Re: How to get PBKDF settings of an existing key slot via libcryptsetup ?

On 04.02.2019 18:47, Milan Broz wrote:
> On 04/02/2019 16:15, Ingo Franzki wrote:
>> It would be nice if I could check via #ifdef if that new function is available or not. 
>> For example have a symbol in libcryptsetup.h that contains the current version:
>> #define LIBCRYPTSETUP_VERSION     0x00020006
>> That way one could use 
>> #ifdef LIBCRYPTSETUP_VERSION >= 0x00020006
>> to check for a feature.
> 
> No, sorry, I am not going to provide such strings. Usually, it ends in a big confusion
> (some distro backports patches without modifying define, etc.)
> 
> Also, the version of API is not the version of binaries (we use so lib versioning
> that provides backward compatibility on the symbol level).
> 
> The proper way would be to use autoconf (or similar tool) that checks availability
> of symbol and then it automatically defines HAVE_symbol in config.h, but I am not sure
> if you can use it.
> 
> I'll try to squeeze it to 2.1 release, there will be some new defines as well,
> so library name version will be updated appropriately.
> In the worst case, you can probably "abuse" other defines that appears in libcryptsetup.h
> (like CRYPT_LOG_DEBUG_JSON) in the same version.
> 
> Milan
> 
> 

I have now added support for calling crypt_keyslot_get_pbkdf(). 
Works great, with one little exception:

When getting a PBKDF from a key slot, the field time_ms is zero. 
When setting this PBKDF using crypt_set_pbkdf_type() I get an error that time can not be zero:
Message "Requested PBKDF target time cannot be zero." from function verify_pbkdf_params().

Looking at function LUKS2_keyslot_pbkdf() it seems that there is a little copy & paste error:

	if (json_object_object_get_ex(jobj_kdf, "iterations", &jobj))
		pbkdf->iterations = json_object_get_int(jobj);
	if (json_object_object_get_ex(jobj_kdf, "time", &jobj))
		pbkdf->iterations = json_object_get_int(jobj); <--- should set field time_ms, not iterations

Not a big deal, I can set time_ms manually before calling crypt_set_pbkdf_type() when it is zero.

-- 
Ingo Franzki
eMail: [email protected]  
Tel: ++49 (0)7031-16-4648
Fax: ++49 (0)7031-16-3456
Linux on IBM Z Development, Schoenaicher Str. 220, 71032 Boeblingen, Germany

IBM Deutschland Research & Development GmbH / Vorsitzender des Aufsichtsrats: Matthias Hartmann
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM DATA Privacy Statement: https://www.ibm.com/privacy/us/en/

_______________________________________________
dm-crypt mailing list
[email protected]
https://www.saout.de/mailman/listinfo/dm-crypt