3dfb094cb2
To prevent keys from being compromised if an attacker acquires read access to kernel memory, some inline encryption hardware supports protecting the keys in hardware without software having access to or the ability to set the plaintext keys. Instead, software only sees "wrapped keys", which may differ on every boot. 'wrappedkey_v0' fileencryption flag is used to denote that the device supports inline encryption hardware that supports this feature. On such devices keymaster is used to generate keys with STORAGE_KEY tag and export a per-boot ephemerally wrapped storage key to install it in the kernel. The wrapped key framework in the linux kernel ensures the wrapped key is provided to the inline encryption hardware where it is unwrapped and the file contents key is derived to encrypt contents without revealing the plaintext key in the clear. Test: FBE validation with Fscrypt v2 + inline crypt + wrapped key changes kernel. Bug: 147733587 Change-Id: I1f0de61b56534ec1df9baef075acb74bacd00758
79 lines
3 KiB
C++
79 lines
3 KiB
C++
/*
|
|
* Copyright (C) 2016 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#ifndef ANDROID_VOLD_KEYSTORAGE_H
|
|
#define ANDROID_VOLD_KEYSTORAGE_H
|
|
|
|
#include "KeyBuffer.h"
|
|
|
|
#include <string>
|
|
|
|
namespace android {
|
|
namespace vold {
|
|
|
|
// Represents the information needed to decrypt a disk encryption key.
|
|
// If "token" is nonempty, it is passed in as a required Gatekeeper auth token.
|
|
// If "token" and "secret" are nonempty, "secret" is appended to the application-specific
|
|
// binary needed to unlock.
|
|
// If only "secret" is nonempty, it is used to decrypt in a non-Keymaster process.
|
|
class KeyAuthentication {
|
|
public:
|
|
KeyAuthentication(const std::string& t, const std::string& s) : token{t}, secret{s} {};
|
|
|
|
bool usesKeymaster() const { return !token.empty() || secret.empty(); };
|
|
|
|
const std::string token;
|
|
const std::string secret;
|
|
};
|
|
|
|
extern const KeyAuthentication kEmptyAuthentication;
|
|
|
|
// Checks if path "path" exists.
|
|
bool pathExists(const std::string& path);
|
|
|
|
bool createSecdiscardable(const std::string& path, std::string* hash);
|
|
bool readSecdiscardable(const std::string& path, std::string* hash);
|
|
|
|
// Create a directory at the named path, and store "key" in it,
|
|
// in such a way that it can only be retrieved via Keymaster and
|
|
// can be securely deleted.
|
|
// It's safe to move/rename the directory after creation.
|
|
bool storeKey(const std::string& dir, const KeyAuthentication& auth, const KeyBuffer& key);
|
|
|
|
// Create a directory at the named path, and store "key" in it as storeKey
|
|
// This version creates the key in "tmp_path" then atomically renames "tmp_path"
|
|
// to "key_path" thereby ensuring that the key is either stored entirely or
|
|
// not at all.
|
|
bool storeKeyAtomically(const std::string& key_path, const std::string& tmp_path,
|
|
const KeyAuthentication& auth, const KeyBuffer& key);
|
|
|
|
// Retrieve the key from the named directory.
|
|
bool retrieveKey(const std::string& dir, const KeyAuthentication& auth, KeyBuffer* key,
|
|
bool keepOld = false);
|
|
|
|
// Securely destroy the key stored in the named directory and delete the directory.
|
|
bool destroyKey(const std::string& dir);
|
|
|
|
bool runSecdiscardSingle(const std::string& file);
|
|
|
|
// Generate wrapped storage key using keymaster. Uses STORAGE_KEY tag in keymaster.
|
|
bool generateWrappedStorageKey(KeyBuffer* key);
|
|
// Export the per-boot boot wrapped storage key using keymaster.
|
|
bool exportWrappedStorageKey(const KeyBuffer& kmKey, KeyBuffer* key);
|
|
} // namespace vold
|
|
} // namespace android
|
|
|
|
#endif
|