From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1kDFbQ-0004Yf-Vi for mharc-grub-devel@gnu.org; Tue, 01 Sep 2020 19:22:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:50666) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kDFbO-0004YU-Px for grub-devel@gnu.org; Tue, 01 Sep 2020 19:22:10 -0400 Received: from mail-oi1-x241.google.com ([2607:f8b0:4864:20::241]:36546) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kDFbM-0007JR-1v for grub-devel@gnu.org; Tue, 01 Sep 2020 19:22:10 -0400 Received: by mail-oi1-x241.google.com with SMTP id x19so2719083oix.3 for ; Tue, 01 Sep 2020 16:22:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficientek-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Gaw/tAIXNFbSqAlmltkA8QnYpBSysX/7DajNGJQEcwc=; b=UyErTVeHVXxxwieSlTHQEp1RIP5B5Jdk/WqOskdjPtGUVO9RNxiqqyVRajdgVQu3Xn 7K1T+oHMe1r5SX8NXP+XcUv1IpQ0R/EyNQfntWzzSNXxpS8PHHDtRjjcDOCvq7VLWo++ MRyslAeDuxHSQcRccN0Dmn8b+UzwNDLfoecFlPwyqWE943RiTzbyvjIqGZO/jJmWqeGp 6hSGQAUJFInhkFzsmLO4EDXMEgXCYvdSb3Fpmz8PamIqpwt+rYJtyOhXVeCinh7XY/UN x7MXI7JXfdrqQAhoB6sbRR70kBpZRV1fxiz3X1mjfAXN5Ym9/ylzyQ/RzAxVJYeP1Ls8 158Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Gaw/tAIXNFbSqAlmltkA8QnYpBSysX/7DajNGJQEcwc=; b=uPLvH7CjNjqUkWjBIcm8pGXiu7fn6RuZB2KFmudae77T2M+DRcja5/5vIxiqklpFUQ 7RMhnRIHLq4TIccYSn9hjfxZWPyNQRxAZW4LY1YdJCI68FwtzfGTK9K9uZRoQ5M/Uxis 49w02ZbGLMZ5DMiD1RfRZQR/728anqdPtS76AUE1U1gXQYAQvVuPZnf6Qv7E2qfQnEoF BQLz2SvUj6WpJBeGvbeFUDxPsbKIJcDTrtW2hhENq2qHev7PS6li/Tw3xSpwYWfEdtnd EduTIoWfoOnNG1yTSMC2ei4Um0VxXpSXXqwZZdgJ5s6YPMj9r+r+PCDF6OjvyIPgVd8J y3gg== X-Gm-Message-State: AOAM531WtJOMQ7GPi9n4rZ3QxwMns1h5mbTZKygP6d8T8CLxZygBz4tR EG9sKgRskJAgC1rK5i/p0ilJ6AkLGn33KA== X-Google-Smtp-Source: ABdhPJwTyRtCUrPA+KD5oZyFZQ0IkCo/nBn5wGA4kTxYkeNzi9oUNAJsEfEOqSlNuJQV/uamJuOAZw== X-Received: by 2002:aca:2b0c:: with SMTP id i12mr345504oik.77.1599002525648; Tue, 01 Sep 2020 16:22:05 -0700 (PDT) Received: from localhost.localdomain ([2605:a601:aaec:9b00:2c09:4e39:9491:777d]) by smtp.gmail.com with ESMTPSA id x11sm531384oot.0.2020.09.01.16.22.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2020 16:22:05 -0700 (PDT) From: Glenn Washburn To: grub-devel@gnu.org Cc: Patrick Steinhardt , Glenn Washburn Subject: [PATCH] cryptodisk: Properly handle non-512 byte sized sectors. Date: Tue, 1 Sep 2020 18:21:00 -0500 Message-Id: <20200901232100.510456-1-development@efficientek.com> X-Mailer: git-send-email 2.27.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=2607:f8b0:4864:20::241; envelope-from=development@efficientek.com; helo=mail-oi1-x241.google.com X-detected-operating-system: by eggs.gnu.org: No matching host in p0f cache. That's all we know. X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Sep 2020 23:22:11 -0000 By default, dm-crypt internally uses an IV that corresponds to 512-byte sectors, even when a larger sector size is specified. What this means is that when using a larger sector size, the IV is incremented every sector. However, the amount the IV is incremented is the number of 512 byte blocks in a sector (ie 8 for 4K sectors). Confusingly the IV does not corespond to the number of, for example, 4K sectors. So each cipher block in the fifth 4K sector will be encrypted with an IV equal to 32, as opposed to 32-39 for each sequential 512 byte block or an IV of 4 for each cipher block in the sector. There are some encryption utilities which do it the intuitive way and have the IV equal to the sector number regardless of sector size (ie. the fifth sector would have an IV of 4 for each cipher block). And this is supported by dm-crypt with the iv_large_sectors option and also cryptsetup as of 2.3.3 with the --iv-large-sectors, though not with LUKS headers (only with --type plain). However, support for this has not been included as grub does not support plain devices right now. One gotcha here is that the encrypted split keys are encrypted with a hard- coded 512-byte sector size. So even if your data is encrypted with 