Re: How to get PBKDF settings of an existing key slot via libcryptsetup ?
Ingo Franzki <[email protected]>
| Newsgroups | gmane.linux.kernel.device-mapper.dm-crypt |
|---|---|
| Message-ID | <[email protected]> |
On 04.02.2019 14:44, Ingo Franzki wrote: > On 04.02.2019 14:22, Milan Broz wrote: >> Hi Ingo, > Hi Milan, >> >> On 31/01/2019 11:14, Ingo Franzki wrote: >>> Hi, >>> >>> is there a way to get the PBKDF settings (struct crypt_pbkdf_type) of an existing key slot in a LUKS2 volume via the libcryptsetup API? >> >> Not yet, but see below. >> >>> >>> This question is related to the default PBKDF algorithm Argon2i for LUKS2 and the out-of-memory errors that you might get when you unlock multiple LUKS2 volumes during system startup via /etc/crypttab. >>> >>> One of my application uses crypt_keyslot_add_by_key() to add a new unbound key slot. Unfortunately this new key slot gets the default PBKDF settings, thus it gets Argon2i. I guess if I would use crypt_set_pbkdf_type() before to set PBKDF2, then the new key slot would get PBKDF2 instead of Argon2i. However, I don't want to hard code PBKDF2 here, but I would like to use the PBKDF settings of the key slot that was unlocked before. So I would need a way to get the PBKDF settings of a key slot and then use crypt_set_pbkdf_type() with those settings before calling crypt_keyslot_add_by_key(). That way the new key slot would get the same PBKDF settings as the current one. >>> >>> Using crypt_get_pbkdf_type() seems to return the default PBKDF algorithm, thus Argon2i for LUKS2. >> >> Yes, you describe exactly how I intended to use it. (I guess your use key is s390 crypto, so PBKDF2 ok, because it is wrapped key for crypto accelerator, >> without the hw attacker cannot run offline attacks here.) >> >> But since we can now get per-keyslot encryption in LUKS2 through API, there should be also way how to get specific keyslot PBKDF setting (and not only the default). >> >> It should be relatively simple, so I tried to add such a call - it something like this what you need? >> https://gitlab.com/cryptsetup/cryptsetup/commit/8c3be56418248ef5b96265f901122effa88e446b >> > Yes, that's exactly what I need ! > Thanks a lot ! It would be nice if I could check via #ifdef if that new function is available or not. For example have a symbol in libcryptsetup.h that contains the current version: #define LIBCRYPTSETUP_VERSION 0x00020006 That way one could use #ifdef LIBCRYPTSETUP_VERSION >= 0x00020006 to check for a feature. That would allow me to write code that does not hardly depend on a certain cryptsetup version. If the new function is not there I could use PBKDF2 unconditionally, and when it is there I use the new function to find out what PBKDF is used by the existing keyslot. >> Thanks, >> Milan >> >> > > -- Ingo Franzki eMail: [email protected] Tel: ++49 (0)7031-16-4648 Fax: ++49 (0)7031-16-3456 Linux on IBM Z Development, Schoenaicher Str. 220, 71032 Boeblingen, Germany IBM Deutschland Research & Development GmbH / Vorsitzender des Aufsichtsrats: Matthias Hartmann Geschäftsführung: Dirk Wittkopp Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294 IBM DATA Privacy Statement: https://www.ibm.com/privacy/us/en/ _______________________________________________ dm-crypt mailing list [email protected] https://www.saout.de/mailman/listinfo/dm-crypt