From: Simon Glass <simon.glass@canonical.com> Add a few Kconfig options to support XTS (XEX Tweakable Block Ciphertext Stealing). Co-developed-by: Claude <noreply@anthropic.com> Signed-off-by: Simon Glass <simon.glass@canonical.com> --- lib/mbedtls/Makefile | 4 ++++ lib/mbedtls/mbedtls_def_config.h | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile index 0506a5a6b3e..257f585c013 100644 --- a/lib/mbedtls/Makefile +++ b/lib/mbedtls/Makefile @@ -37,6 +37,10 @@ mbedtls_lib_crypto-$(CONFIG_$(PHASE_)HKDF_MBEDTLS) += \ $(MBEDTLS_LIB_DIR)/hkdf.o mbedtls_lib_crypto-$(CONFIG_$(PHASE_)PKCS5_MBEDTLS) += \ $(MBEDTLS_LIB_DIR)/pkcs5.o +mbedtls_lib_crypto-$(CONFIG_$(PHASE_)BLK_LUKS) += \ + $(MBEDTLS_LIB_DIR)/aes.o \ + $(MBEDTLS_LIB_DIR)/cipher.o \ + $(MBEDTLS_LIB_DIR)/cipher_wrap.o # MbedTLS X509 library obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_X509) += mbedtls_lib_x509.o diff --git a/lib/mbedtls/mbedtls_def_config.h b/lib/mbedtls/mbedtls_def_config.h index 9e3beed07f4..a0578d33ba6 100644 --- a/lib/mbedtls/mbedtls_def_config.h +++ b/lib/mbedtls/mbedtls_def_config.h @@ -64,6 +64,12 @@ #define MBEDTLS_PKCS5_C #endif +#if CONFIG_IS_ENABLED(BLK_LUKS) +#define MBEDTLS_CIPHER_C +#define MBEDTLS_CIPHER_MODE_XTS +#define MBEDTLS_AES_C +#endif + #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) #if CONFIG_IS_ENABLED(X509_CERTIFICATE_PARSER) @@ -104,6 +110,7 @@ #define MBEDTLS_SSL_CLI_C #define MBEDTLS_SSL_TLS_C #define MBEDTLS_CIPHER_C +#define MBEDTLS_CIPHER_MODE_XTS #define MBEDTLS_MD_C #define MBEDTLS_CTR_DRBG_C #define MBEDTLS_AES_C -- 2.43.0

From: Simon Glass <simon.glass@canonical.com> Update ut_asserteq_str() and ut_asserteq_strn() to check for NULL. This allows tests to avoid doing this. Co-developed-by: Claude <noreply@anthropic.com> Signed-off-by: Simon Glass <simon.glass@canonical.com> --- include/test/ut.h | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/include/test/ut.h b/include/test/ut.h index 6731b43dba9..70eaaea5e0e 100644 --- a/include/test/ut.h +++ b/include/test/ut.h @@ -206,7 +206,15 @@ int ut_check_console_dump(struct unit_test_state *uts, int total_bytes); const char *_val1 = (expr1), *_val2 = (expr2); \ int __ret = 0; \ \ - if (strcmp(_val1, _val2)) { \ + if (!_val1 || !_val2) { \ + ut_failf(uts, __FILE__, __LINE__, __func__, \ + #expr1 " = " #expr2, \ + "Expected \"%s\", got \"%s\"", \ + _val1 ? _val1 : "(null)", \ + _val2 ? _val2 : "(null)"); \ + if (!uts->soft_fail) \ + return CMD_RET_FAILURE; \ + } else if (strcmp(_val1, _val2)) { \ ut_failf(uts, __FILE__, __LINE__, __func__, \ #expr1 " = " #expr2, \ "Expected \"%s\", got \"%s\"", _val1, _val2); \ @@ -222,16 +230,26 @@ int ut_check_console_dump(struct unit_test_state *uts, int total_bytes); */ #define ut_asserteq_strn(expr1, expr2) ({ \ const char *_val1 = (expr1), *_val2 = (expr2); \ - int _len = strlen(_val1); \ int __ret = 0; \ \ - if (memcmp(_val1, _val2, _len)) { \ + if (!_val1 || !_val2) { \ ut_failf(uts, __FILE__, __LINE__, __func__, \ #expr1 " = " #expr2, \ - "Expected \"%.*s\", got \"%.*s\"", \ - _len, _val1, _len, _val2); \ + "Expected \"%s\", got \"%s\"", \ + _val1 ? _val1 : "(null)", \ + _val2 ? _val2 : "(null)"); \ if (!uts->soft_fail) \ return CMD_RET_FAILURE; \ + } else { \ + int _len = strlen(_val1); \ + if (memcmp(_val1, _val2, _len)) { \ + ut_failf(uts, __FILE__, __LINE__, __func__, \ + #expr1 " = " #expr2, \ + "Expected \"%.*s\", got \"%.*s\"", \ + _len, _val1, _len, _val2); \ + if (!uts->soft_fail) \ + return CMD_RET_FAILURE; \ + } \ } \ __ret; \ }) -- 2.43.0

From: Simon Glass <simon.glass@canonical.com> This library is used for full-disk encryption with LUKS, so bring it in from https://github.com/P-H-C/phc-winner-argon2 commit: f57e61e Merge pull request #321 from bittorf/fix-spelling-mistakes Co-developed-by: Claude <noreply@anthropic.com> Signed-off-by: Simon Glass <simon.glass@canonical.com> --- lib/argon2/argon2.c | 452 +++++++++++++++++++ lib/argon2/argon2.h | 437 ++++++++++++++++++ lib/argon2/blake2/blake2-impl.h | 156 +++++++ lib/argon2/blake2/blake2.h | 89 ++++ lib/argon2/blake2/blake2b.c | 390 ++++++++++++++++ lib/argon2/blake2/blamka-round-ref.h | 56 +++ lib/argon2/core.c | 648 +++++++++++++++++++++++++++ lib/argon2/core.h | 228 ++++++++++ lib/argon2/ref.c | 194 ++++++++ 9 files changed, 2650 insertions(+) create mode 100644 lib/argon2/argon2.c create mode 100644 lib/argon2/argon2.h create mode 100644 lib/argon2/blake2/blake2-impl.h create mode 100644 lib/argon2/blake2/blake2.h create mode 100644 lib/argon2/blake2/blake2b.c create mode 100644 lib/argon2/blake2/blamka-round-ref.h create mode 100644 lib/argon2/core.c create mode 100644 lib/argon2/core.h create mode 100644 lib/argon2/ref.c diff --git a/lib/argon2/argon2.c b/lib/argon2/argon2.c new file mode 100644 index 00000000000..34da3d6b4ac --- /dev/null +++ b/lib/argon2/argon2.c @@ -0,0 +1,452 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include <string.h> +#include <stdlib.h> +#include <stdio.h> + +#include "argon2.h" +#include "encoding.h" +#include "core.h" + +const char *argon2_type2string(argon2_type type, int uppercase) { + switch (type) { + case Argon2_d: + return uppercase ? "Argon2d" : "argon2d"; + case Argon2_i: + return uppercase ? "Argon2i" : "argon2i"; + case