_CONTEXT_DIRECT_KEY, false);

	} else if (ci->ci_policy.v2.flags &

		   FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) {
@@ -211,11 +257,14 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci, 
		 * IV_INO_LBLK_64: encryption keys are derived from (master_key,

		 * mode_num, filesystem_uuid), and inode number is included in

		 * the IVs.  This format is optimized for use with inline

		 * encryption hardware compliant with the UFS or eMMC standards.

		 * encryption hardware compliant with the UFS standard.

		 */

		err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_64_tfms,

		err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_64_keys,

					     HKDF_CONTEXT_IV_INO_LBLK_64_KEY,

					     true);

	} else if (ci->ci_policy.v2.flags &

		   FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) {

		err = fscrypt_setup_iv_ino_lblk_32_key(ci, mk);

	} else {

		u8 derived_key[FSCRYPT_MAX_KEY_SIZE];

CRA Git | Maintained and supported by SUSTech CRA and CCSE