Georg/luksrku
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
204f85c93f
luksrku/vault.h

54 lines
1.6 KiB
C
Raw Normal View History

Add license header to vault files Since this was just work-in-progress, I had forgotten to include license header text.
2019-10-19 11:10:03 +02:00
/*
luksrku - Tool to remotely unlock LUKS disks using TLS.
Copyright (C) 2016-2019 Johannes Bauer
This file is part of luksrku.
luksrku is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; this program is ONLY licensed under
version 3 of the License, later versions are explicitly excluded.
luksrku is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with luksrku; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Johannes Bauer <JohannesBauer@gmx.de>
*/
Started working on a coldboot-resistant "vault" implementation When not needed, encrypt the keys in-memory with a large pre-key so that forensic acquisition of data using coldboot becomes infeasible. Not used yet internally.
2019-10-19 11:07:55 +02:00
#ifndef __VAULT_H__
#define __VAULT_H__
#include <stdbool.h>
#include <stdint.h>
Make vault threadsafe We might have multiple processes accessing the vault and need to always keep a proper reference count.
2019-10-25 16:30:46 +02:00
#include <pthread.h>
Started working on a coldboot-resistant "vault" implementation When not needed, encrypt the keys in-memory with a large pre-key so that forensic acquisition of data using coldboot becomes infeasible. Not used yet internally.
2019-10-19 11:07:55 +02:00
struct vault_t {
Make vault threadsafe We might have multiple processes accessing the vault and need to always keep a proper reference count.
2019-10-25 16:30:46 +02:00
pthread_mutex_t mutex;
unsigned int reference_count;
Started working on a coldboot-resistant "vault" implementation When not needed, encrypt the keys in-memory with a large pre-key so that forensic acquisition of data using coldboot becomes infeasible. Not used yet internally.
2019-10-19 11:07:55 +02:00
void *data;
unsigned int data_length;
Slight refactoring of vault code We want to keep the dkey in the vault structure as long as it's open (because only the open operation should take long, the close operation should be really fast).
2019-10-26 10:33:36 +02:00
uint8_t *source_key;
unsigned int source_key_length;
Started working on a coldboot-resistant "vault" implementation When not needed, encrypt the keys in-memory with a large pre-key so that forensic acquisition of data using coldboot becomes infeasible. Not used yet internally.
2019-10-19 11:07:55 +02:00
uint8_t auth_tag[16];
Modify keying in vault We currently derive the dkey from the source key at every open or close (decrypt or encrypt) operation. However, we want to keep the time that the internal data is exposed (decrypted) as short as possible. While the vault is open, there's no problem keeping a copy of the dkey around (because the data is decrypted anyways, therefore it isn't important). So we change things around and, at the expense of doubling the time that decryption takes, we make encryption extremely fast. We do this by computing the next (rekeyed) key at the start of the decryption routine (but before the data has been decrypted) and keep the dkey stored in the vault structure for direct access on the next encryption run.
2019-10-26 12:55:25 +02:00
uint8_t dkey[32];
Started working on a coldboot-resistant "vault" implementation When not needed, encrypt the keys in-memory with a large pre-key so that forensic acquisition of data using coldboot becomes infeasible. Not used yet internally.
2019-10-19 11:07:55 +02:00
uint64_t iv;
Make vault iteration count adaptible to hardware We want to specify a real time for key derivation and let it figure out by itself how many iterations it needs.
2019-10-19 11:29:39 +02:00
unsigned int iteration_cnt;
Started working on a coldboot-resistant "vault" implementation When not needed, encrypt the keys in-memory with a large pre-key so that forensic acquisition of data using coldboot becomes infeasible. Not used yet internally.
2019-10-19 11:07:55 +02:00
};
Slight refactoring of vault code We want to keep the dkey in the vault structure as long as it's open (because only the open operation should take long, the close operation should be really fast).
2019-10-26 10:33:36 +02:00
#define DEFAULT_SOURCE_KEY_LENGTH_BYTES (1024 * 1024)
Started working on a coldboot-resistant "vault" implementation When not needed, encrypt the keys in-memory with a large pre-key so that forensic acquisition of data using coldboot becomes infeasible. Not used yet internally.
2019-10-19 11:07:55 +02:00
/*************** AUTO GENERATED SECTION FOLLOWS ***************/
Make vault iteration count adaptible to hardware We want to specify a real time for key derivation and let it figure out by itself how many iterations it needs.
2019-10-19 11:29:39 +02:00
struct vault_t* vault_init(unsigned int data_length, double target_derivation_time);
Started working on a coldboot-resistant "vault" implementation When not needed, encrypt the keys in-memory with a large pre-key so that forensic acquisition of data using coldboot becomes infeasible. Not used yet internally.
2019-10-19 11:07:55 +02:00
bool vault_open(struct vault_t *vault);
bool vault_close(struct vault_t *vault);
void vault_free(struct vault_t *vault);
/*************** AUTO GENERATED SECTION ENDS ***************/
#endif
Reference in New Issue Copy Permalink