Argon2_id: + return uppercase ? "Argon2id" : "argon2id"; + } + + return NULL; +} + +int argon2_ctx(argon2_context *context, argon2_type type) { + /* 1. Validate all inputs */ + int result = validate_inputs(context); + uint32_t memory_blocks, segment_length; + argon2_instance_t instance; + + if (ARGON2_OK != result) { + return result; + } + + if (Argon2_d != type && Argon2_i != type && Argon2_id != type) { + return ARGON2_INCORRECT_TYPE; + } + + /* 2. Align memory size */ + /* Minimum memory_blocks = 8L blocks, where L is the number of lanes */ + memory_blocks = context->m_cost; + + if (memory_blocks < 2 * ARGON2_SYNC_POINTS * context->lanes) { + memory_blocks = 2 * ARGON2_SYNC_POINTS * context->lanes; + } + + segment_length = memory_blocks / (context->lanes * ARGON2_SYNC_POINTS); + /* Ensure that all segments have equal length */ + memory_blocks = segment_length * (context->lanes * ARGON2_SYNC_POINTS); + + instance.version = context->version; + instance.memory = NULL; + instance.passes = context->t_cost; + instance.memory_blocks = memory_blocks; + instance.segment_length = segment_length; + instance.lane_length = segment_length * ARGON2_SYNC_POINTS; + instance.lanes = context->lanes; + instance.threads = context->threads; + instance.type = type; + + if (instance.threads > instance.lanes) { + instance.threads = instance.lanes; + } + + /* 3. Initialization: Hashing inputs, allocating memory, filling first + * blocks + */ + result = initialize(&instance, context); + + if (ARGON2_OK != result) { + return result; + } + + /* 4. Filling memory */ + result = fill_memory_blocks(&instance); + + if (ARGON2_OK != result) { + return result; + } + /* 5. Finalization */ + finalize(context, &instance); + + return ARGON2_OK; +} + +int argon2_hash(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, const size_t saltlen, + void *hash, const size_t hashlen, char *encoded, + const size_t encodedlen, argon2_type type, + const uint32_t version){ + + argon2_context context; + int result; + uint8_t *out; + + if (pwdlen > ARGON2_MAX_PWD_LENGTH) { + return ARGON2_PWD_TOO_LONG; + } + + if (saltlen > ARGON2_MAX_SALT_LENGTH) { + return ARGON2_SALT_TOO_LONG; + } + + if (hashlen > ARGON2_MAX_OUTLEN) { + return ARGON2_OUTPUT_TOO_LONG; + } + + if (hashlen < ARGON2_MIN_OUTLEN) { + return ARGON2_OUTPUT_TOO_SHORT; + } + + out = malloc(hashlen); + if (!out) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + context.out = (uint8_t *)out; + context.outlen = (uint32_t)hashlen; + context.pwd = CONST_CAST(uint8_t *)pwd; + context.pwdlen = (uint32_t)pwdlen; + context.salt = CONST_CAST(uint8_t *)salt; + context.saltlen = (uint32_t)saltlen; + context.secret = NULL; + context.secretlen = 0; + context.ad = NULL; + context.adlen = 0; + context.t_cost = t_cost; + context.m_cost = m_cost; + context.lanes = parallelism; + context.threads = parallelism; + context.allocate_cbk = NULL; + context.free_cbk = NULL; + context.flags = ARGON2_DEFAULT_FLAGS; + context.version = version; + + result = argon2_ctx(&context, type); + + if (result != ARGON2_OK) { + clear_internal_memory(out, hashlen); + free(out); + return result; + } + + /* if raw hash requested, write it */ + if (hash) { + memcpy(hash, out, hashlen); + } + + /* if encoding requested, write it */ + if (encoded && encodedlen) { + if (encode_string(encoded, encodedlen, &context, type) != ARGON2_OK) { + clear_internal_memory(out, hashlen); /* wipe buffers if error */ + clear_internal_memory(encoded, encodedlen); + free(out); + return ARGON2_ENCODING_FAIL; + } + } + clear_internal_memory(out, hashlen); + free(out); + + return ARGON2_OK; +} + +int argon2i_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_i, + ARGON2_VERSION_NUMBER); +} + +int argon2i_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_i, ARGON2_VERSION_NUMBER); +} + +int argon2d_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_d, + ARGON2_VERSION_NUMBER); +} + +int argon2d_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_d, ARGON2_VERSION_NUMBER); +} + +int argon2id_hash_encoded(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, const size_t hashlen, + char *encoded, const size_t encodedlen) { + + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + NULL, hashlen, encoded, encodedlen, Argon2_id, + ARGON2_VERSION_NUMBER); +} + +int argon2id_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, const size_t hashlen) { + return argon2_hash(t_cost, m_cost, parallelism, pwd, pwdlen, salt, saltlen, + hash, hashlen, NULL, 0, Argon2_id, + ARGON2_VERSION_NUMBER); +} + +static int argon2_compare(const uint8_t *b1, const uint8_t *b2, size_t len) { + size_t i; + uint8_t d = 0U; + + for (i = 0U; i < len; i++) { + d |= b1[i] ^ b2[i]; + } + return (int)((1 & ((d - 1) >> 8)) - 1); +} + +int argon2_verify(const char *encoded, const void *pwd, const size_t pwdlen, + argon2_type type) { + + argon2_context ctx; + uint8_t *desired_result = NULL; + + int ret = ARGON2_OK; + + size_t encoded_len; + uint32_t max_field_len; + + if (pwdlen > ARGON2_MAX_PWD_LENGTH) { + return ARGON2_PWD_TOO_LONG; + } + + if (encoded == NULL) { + return ARGON2_DECODING_FAIL; + } + + encoded_len = strlen(encoded); + if (encoded_len > UINT32_MAX) { + return ARGON2_DECODING_FAIL; + } + + /* No