From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.90_1) id 1knI4v-0008Os-Gi for mharc-grub-devel@gnu.org; Thu, 10 Dec 2020 04:17:37 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:44938) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1knI4t-0008M2-RQ for grub-devel@gnu.org; Thu, 10 Dec 2020 04:17:35 -0500 Received: from cyberdimension.org ([80.67.179.20]:35256 helo=gnutoo.cyberdimension.org) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_CHACHA20_POLY1305:256) (Exim 4.90_1) (envelope-from ) id 1knI4p-0005sp-0M for grub-devel@gnu.org; Thu, 10 Dec 2020 04:17:34 -0500 Received: from gnutoo.cyberdimension.org (localhost [127.0.0.1]) by cyberdimension.org (OpenSMTPD) with ESMTP id 345f73c3; Thu, 10 Dec 2020 09:14:05 +0000 (UTC) Received: from primarylaptop.localdomain (localhost.localdomain [::1]) by gnutoo.cyberdimension.org (OpenSMTPD) with ESMTP id 45946e78; Thu, 10 Dec 2020 09:14:04 +0000 (UTC) From: Denis 'GNUtoo' Carikli To: Patrick Steinhardt , Daniel Kiper , Glenn Washburn Cc: The development of GNU GRUB , Denis 'GNUtoo' Carikli , John Lane Subject: [PATCH v7 6/6] cryptodisk: Add support for LUKS1 key files Date: Thu, 10 Dec 2020 10:14:59 +0100 Message-Id: <20201210091459.11154-7-GNUtoo@cyberdimension.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201210091459.11154-1-GNUtoo@cyberdimension.org> References: <20201210091459.11154-1-GNUtoo@cyberdimension.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=80.67.179.20; envelope-from=GNUtoo@cyberdimension.org; helo=gnutoo.cyberdimension.org X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2020 09:17:36 -0000 cryptsetup supports key files thourh the --key-file --header command line argument for both LUKS1 and LUKS2. This adds support for LUKS1 key files. Signed-off-by: John Lane GNUtoo@cyberdimension.org: rebase, fixes, commit message Signed-off-by: Denis 'GNUtoo' Carikli Reviewed-by: Patrick Steinhardt --- ChangeLog since v4: - Added Reviewed-by tag ChangeLog since v5: - No changes ChangeLog since v6: - No changes --- grub-core/disk/luks.c | 43 ++++++++++++++++++++++++++----------------- 1 file changed, 26 insertions(+), 17 deletions(-) diff --git a/grub-core/disk/luks.c b/grub-core/disk/luks.c index b7867585a..0f6948f73 100644 --- a/grub-core/disk/luks.c +++ b/grub-core/disk/luks.c @@ -168,7 +168,9 @@ luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr, struct grub_luks_phdr header; grub_size_t keysize; grub_uint8_t *split_key = NULL; - char passphrase[MAX_PASSPHRASE] = ""; + char interactive_passphrase[MAX_PASSPHRASE] = ""; + grub_uint8_t *passphrase; + grub_size_t passphrase_length; grub_uint8_t candidate_digest[sizeof (header.mkDigest)]; unsigned i; grub_size_t length; @@ -177,10 +179,6 @@ luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr, char *tmp; grub_uint32_t sector; - /* Keyfiles are not implemented yet */ - if (keyfile_bytes || keyfile_bytes_size) - return GRUB_ERR_NOT_IMPLEMENTED_YET; - if (hdr) { if (grub_file_seek (hdr, 0) == (grub_off_t) -1) @@ -209,18 +207,29 @@ luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr, if (!split_key) return grub_errno; - /* Get the passphrase from the user. */ - tmp = NULL; - if (source->partition) - tmp = grub_partition_get_name (source->partition); - grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, - source->partition ? "," : "", tmp ? : "", - dev->uuid); - grub_free (tmp); - if (!grub_password_get (passphrase, MAX_PASSPHRASE)) + if (keyfile_bytes) { - grub_free (split_key); - return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied"); + /* Use bytestring from key file as passphrase */ + passphrase = keyfile_bytes; + passphrase_length = keyfile_bytes_size; + } + else + { + /* Get the passphrase from the user. */ + tmp = NULL; + if (source->partition) + tmp = grub_partition_get_name (source->partition); + grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, + source->partition ? "," : "", tmp ? : "", dev->uuid); + grub_free (tmp); + if (!grub_password_get (interactive_passphrase, MAX_PASSPHRASE)) + { + grub_free (split_key); + return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not supplied"); + } + + passphrase = (grub_uint8_t *)interactive_passphrase; + passphrase_length = grub_strlen (interactive_passphrase); } /* Try to recover master key from each active keyslot. */ @@ -238,7 +247,7 @@ luks_recover_key (grub_disk_t source, grub_cryptodisk_t dev, grub_file_t hdr, /* Calculate the PBKDF2 of the user supplied passphrase. */ gcry_err = grub_crypto_pbkdf2 (dev->hash, (grub_uint8_t *) passphrase, - grub_strlen (passphrase), + passphrase_length, header.keyblock[i].passwordSalt, sizeof (header.keyblock[i].passwordSalt), grub_be_to_cpu32 (header.keyblock[i]. -- 2.29.2