4K sector sizes, the split key encrypted area must be decrypted with a block size of 512 (ie the IV increments every 512 bytes). This made these changes less aestetically pleasing than desired. Signed-off-by: Glenn Washburn --- grub-core/disk/cryptodisk.c | 44 ++++++++++++++++++++----------------- grub-core/disk/luks.c | 5 +++-- grub-core/disk/luks2.c | 7 +++++- include/grub/cryptodisk.h | 9 +++++++- 4 files changed, 41 insertions(+), 24 deletions(-) diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c index 0b63b7d96..6319f3164 100644 --- a/grub-core/disk/cryptodisk.c +++ b/grub-core/disk/cryptodisk.c @@ -224,7 +224,8 @@ lrw_xor (const struct lrw_sector *sec, static gcry_err_code_t grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, grub_uint8_t * data, grub_size_t len, - grub_disk_addr_t sector, int do_encrypt) + grub_disk_addr_t sector, grub_size_t log_sector_size, + int do_encrypt) { grub_size_t i; gcry_err_code_t err; @@ -237,12 +238,13 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, return (do_encrypt ? grub_crypto_ecb_encrypt (dev->cipher, data, data, len) : grub_crypto_ecb_decrypt (dev->cipher, data, data, len)); - for (i = 0; i < len; i += (1U << dev->log_sector_size)) + for (i = 0; i < len; i += (1U << log_sector_size)) { grub_size_t sz = ((dev->cipher->cipher->blocksize + sizeof (grub_uint32_t) - 1) / sizeof (grub_uint32_t)); grub_uint32_t iv[(GRUB_CRYPTO_MAX_CIPHER_BLOCKSIZE + 3) / 4]; + grub_uint64_t iv_calc = 0; if (dev->rekey) { @@ -270,7 +272,7 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, if (!ctx) return GPG_ERR_OUT_OF_MEMORY; - tmp = grub_cpu_to_le64 (sector << dev->log_sector_size); + tmp = grub_cpu_to_le64 (sector << log_sector_size); dev->iv_hash->init (ctx); dev->iv_hash->write (ctx, dev->iv_prefix, dev->iv_prefix_len); dev->iv_hash->write (ctx, &tmp, sizeof (tmp)); @@ -281,14 +283,16 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, } break; case GRUB_CRYPTODISK_MODE_IV_PLAIN64: - iv[1] = grub_cpu_to_le32 (sector >> 32); + iv_calc = sector << (log_sector_size - GRUB_CRYPTODISK_IV_LOG_SIZE); + iv[1] = grub_cpu_to_le32 (iv_calc >> 32); /* FALLTHROUGH */ case GRUB_CRYPTODISK_MODE_IV_PLAIN: - iv[0] = grub_cpu_to_le32 (sector & 0xFFFFFFFF); + iv_calc = sector << (log_sector_size - GRUB_CRYPTODISK_IV_LOG_SIZE); + iv[0] = grub_cpu_to_le32 (iv_calc & 0xFFFFFFFF); break; case GRUB_CRYPTODISK_MODE_IV_BYTECOUNT64: - iv[1] = grub_cpu_to_le32 (sector >> (32 - dev->log_sector_size)); - iv[0] = grub_cpu_to_le32 ((sector << dev->log_sector_size) + iv[1] = grub_cpu_to_le32 (sector >> (32 - log_sector_size)); + iv[0] = grub_cpu_to_le32 ((sector << log_sector_size) & 0xFFFFFFFF); break; case GRUB_CRYPTODISK_MODE_IV_BENBI: @@ -311,10 +315,10 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, case GRUB_CRYPTODISK_MODE_CBC: if (do_encrypt) err = grub_crypto_cbc_encrypt (dev->cipher, data + i, data + i, - (1U << dev->log_sector_size), iv); + (1U << log_sector_size), iv); else err = grub_crypto_cbc_decrypt (dev->cipher, data + i, data + i, - (1U << dev->log_sector_size), iv); + (1U << log_sector_size), iv); if (err) return err; break; @@ -322,10 +326,10 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, case GRUB_CRYPTODISK_MODE_PCBC: if (do_encrypt) err = grub_crypto_pcbc_encrypt (dev->cipher, data + i, data + i, - (1U << dev->log_sector_size), iv); + (1U << log_sector_size), iv); else err = grub_crypto_pcbc_decrypt (dev->cipher, data + i, data + i, - (1U << dev->log_sector_size), iv); + (1U << log_sector_size), iv); if (err) return err; break; @@ -337,7 +341,7 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, if (err) return err; - for (j = 0; j < (1U << dev->log_sector_size); + for (j = 0; j < (1U << log_sector_size); j += dev->cipher->cipher->blocksize) { grub_crypto_xor (data + i + j, data + i + j, iv, @@ -368,11 +372,11 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, if (do_encrypt) err = grub_crypto_ecb_encrypt (dev->cipher, data + i, data + i, - (1U << dev->log_sector_size)); + (1U << log_sector_size)); else err = grub_crypto_ecb_decrypt (dev->cipher, data + i, data + i, - (1U << dev->log_sector_size)); + (1U << log_sector_size)); if (err) return err; lrw_xor (&sec, dev, data + i); @@ -381,10 +385,10 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, case GRUB_CRYPTODISK_MODE_ECB: if (do_encrypt) err = grub_crypto_ecb_encrypt (dev->cipher, data + i, data + i, - (1U << dev->log_sector_size)); + (1U << log_sector_size)); else err = grub_crypto_ecb_decrypt (dev->cipher, data + i, data + i, - (1U << dev->log_sector_size)); + (1U << log_sector_size)); if (err) return err; break; @@ -399,9 +403,9 @@ grub_cryptodisk_endecrypt (struct grub_cryptodisk *dev, gcry_err_code_t grub_cryptodisk_decrypt (struct grub_cryptodisk *dev, grub_uint8_t * data, grub_size_t len, - grub_disk_addr_t sector) + grub_disk_addr_t sector, grub_size_t log_sector_size) { - return grub_cryptodisk_endecrypt (dev, data, len, sector, 0); + return grub_cryptodisk_endecrypt (dev, data, len, sector, log_sector_size, 0); } grub_err_t @@ -766,7 +770,7 @@ grub_cryptodisk_read (grub_disk_t disk, grub_disk_addr_t sector, } gcry_err = grub_cryptodisk_endecrypt (dev, (grub_uint8_t *) buf, size << disk->log_sector_size, - sector, 0); + sector, dev->log_sector_size, 0); return grub_crypto_gcry_error (gcry_err); } @@ -807,7 +811,7 @@ grub_cryptodisk_write (grub_disk_t disk, grub_disk_addr_t sector, gcry_err = grub_cryptodisk_endecrypt (dev, (grub_uint8_t *) tmp, size << disk->log_sector_size, - sector, 1); + sector, disk->log_sector_size, 1); if (gcry_err) { grub_free (tmp); diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c index 59702067a..2e1347b13 100644 --- a/grub-core/disk/luks.c +++ b/grub-core/disk/luks.c @@ -124,7 +124,7 @@ configure_ciphers (grub_disk_t disk, const char *check_uuid, return NULL; newdev->offset = grub_be_to_cpu32 (header.payloadOffset); newdev->source_disk = NULL; - newdev->log_sector_size = 9; + newdev->log_sector_size = LUKS_LOG_SECTOR_SIZE; newdev->total_length = grub_disk_get_size (disk) - newdev->offset; grub_memcpy (newdev->uuid, uuid, sizeof (uuid)); newdev->modname = "luks"; @@ -247,7 +247,8 @@ luks_recover_key (grub_disk_t source, return err; } - gcry_err = grub_cryptodisk_decrypt (dev, split_key, length, 0); + gcry_err = grub_cryptodisk_decrypt (dev, split_key, length, 0, + LUKS_LOG_SECTOR_SIZE); if (gcry_err) { grub_free (split_key); diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c index 26e1126b1..eb64a0596 100644 --- a/grub-core/disk/luks2.c +++ b/grub-core/disk/luks2.c @@ -492,7 +492,12 @@ luks2_decrypt_key (grub_uint8_t *out_key, goto err; } - gcry_ret = grub_cryptodisk_decrypt (crypt, split_key, k->area.size, 0); + /* + * The key slots area is always encrypted in 512-byte sectors, + * regardless of encrypted data sector size. + */ + gcry_ret = grub_cryptodisk_decrypt (crypt, split_key, k->area.size, 0, + LUKS_LOG_SECTOR_SIZE); if (gcry_ret) { ret = grub_crypto_gcry_error (gcry_ret); diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h index e1b21e785..ecb37ba43 100644 --- a/include/grub/cryptodisk.h +++ b/include/grub/cryptodisk.h @@ -48,6 +48,13 @@ typedef enum #define GRUB_CRYPTODISK_MAX_UUID_LENGTH 71 +#define LUKS_LOG_SECTOR_SIZE 9 + +/* For the purposes of IV incrementing the sector size is 512 bytes, unless + * otherwise specified. + */ +#define GRUB_CRYPTODISK_IV_LOG_SIZE 9 + #define GRUB_CRYPTODISK_GF_LOG_SIZE 7 #define GRUB_CRYPTODISK_GF_SIZE (1U << GRUB_CRYPTODISK_GF_LOG_SIZE) #define GRUB_CRYPTODISK_GF_LOG_BYTES (GRUB_CRYPTODISK_GF_LOG_SIZE - 3) @@ -139,7 +146,7 @@ grub_cryptodisk_setkey (grub_cryptodisk_t dev, gcry_err_code_t grub_cryptodisk_decrypt (struct grub_cryptodisk *dev, grub_uint8_t * data, grub_size_t len, - grub_disk_addr_t sector); + grub_disk_addr_t sector, grub_size_t log_sector_size); grub_err_t grub_cryptodisk_insert (grub_cryptodisk_t newdev, const char *name, grub_disk_t source); -- 2.27.0