field can be longer than the encoded length */ + max_field_len = (uint32_t)encoded_len; + + ctx.saltlen = max_field_len; + ctx.outlen = max_field_len; + + ctx.salt = malloc(ctx.saltlen); + ctx.out = malloc(ctx.outlen); + if (!ctx.salt || !ctx.out) { + ret = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + ctx.pwd = (uint8_t *)pwd; + ctx.pwdlen = (uint32_t)pwdlen; + + ret = decode_string(&ctx, encoded, type); + if (ret != ARGON2_OK) { + goto fail; + } + + /* Set aside the desired result, and get a new buffer. */ + desired_result = ctx.out; + ctx.out = malloc(ctx.outlen); + if (!ctx.out) { + ret = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + ret = argon2_verify_ctx(&ctx, (char *)desired_result, type); + if (ret != ARGON2_OK) { + goto fail; + } + +fail: + free(ctx.salt); + free(ctx.out); + free(desired_result); + + return ret; +} + +int argon2i_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_i); +} + +int argon2d_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_d); +} + +int argon2id_verify(const char *encoded, const void *pwd, const size_t pwdlen) { + + return argon2_verify(encoded, pwd, pwdlen, Argon2_id); +} + +int argon2d_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_d); +} + +int argon2i_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_i); +} + +int argon2id_ctx(argon2_context *context) { + return argon2_ctx(context, Argon2_id); +} + +int argon2_verify_ctx(argon2_context *context, const char *hash, + argon2_type type) { + int ret = argon2_ctx(context, type); + if (ret != ARGON2_OK) { + return ret; + } + + if (argon2_compare((uint8_t *)hash, context->out, context->outlen)) { + return ARGON2_VERIFY_MISMATCH; + } + + return ARGON2_OK; +} + +int argon2d_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_d); +} + +int argon2i_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_i); +} + +int argon2id_verify_ctx(argon2_context *context, const char *hash) { + return argon2_verify_ctx(context, hash, Argon2_id); +} + +const char *argon2_error_message(int error_code) { + switch (error_code) { + case ARGON2_OK: + return "OK"; + case ARGON2_OUTPUT_PTR_NULL: + return "Output pointer is NULL"; + case ARGON2_OUTPUT_TOO_SHORT: + return "Output is too short"; + case ARGON2_OUTPUT_TOO_LONG: + return "Output is too long"; + case ARGON2_PWD_TOO_SHORT: + return "Password is too short"; + case ARGON2_PWD_TOO_LONG: + return "Password is too long"; + case ARGON2_SALT_TOO_SHORT: + return "Salt is too short"; + case ARGON2_SALT_TOO_LONG: + return "Salt is too long"; + case ARGON2_AD_TOO_SHORT: + return "Associated data is too short"; + case ARGON2_AD_TOO_LONG: + return "Associated data is too long"; + case ARGON2_SECRET_TOO_SHORT: + return "Secret is too short"; + case ARGON2_SECRET_TOO_LONG: + return "Secret is too long"; + case ARGON2_TIME_TOO_SMALL: + return "Time cost is too small"; + case ARGON2_TIME_TOO_LARGE: + return "Time cost is too large"; + case ARGON2_MEMORY_TOO_LITTLE: + return "Memory cost is too small"; + case ARGON2_MEMORY_TOO_MUCH: + return "Memory cost is too large"; + case ARGON2_LANES_TOO_FEW: + return "Too few lanes"; + case ARGON2_LANES_TOO_MANY: + return "Too many lanes"; + case ARGON2_PWD_PTR_MISMATCH: + return "Password pointer is NULL, but password length is not 0"; + case ARGON2_SALT_PTR_MISMATCH: + return "Salt pointer is NULL, but salt length is not 0"; + case ARGON2_SECRET_PTR_MISMATCH: + return "Secret pointer is NULL, but secret length is not 0"; + case ARGON2_AD_PTR_MISMATCH: + return "Associated data pointer is NULL, but ad length is not 0"; + case ARGON2_MEMORY_ALLOCATION_ERROR: + return "Memory allocation error"; + case ARGON2_FREE_MEMORY_CBK_NULL: + return "The free memory callback is NULL"; + case ARGON2_ALLOCATE_MEMORY_CBK_NULL: + return "The allocate memory callback is NULL"; + case ARGON2_INCORRECT_PARAMETER: + return "Argon2_Context context is NULL"; + case ARGON2_INCORRECT_TYPE: + return "There is no such version of Argon2"; + case ARGON2_OUT_PTR_MISMATCH: + return "Output pointer mismatch"; + case ARGON2_THREADS_TOO_FEW: + return "Not enough threads"; + case ARGON2_THREADS_TOO_MANY: + return "Too many threads"; + case ARGON2_MISSING_ARGS: + return "Missing arguments"; + case ARGON2_ENCODING_FAIL: + return "Encoding failed"; + case ARGON2_DECODING_FAIL: + return "Decoding failed"; + case ARGON2_THREAD_FAIL: + return "Threading failure"; + case ARGON2_DECODING_LENGTH_FAIL: + return "Some of encoded parameters are too long or too short"; + case ARGON2_VERIFY_MISMATCH: + return "The password does not match the supplied hash"; + default: + return "Unknown error code"; + } +} + +size_t argon2_encodedlen(uint32_t t_cost, uint32_t m_cost, uint32_t parallelism, + uint32_t saltlen, uint32_t hashlen, argon2_type type) { + return strlen("$$v=$m=,t=,p=$$") + strlen(argon2_type2string(type, 0)) + + numlen(t_cost) + numlen(m_cost) + numlen(parallelism) + + b64len(saltlen) + b64len(hashlen) + numlen(ARGON2_VERSION_NUMBER) + 1; +} diff --git a/lib/argon2/argon2.h b/lib/argon2/argon2.h new file mode 100644 index 00000000000..3980bb352f2 --- /dev/null +++ b/lib/argon2/argon2.h @@ -0,0 +1,437 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_H +#define ARGON2_H + +#include <stdint.h> +#include <stddef.h> +#include <limits.h> + +#if defined(__cplusplus) +extern "C" { +#endif + +/* Symbols visibility control */ +#ifdef A2_VISCTL +#define ARGON2_PUBLIC __attribute__((visibility("default"))) +#define ARGON2_LOCAL __attribute__ ((visibility ("hidden"))) +#elif defined(_MSC_VER) +#define ARGON2_PUBLIC __declspec(dllexport) +#define ARGON2_LOCAL +#else +#define ARGON2_PUBLIC +#define ARGON2_LOCAL +#endif + +/* + * Argon2 input parameter restrictions + */ + +/* Minimum and maximum number of lanes (degree of parallelism) */ +#define ARGON2_MIN_LANES UINT32_C(1) +#define ARGON2_MAX_LANES UINT32_C(0xFFFFFF) + +/* Minimum and maximum number of threads */ +#define ARGON2_MIN_THREADS UINT32_C(1) +#define ARGON2_MAX_THREADS UINT32_C(0xFFFFFF) + +/* Number of synchronization points between lanes per pass */ +#define ARGON2_SYNC_POINTS UINT32_C(4) + +/* Minimum and maximum digest size in bytes */ +#define ARGON2_MIN_OUTLEN UINT32_C(4) +#define ARGON2_MAX_OUTLEN UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum number of memory blocks (each of BLOCK_SIZE bytes) */ +#define ARGON2_MIN_MEMORY (2 * ARGON2_SYNC_POINTS) /* 2 blocks per slice */ + +#define ARGON2_MIN(a, b) ((a) < (b) ? (a) : (b)) +/* Max memory size is addressing-space/2, topping at 2^32 blocks (4 TB) */ +#define ARGON2_MAX_MEMORY_BITS \ + ARGON2_MIN(UINT32_C(32), (sizeof(void *) * CHAR_BIT - 10 - 1)) +#define ARGON2_MAX_MEMORY \ + ARGON2_MIN(UINT32_C(0xFFFFFFFF), UINT64_C(1) << ARGON2_MAX_MEMORY_BITS) + +/* Minimum and maximum number of passes */ +#define ARGON2_MIN_TIME UINT32_C(1) +#define ARGON2_MAX_TIME UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum password length in bytes */ +#define ARGON2_MIN_PWD_LENGTH UINT32_C(0) +#define ARGON2_MAX_PWD_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum associated data length in bytes */ +#define ARGON2_MIN_AD_LENGTH UINT32_C(0) +#define ARGON2_MAX_AD_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum salt length in bytes */ +#define ARGON2_MIN_SALT_LENGTH UINT32_C(8) +#define ARGON2_MAX_SALT_LENGTH UINT32_C(0xFFFFFFFF) + +/* Minimum and maximum key length in bytes */ +#define ARGON2_MIN_SECRET UINT32_C(0) +#define ARGON2_MAX_SECRET UINT32_C(0xFFFFFFFF) + +/* Flags to determine which fields are securely wiped (default = no wipe). */ +#define ARGON2_DEFAULT_FLAGS UINT32_C(0) +#define ARGON2_FLAG_CLEAR_PASSWORD (UINT32_C(1) << 0) +#define ARGON2_FLAG_CLEAR_SECRET (UINT32_C(1) << 1) + +/* Global flag to determine if we are wiping internal memory buffers. This flag + * is defined in core.c and defaults to 1 (wipe internal memory). */ +extern int FLAG_clear_internal_memory; + +/* Error codes */ +typedef enum Argon2_ErrorCodes { + ARGON2_OK = 0, + + ARGON2_OUTPUT_PTR_NULL = -1, + + ARGON2_OUTPUT_TOO_SHORT = -2, + ARGON2_OUTPUT_TOO_LONG = -3, + + ARGON2_PWD_TOO_SHORT = -4, + ARGON2_PWD_TOO_LONG = -5, + + ARGON2_SALT_TOO_SHORT = -6, + ARGON2_SALT_TOO_LONG = -7, + + ARGON2_AD_TOO_SHORT = -8, + ARGON2_AD_TOO_LONG = -9, + + ARGON2_SECRET_TOO_SHORT = -10, + ARGON2_SECRET_TOO_LONG = -11, + + ARGON2_TIME_TOO_SMALL = -12, + ARGON2_TIME_TOO_LARGE = -13, + + ARGON2_MEMORY_TOO_LITTLE = -14, + ARGON2_MEMORY_TOO_MUCH = -15, + + ARGON2_LANES_TOO_FEW = -16, + ARGON2_LANES_TOO_MANY = -17, + + ARGON2_PWD_PTR_MISMATCH = -18, /* NULL ptr with non-zero length */ + ARGON2_SALT_PTR_MISMATCH = -19, /* NULL ptr with non-zero length */ + ARGON2_SECRET_PTR_MISMATCH = -20, /* NULL ptr with non-zero length */ + ARGON2_AD_PTR_MISMATCH = -21, /* NULL ptr with non-zero length */ + + ARGON2_MEMORY_ALLOCATION_ERROR = -22, + + ARGON2_FREE_MEMORY_CBK_NULL = -23, + ARGON2_ALLOCATE_MEMORY_CBK_NULL = -24, + + ARGON2_INCORRECT_PARAMETER = -25, + ARGON2_INCORRECT_TYPE = -26, + + ARGON2_OUT_PTR_MISMATCH = -27, + + ARGON2_THREADS_TOO_FEW = -28, + ARGON2_THREADS_TOO_MANY = -29, + + ARGON2_MISSING_ARGS = -30, + + ARGON2_ENCODING_FAIL = -31, + + ARGON2_DECODING_FAIL = -32, + + ARGON2_THREAD_FAIL = -33, + + ARGON2_DECODING_LENGTH_FAIL = -34, + + ARGON2_VERIFY_MISMATCH = -35 +} argon2_error_codes; + +/* Memory allocator types --- for external allocation */ +typedef int (*allocate_fptr)(uint8_t **memory, size_t bytes_to_allocate); +typedef void (*deallocate_fptr)(uint8_t *memory, size_t bytes_to_allocate); + +/* Argon2 external data structures */ + +/* + ***** + * Context: structure to hold Argon2 inputs: + * output array and its length, + * password and its length, + * salt and its length, + * secret and its length, + * associated data and its length, + * number of passes, amount of used memory (in KBytes, can be rounded up a bit) + * number of parallel threads that will be run. + * All the parameters above affect the output hash value. + * Additionally, two function pointers can be provided to allocate and + * deallocate the memory (if NULL, memory will be allocated internally). + * Also, three flags indicate whether to erase password, secret as soon as they + * are pre-hashed (and thus not needed anymore), and the entire memory + ***** + * Simplest situation: you have output array out[8], password is stored in + * pwd[32], salt is stored in salt[16], you do not have keys nor associated + * data. You need to spend 1 GB of RAM and you run 5 passes of