From patchwork Mon Apr 30 22:51:49 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Biggers X-Patchwork-Id: 906904 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=linux-ext4-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="nc+QaGGw"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40Zg0C4Lrgz9s0n for ; Tue, 1 May 2018 08:56:59 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755450AbeD3W45 (ORCPT ); Mon, 30 Apr 2018 18:56:57 -0400 Received: from mail-pf0-f194.google.com ([209.85.192.194]:44354 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755453AbeD3W4x (ORCPT ); Mon, 30 Apr 2018 18:56:53 -0400 Received: by mail-pf0-f194.google.com with SMTP id q22so7870859pff.11; Mon, 30 Apr 2018 15:56:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=6FJK5fX6Xy34m8X70gLUAwyLpubC/LkpvQQIN9+cN18=; b=nc+QaGGwfKkQIdYEA4J+WKPM3EYIRliTwUb7DkA9HOI6ChdWYHlo1fXmP38wFOdu4t jk+hKMVh6vIBMGcg1SjDnuMOLmRV7dobT1wqa8Az8svs4Nfs7urbegH+uS+L3LD8RG0j e/1nhSHzP7n3knPI5kGxOaBEMOqAPJ6EPYf5sDZzALdmxrfHER+XTq7PH6mtc7M3+N7R QFOa5O0DSy+SDl0VFNb1bhWmBuX6sGwKol9TzeD9Ic1LyOROk0opaNavMaAfHedc/rhd SO98v8fcNI8zBReoIOi75V6e3UFLjMmdYUzfSSU9d9nAk05JBEjRQcsv0CsNL1skP5Tc XaDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=6FJK5fX6Xy34m8X70gLUAwyLpubC/LkpvQQIN9+cN18=; b=i3btRShJ9E1YagW+8b5HefOis5f0IuhMjH2VDICjl9lYo4Jj46m1O9XsgLDAd8Hx5Z aUH+jMbn4rKDd0exaUgstpH7T50bipDTnvmCaWq7u+1hY3to65Q1gxxjUdSTruKJjcz7 Mr9TC/HFBEGb7pQqex07SCxiHIhhthNkPQiduA6sdEhwaSAI99ksfrJLE63Q51OexUW2 w+VuQFbExIFvjvPfNgmrpXkmWUd88QgLJm/tDIpZIMCed3HhgjxIRZBjupIiyyJdvQmF 8DT90qur8U8cjBCWgMUT7o8pB/dHxsaZt/sEk2t+KAkbTg/NJJY1u/1FoYaktWfwNS0U vyfw== X-Gm-Message-State: ALQs6tAS4k9WJtuZXhHwD7OWLueD5gFPkHSi6b0HkM3oJJN9uJWx0+vZ UBTlCalwTP3mfEjlAFhhhVFdh9Yq X-Google-Smtp-Source: AB8JxZrbEZADLIPieDij4VBAiT1ncSAJTqVZvitaof6IITCk8FbFzeq4Msh2trjuQtXKEmI1wY8Ofw== X-Received: by 2002:a17:902:bb8c:: with SMTP id m12-v6mr14255407pls.53.1525129012623; Mon, 30 Apr 2018 15:56:52 -0700 (PDT) Received: from ebiggers-linuxstation.kir.corp.google.com ([2620:15c:17:3:dc28:5c82:b905:e8a8]) by smtp.gmail.com with ESMTPSA id b15sm12969305pfi.111.2018.04.30.15.56.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 30 Apr 2018 15:56:51 -0700 (PDT) From: Eric Biggers To: linux-fscrypt@vger.kernel.org, "Theodore Y . Ts'o" Cc: Jaegeuk Kim , linux-ext4@vger.kernel.org, linux-f2fs-devel@lists.sourceforge.net, linux-mtd@lists.infradead.org, Eric Biggers Subject: [PATCH 15/15] fscrypt: only derive the needed portion of the key Date: Mon, 30 Apr 2018 15:51:49 -0700 Message-Id: <20180430225149.183514-16-ebiggers3@gmail.com> X-Mailer: git-send-email 2.17.0.441.gb46fe60e1d-goog In-Reply-To: <20180430225149.183514-1-ebiggers3@gmail.com> References: <20180430225149.183514-1-ebiggers3@gmail.com> Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: Eric Biggers Currently the key derivation function in fscrypt uses the master key length as the amount of output key material to derive. This works, but it means we can waste time deriving more key material than is actually used, e.g. most commonly, deriving 64 bytes for directories which only take a 32-byte AES-256-CTS-CBC key. It also forces us to validate that the master key length is a multiple of AES_BLOCK_SIZE, which wouldn't otherwise be necessary. Fix it to only derive the needed length key. Signed-off-by: Eric Biggers --- fs/crypto/keyinfo.c | 39 ++++++++++++++++----------------------- 1 file changed, 16 insertions(+), 23 deletions(-) diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c index f248ee9974fa..c4d1388fc9b4 100644 --- a/fs/crypto/keyinfo.c +++ b/fs/crypto/keyinfo.c @@ -19,17 +19,16 @@ static struct crypto_shash *essiv_hash_tfm; -/** - * derive_key_aes() - Derive a key using AES-128-ECB - * @deriving_key: Encryption key used for derivation. - * @source_key: Source key to which to apply derivation. - * @derived_raw_key: Derived raw key. +/* + * Key derivation function. This generates the derived key by encrypting the + * master key with AES-128-ECB using the inode's nonce as the AES key. * - * Return: Zero on success; non-zero otherwise. + * The master key must be at least as long as the derived key. If the master + * key is longer, then only the first 'derived_keysize' bytes are used. */ -static int derive_key_aes(const u8 deriving_key[FS_KEY_DERIVATION_NONCE_SIZE], - const struct fscrypt_key *source_key, - u8 derived_raw_key[FS_MAX_KEY_SIZE]) +static int derive_key_aes(const u8 *master_key, + const struct fscrypt_context *ctx, + u8 *derived_key, unsigned int derived_keysize) { int res = 0; struct skcipher_request *req = NULL; @@ -51,14 +50,13 @@ static int derive_key_aes(const u8 deriving_key[FS_KEY_DERIVATION_NONCE_SIZE], skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP, crypto_req_done, &wait); - res = crypto_skcipher_setkey(tfm, deriving_key, - FS_KEY_DERIVATION_NONCE_SIZE); + res = crypto_skcipher_setkey(tfm, ctx->nonce, sizeof(ctx->nonce)); if (res < 0) goto out; - sg_init_one(&src_sg, source_key->raw, source_key->size); - sg_init_one(&dst_sg, derived_raw_key, source_key->size); - skcipher_request_set_crypt(req, &src_sg, &dst_sg, source_key->size, + sg_init_one(&src_sg, master_key, derived_keysize); + sg_init_one(&dst_sg, derived_key, derived_keysize); + skcipher_request_set_crypt(req, &src_sg, &dst_sg, derived_keysize, NULL); res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait); out: @@ -109,10 +107,9 @@ find_and_lock_process_key(const char *prefix, goto invalid; } - if (payload->size < min_keysize || - payload->size % AES_BLOCK_SIZE != 0) { + if (payload->size < min_keysize) { fscrypt_warn(NULL, - "key with description '%s' is too short or is misaligned (got %u bytes, need %u+ bytes)", + "key with description '%s' is too short (got %u bytes, need %u+ bytes)", key->description, payload->size, min_keysize); goto invalid; } @@ -145,7 +142,7 @@ static int find_and_derive_key(const struct inode *inode, } if (IS_ERR(key)) return PTR_ERR(key); - err = derive_key_aes(ctx->nonce, payload, derived_key); + err = derive_key_aes(payload->raw, ctx, derived_key, derived_keysize); up_read(&key->sem); key_put(key); return err; @@ -325,7 +322,7 @@ int fscrypt_get_encryption_info(struct inode *inode) * crypto API as part of key derivation. */ res = -ENOMEM; - raw_key = kmalloc(FS_MAX_KEY_SIZE, GFP_NOFS); + raw_key = kmalloc(keysize, GFP_NOFS); if (!raw_key) goto out; @@ -343,10 +340,6 @@ int fscrypt_get_encryption_info(struct inode *inode) } crypt_info->ci_ctfm = ctfm; crypto_skcipher_set_flags(ctfm, CRYPTO_TFM_REQ_WEAK_KEY); - /* - * if the provided key is longer than keysize, we use the first - * keysize bytes of the derived key only - */ res = crypto_skcipher_setkey(ctfm, raw_key, keysize); if (res) goto out;