Argon2d with + * 4 parallel lanes. + * You want to erase the password, but you're OK with last pass not being + * erased. You want to use the default memory allocator. + * Then you initialize: + Argon2_Context(out,8,pwd,32,salt,16,NULL,0,NULL,0,5,1<<20,4,4,NULL,NULL,true,false,false,false) + */ +typedef struct Argon2_Context { + uint8_t *out; /* output array */ + uint32_t outlen; /* digest length */ + + uint8_t *pwd; /* password array */ + uint32_t pwdlen; /* password length */ + + uint8_t *salt; /* salt array */ + uint32_t saltlen; /* salt length */ + + uint8_t *secret; /* key array */ + uint32_t secretlen; /* key length */ + + uint8_t *ad; /* associated data array */ + uint32_t adlen; /* associated data length */ + + uint32_t t_cost; /* number of passes */ + uint32_t m_cost; /* amount of memory requested (KB) */ + uint32_t lanes; /* number of lanes */ + uint32_t threads; /* maximum number of threads */ + + uint32_t version; /* version number */ + + allocate_fptr allocate_cbk; /* pointer to memory allocator */ + deallocate_fptr free_cbk; /* pointer to memory deallocator */ + + uint32_t flags; /* array of bool options */ +} argon2_context; + +/* Argon2 primitive type */ +typedef enum Argon2_type { + Argon2_d = 0, + Argon2_i = 1, + Argon2_id = 2 +} argon2_type; + +/* Version of the algorithm */ +typedef enum Argon2_version { + ARGON2_VERSION_10 = 0x10, + ARGON2_VERSION_13 = 0x13, + ARGON2_VERSION_NUMBER = ARGON2_VERSION_13 +} argon2_version; + +/* + * Function that gives the string representation of an argon2_type. + * @param type The argon2_type that we want the string for + * @param uppercase Whether the string should have the first letter uppercase + * @return NULL if invalid type, otherwise the string representation. + */ +ARGON2_PUBLIC const char *argon2_type2string(argon2_type type, int uppercase); + +/* + * Function that performs memory-hard hashing with certain degree of parallelism + * @param context Pointer to the Argon2 internal structure + * @return Error code if smth is wrong, ARGON2_OK otherwise + */ +ARGON2_PUBLIC int argon2_ctx(argon2_context *context, argon2_type type); + +/** + * Hashes a password with Argon2i, producing an encoded hash + * @param t_cost Number of iterations + * @param m_cost Sets memory usage to m_cost kibibytes + * @param parallelism Number of threads and compute lanes + * @param pwd Pointer to password + * @param pwdlen Password size in bytes + * @param salt Pointer to salt + * @param saltlen Salt size in bytes + * @param hashlen Desired length of the hash in bytes + * @param encoded Buffer where to write the encoded hash + * @param encodedlen Size of the buffer (thus max size of the encoded hash) + * @pre Different parallelism levels will give different results + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +/** + * Hashes a password with Argon2i, producing a raw hash at @hash + * @param t_cost Number of iterations + * @param m_cost Sets memory usage to m_cost kibibytes + * @param parallelism Number of threads and compute lanes + * @param pwd Pointer to password + * @param pwdlen Password size in bytes + * @param salt Pointer to salt + * @param saltlen Salt size in bytes + * @param hash Buffer where to write the raw hash - updated by the function + * @param hashlen Desired length of the hash in bytes + * @pre Different parallelism levels will give different results + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +ARGON2_PUBLIC int argon2d_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +ARGON2_PUBLIC int argon2d_hash_raw(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +ARGON2_PUBLIC int argon2id_hash_encoded(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, + const void *pwd, const size_t pwdlen, + const void *salt, const size_t saltlen, + const size_t hashlen, char *encoded, + const size_t encodedlen); + +ARGON2_PUBLIC int argon2id_hash_raw(const uint32_t t_cost, + const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_hash(const uint32_t t_cost, const uint32_t m_cost, + const uint32_t parallelism, const void *pwd, + const size_t pwdlen, const void *salt, + const size_t saltlen, void *hash, + const size_t hashlen, char *encoded, + const size_t encodedlen, argon2_type type, + const uint32_t version); + +/** + * Verifies a password against an encoded string + * Encoded string is restricted as in validate_inputs() + * @param encoded String encoding parameters, salt, hash + * @param pwd Pointer to password + * @pre Returns ARGON2_OK if successful + */ +ARGON2_PUBLIC int argon2i_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +ARGON2_PUBLIC int argon2d_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +ARGON2_PUBLIC int argon2id_verify(const char *encoded, const void *pwd, + const size_t pwdlen); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_verify(const char *encoded, const void *pwd, + const size_t pwdlen, argon2_type type); + +/** + * Argon2d: Version of Argon2 that picks memory blocks depending + * on the password and salt. Only for side-channel-free + * environment!! + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2d_ctx(argon2_context *context); + +/** + * Argon2i: Version of Argon2 that picks memory blocks + * independent on the password and salt. Good for side-channels, + * but worse w.r.t. tradeoff attacks if only one pass is used. + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2i_ctx(argon2_context *context); + +/** + * Argon2id: Version of Argon2 where the first half-pass over memory is + * password-independent, the rest are password-dependent (on the password and + * salt). OK against side channels (they reduce to 1/2-pass Argon2i), and + * better with w.r.t. tradeoff attacks (similar to Argon2d). + ***** + * @param context Pointer to current Argon2 context + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2id_ctx(argon2_context *context); + +/** + * Verify if a given password is correct for Argon2d hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2d_verify_ctx(argon2_context *context, const char *hash); + +/** + * Verify if a given password is correct for Argon2i hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2i_verify_ctx(argon2_context *context, const char *hash); + +/** + * Verify if a given password is correct for Argon2id hashing + * @param context Pointer to current Argon2 context + * @param hash The password hash to verify. The length of the hash is + * specified by the context outlen member + * @return Zero if successful, a non zero error code otherwise + */ +ARGON2_PUBLIC int argon2id_verify_ctx(argon2_context *context, + const char *hash); + +/* generic function underlying the above ones */ +ARGON2_PUBLIC int argon2_verify_ctx(argon2_context *context, const char *hash, + argon2_type type); + +/** + * Get the associated error message for given error code + * @return The error message associated with the given error code + */ +ARGON2_PUBLIC const char *argon2_error_message(int error_code); + +/** + * Returns the encoded hash length for the given input parameters + * @param t_cost Number of iterations + * @param m_cost Memory usage in kibibytes + * @param parallelism Number of threads; used to compute lanes + * @param saltlen Salt size in bytes + * @param hashlen Hash size in bytes + * @param type The argon2_type that we want the encoded length for + * @return The encoded hash length in bytes + */ +ARGON2_PUBLIC size_t argon2_encodedlen(uint32_t t_cost, uint32_t m_cost, + uint32_t parallelism, uint32_t saltlen, + uint32_t hashlen, argon2_type type); + +#if defined(__cplusplus) +} +#endif + +#endif diff --git a/lib/argon2/blake2/blake2-impl.h b/lib/argon2/blake2/blake2-impl.h new file mode 100644 index 00000000000..86d0d5cfa9b --- /dev/null +++ b/lib/argon2/blake2/blake2-impl.h @@ -0,0 +1,156 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef PORTABLE_BLAKE2_IMPL_H +#define PORTABLE_BLAKE2_IMPL_H + +#include <stdint.h> +#include <string.h> + +#ifdef _WIN32 +#define BLAKE2_INLINE __inline +#elif defined(__GNUC__) || defined(__clang__) +#define BLAKE2_INLINE __inline__ +#else +#define BLAKE2_INLINE +#endif + +/* Argon2 Team - Begin Code */ +/* + Not an exhaustive list, but should cover the majority of modern platforms + Additionally, the code will always be correct---this is only a performance + tweak. +*/ +#if (defined(__BYTE_ORDER__) && \ + (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)) || \ + defined(__LITTLE_ENDIAN__) || defined(__ARMEL__) || defined(__MIPSEL__) || \ + defined(__AARCH64EL__) || defined(__amd64__) || defined(__i386__) || \ + defined(_M_IX86) || defined(_M_X64) || defined(_M_AMD64) || \ + defined(_M_ARM) +#define NATIVE_LITTLE_ENDIAN +#endif +/* Argon2 Team - End Code */ + +static BLAKE2_INLINE uint32_t load32(const void *src) { +#if defined(NATIVE_LITTLE_ENDIAN) + uint32_t w; + memcpy(&w, src, sizeof w); + return w; +#else + const uint8_t *p = (const uint8_t *)src; + uint32_t w = *p++; + w |= (uint32_t)(*p++) << 8; + w |= (uint32_t)(*p++) << 16; + w |= (uint32_t)(*p++) << 24; + return w; +#endif +} + +static BLAKE2_INLINE uint64_t load64(const void *src) { +#if defined(NATIVE_LITTLE_ENDIAN) + uint64_t w; + memcpy(&w, src, sizeof w); + return w; +#else + const uint8_t *p = (const uint8_t *)src; + uint64_t w = *p++; + w |= (uint64_t)(*p++) << 8; + w |= (uint64_t)(*p++) << 16; + w |= (uint64_t)(*p++) << 24; + w |= (uint64_t)(*p++) << 32; + w |= (uint64_t)(*p++) << 40; + w |= (uint64_t)(*p++) << 48; + w |= (uint64_t)(*p++) << 56; + return w; +#endif +} + +static BLAKE2_INLINE void store32(void *dst, uint32_t w) { +#if defined(NATIVE_LITTLE_ENDIAN) + memcpy(dst, &w, sizeof w); +#else + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +#endif +} + +static BLAKE2_INLINE void store64(void *dst, uint64_t w) { +#if defined(NATIVE_LITTLE_ENDIAN) + memcpy(dst, &w, sizeof w); +#else + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +#endif +} + +static BLAKE2_INLINE uint64_t load48(const void *src) { + const uint8_t *p = (const uint8_t *)src; + uint64_t w = *p++; + w |= (uint64_t)(*p++) << 8; + w |= (uint64_t)(*p++) << 16; + w |= (uint64_t)(*p++) << 24; + w |= (uint64_t)(*p++) << 32; + w |= (uint64_t)(*p++) << 40; + return w; +} + +static BLAKE2_INLINE void store48(void *dst, uint64_t w) { + uint8_t *p = (uint8_t *)dst; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; + w >>= 8; + *p++ = (uint8_t)w; +} + +static BLAKE2_INLINE uint32_t rotr32(const uint32_t w, const unsigned c) { + return (w >> c) | (w << (32 - c)); +} + +static BLAKE2_INLINE uint64_t rotr64(const uint64_t w, const unsigned c) { + return (w >> c) | (w << (64 - c)); +} + +void clear_internal_memory(void *v, size_t n); + +#endif diff --git a/lib/argon2/blake2/blake2.h b/lib/argon2/blake2/blake2.h new file mode 100644 index 00000000000..501c6a3186d --- /dev/null +++ b/lib/argon2/blake2/blake2.h @@ -0,0 +1,89 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef PORTABLE_BLAKE2_H +#define PORTABLE_BLAKE2_H + +#include <argon2.h> + +#if defined(__cplusplus) +extern "C" { +#endif + +enum blake2b_constant { + BLAKE2B_BLOCKBYTES = 128, + BLAKE2B_OUTBYTES = 64, + BLAKE2B_KEYBYTES = 64, + BLAKE2B_SALTBYTES = 16, + BLAKE2B_PERSONALBYTES = 16 +}; + +#pragma pack(push, 1) +typedef struct __blake2b_param { + uint8_t digest_length; /* 1 */ + uint8_t key_length; /* 2 */ + uint8_t fanout; /* 3 */ + uint8_t depth; /* 4 */ + uint32_t leaf_length; /* 8 */ + uint64_t node_offset; /* 16 */ + uint8_t node_depth; /* 17 */ + uint8_t inner_length; /* 18 */ + uint8_t reserved[14]; /* 32 */ + uint8_t salt[BLAKE2B_SALTBYTES]; /* 48 */ + uint8_t personal[BLAKE2B_PERSONALBYTES]; /* 64 */ +} blake2b_param; +#pragma pack(pop) + +typedef struct __blake2b_state { + uint64_t h[8]; + uint64_t t[2]; + uint64_t f[2]; + uint8_t buf[BLAKE2B_BLOCKBYTES]; + unsigned buflen; + unsigned outlen; + uint8_t last_node; +} blake2b_state; + +/* Ensure param structs have not been wrongly padded */ +/* Poor man's static_assert */ +enum { + blake2_size_check_0 = 1 / !!(CHAR_BIT == 8), + blake2_size_check_2 = + 1 / !!(sizeof(blake2b_param) == sizeof(uint64_t) * CHAR_BIT) +}; + +/* Streaming API */ +ARGON2_LOCAL int blake2b_init(blake2b_state *S, size_t outlen); +ARGON2_LOCAL int blake2b_init_key(blake2b_state *S, size_t outlen, const void *key, + size_t keylen); +ARGON2_LOCAL int blake2b_init_param(blake2b_state *S, const blake2b_param *P); +ARGON2_LOCAL int blake2b_update(blake2b_state *S, const void *in, size_t inlen); +ARGON2_LOCAL int blake2b_final(blake2b_state *S, void *out, size_t outlen); + +/* Simple API */ +ARGON2_LOCAL int blake2b(void *out, size_t outlen, const void *in, size_t inlen, + const void *key, size_t keylen); + +/* Argon2 Team - Begin Code */ +ARGON2_LOCAL int blake2b_long(void *out, size_t outlen, const void *in, size_t inlen); +/* Argon2 Team - End Code */ + +#if defined(__cplusplus) +} +#endif + +#endif diff --git a/lib/argon2/blake2/blake2b.c b/lib/argon2/blake2/blake2b.c new file mode 100644 index 00000000000..3b519ddb4d0 --- /dev/null +++ b/lib/argon2/blake2/blake2b.c @@ -0,0 +1,390 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include <stdint.h> +#include <string.h> +#include <stdio.h> + +#include "blake2.h" +#include "blake2-impl.h" + +static const uint64_t blake2b_IV[8] = { + UINT64_C(0x6a09e667f3bcc908), UINT64_C(0xbb67ae8584caa73b), + UINT64_C(0x3c6ef372fe94f82b), UINT64_C(0xa54ff53a5f1d36f1), + UINT64_C(0x510e527fade682d1), UINT64_C(0x9b05688c2b3e6c1f), + UINT64_C(0x1f83d9abfb41bd6b), UINT64_C(0x5be0cd19137e2179)}; + +static const unsigned int blake2b_sigma[12][16] = { + {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}, + {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3}, + {11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4}, + {7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8}, + {9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13}, + {2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9}, + {12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11}, + {13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10}, + {6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5}, + {10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0}, + {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15}, + {14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3}, +}; + +static BLAKE2_INLINE void blake2b_set_lastnode(blake2b_state *S) { + S->f[1] = (uint64_t)-1; +} + +static BLAKE2_INLINE void blake2b_set_lastblock(blake2b_state *S) { + if (S->last_node) { + blake2b_set_lastnode(S); + } + S->f[0] = (uint64_t)-1; +} + +static BLAKE2_INLINE void blake2b_increment_counter(blake2b_state *S, + uint64_t inc) { + S->t[0] += inc; + S->t[1] += (S->t[0] < inc); +} + +static BLAKE2_INLINE void blake2b_invalidate_state(blake2b_state *S) { + clear_internal_memory(S, sizeof(*S)); /* wipe */ + blake2b_set_lastblock(S); /* invalidate for further use */ +} + +static BLAKE2_INLINE void blake2b_init0(blake2b_state *S) { + memset(S, 0, sizeof(*S)); + memcpy(S->h, blake2b_IV, sizeof(S->h)); +} + +int blake2b_init_param(blake2b_state *S, const blake2b_param *P) { + const unsigned char *p = (const unsigned char *)P; + unsigned int i; + + if (NULL == P || NULL == S) { + return -1; + } + + blake2b_init0(S); + /* IV XOR Parameter Block */ + for (i = 0; i < 8; ++i) { + S->h[i] ^= load64(&p[i * sizeof(S->h[i])]); + } + S->outlen = P->digest_length; + return 0; +} + +/* Sequential blake2b initialization */ +int blake2b_init(blake2b_state *S, size_t outlen) { + blake2b_param P; + + if (S == NULL) { + return -1; + } + + if ((outlen == 0) || (outlen > BLAKE2B_OUTBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + /* Setup Parameter Block for unkeyed BLAKE2 */ + P.digest_length = (uint8_t)outlen; + P.key_length = 0; + P.fanout = 1; + P.depth = 1; + P.leaf_length = 0; + P.node_offset = 0; + P.node_depth = 0; + P.inner_length = 0; + memset(P.reserved, 0, sizeof(P.reserved)); + memset(P.salt, 0, sizeof(P.salt)); + memset(P.personal, 0, sizeof(P.personal)); + + return blake2b_init_param(S, &P); +} + +int blake2b_init_key(blake2b_state *S, size_t outlen, const void *key, + size_t keylen) { + blake2b_param P; + + if (S == NULL) { + return -1; + } + + if ((outlen == 0) || (outlen > BLAKE2B_OUTBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + if ((key == 0) || (keylen == 0) || (keylen > BLAKE2B_KEYBYTES)) { + blake2b_invalidate_state(S); + return -1; + } + + /* Setup Parameter Block for keyed BLAKE2 */ + P.digest_length = (uint8_t)outlen; + P.key_length = (uint8_t)keylen; + P.fanout = 1; + P.depth = 1; + P.leaf_length = 0; + P.node_offset = 0; + P.node_depth = 0; + P.inner_length = 0; + memset(P.reserved, 0, sizeof(P.reserved)); + memset(P.salt, 0, sizeof(P.salt)); + memset(P.personal, 0, sizeof(P.personal)); + + if (blake2b_init_param(S, &P) < 0) { + blake2b_invalidate_state(S); + return -1; + } + + { + uint8_t block[BLAKE2B_BLOCKBYTES]; + memset(block, 0, BLAKE2B_BLOCKBYTES); + memcpy(block, key, keylen); + blake2b_update(S, block, BLAKE2B_BLOCKBYTES); + /* Burn the key from stack */ + clear_internal_memory(block, BLAKE2B_BLOCKBYTES); + } + return 0; +} + +static void blake2b_compress(blake2b_state *S, const uint8_t *block) { + uint64_t m[16]; + uint64_t v[16]; + unsigned int i, r; + + for (i = 0; i < 16; ++i) { + m[i] = load64(block + i * sizeof(m[i])); + } + + for (i = 0; i < 8; ++i) { + v[i] = S->h[i]; + } + + v[8] = blake2b_IV[0]; + v[9] = blake2b_IV[1]; + v[10] = blake2b_IV[2]; + v[11] = blake2b_IV[3]; + v[12] = blake2b_IV[4] ^ S->t[0]; + v[13] = blake2b_IV[5] ^ S->t[1]; + v[14] = blake2b_IV[6] ^ S->f[0]; + v[15] = blake2b_IV[7] ^ S->f[1]; + +#define G(r, i, a, b, c, d) \ + do { \ + a = a + b + m[blake2b_sigma[r][2 * i + 0]]; \ + d = rotr64(d ^ a, 32); \ + c = c + d; \ + b = rotr64(b ^ c, 24); \ + a = a + b + m[blake2b_sigma[r][2 * i + 1]]; \ + d = rotr64(d ^ a, 16); \ + c = c + d; \ + b = rotr64(b ^ c, 63); \ + } while ((void)0, 0) + +#define ROUND(r) \ + do { \ + G(r, 0, v[0], v[4], v[8], v[12]); \ + G(r, 1, v[1], v[5], v[9], v[13]); \ + G(r, 2, v[2], v[6], v[10], v[14]); \ + G(r, 3, v[3], v[7], v[11], v[15]); \ + G(r, 4, v[0], v[5], v[10], v[15]); \ + G(r, 5, v[1], v[6], v[11], v[12]); \ + G(r, 6, v[2], v[7], v[8], v[13]); \ + G(r, 7, v[3], v[4], v[9], v[14]); \ + } while ((void)0, 0) + + for (r = 0; r < 12; ++r) { + ROUND(r); + } + + for (i = 0; i < 8; ++i) { + S->h[i] = S->h[i] ^ v[i] ^ v[i + 8]; + } + +#undef G +#undef ROUND +} + +int blake2b_update(blake2b_state *S, const void *in, size_t inlen) { + const uint8_t *pin = (const uint8_t *)in; + + if (inlen == 0) { + return 0; + } + + /* Sanity check */ + if (S == NULL || in == NULL) { + return -1; + } + + /* Is this a reused state? */ + if (S->f[0] != 0) { + return -1; + } + + if (S->buflen + inlen > BLAKE2B_BLOCKBYTES) { + /* Complete current block */ + size_t left = S->buflen; + size_t fill = BLAKE2B_BLOCKBYTES - left; + memcpy(&S->buf[left], pin, fill); + blake2b_increment_counter(S, BLAKE2B_BLOCKBYTES); + blake2b_compress(S, S->buf); + S->buflen = 0; + inlen -= fill; + pin += fill; + /* Avoid buffer copies when possible */ + while (inlen > BLAKE2B_BLOCKBYTES) { + blake2b_increment_counter(S, BLAKE2B_BLOCKBYTES); + blake2b_compress(S, pin); + inlen -= BLAKE2B_BLOCKBYTES; + pin += BLAKE2B_BLOCKBYTES; + } + } + memcpy(&S->buf[S->buflen], pin, inlen); + S->buflen += (unsigned int)inlen; + return 0; +} + +int blake2b_final(blake2b_state *S, void *out, size_t outlen) { + uint8_t buffer[BLAKE2B_OUTBYTES] = {0}; + unsigned int i; + + /* Sanity checks */ + if (S == NULL || out == NULL || outlen < S->outlen) { + return -1; + } + + /* Is this a reused state? */ + if (S->f[0] != 0) { + return -1; + } + + blake2b_increment_counter(S, S->buflen); + blake2b_set_lastblock(S); + memset(&S->buf[S->buflen], 0, BLAKE2B_BLOCKBYTES - S->buflen); /* Padding */ + blake2b_compress(S, S->buf); + + for (i = 0; i < 8; ++i) { /* Output full hash to temp buffer */ + store64(buffer + sizeof(S->h[i]) * i, S->h[i]); + } + + memcpy(out, buffer, S->outlen); + clear_internal_memory(buffer, sizeof(buffer)); + clear_internal_memory(S->buf, sizeof(S->buf)); + clear_internal_memory(S->h, sizeof(S->h)); + return 0; +} + +int blake2b(void *out, size_t outlen, const void *in, size_t inlen, + const void *key, size_t keylen) { + blake2b_state S; + int ret = -1; + + /* Verify parameters */ + if (NULL == in && inlen > 0) { + goto fail; + } + + if (NULL == out || outlen == 0 || outlen > BLAKE2B_OUTBYTES) { + goto fail; + } + + if ((NULL == key && keylen > 0) || keylen > BLAKE2B_KEYBYTES) { + goto fail; + } + + if (keylen > 0) { + if (blake2b_init_key(&S, outlen, key, keylen) < 0) { + goto fail; + } + } else { + if (blake2b_init(&S, outlen) < 0) { + goto fail; + } + } + + if (blake2b_update(&S, in, inlen) < 0) { + goto fail; + } + ret = blake2b_final(&S, out, outlen); + +fail: + clear_internal_memory(&S, sizeof(S)); + return ret; +} + +/* Argon2 Team - Begin Code */ +int blake2b_long(void *pout, size_t outlen, const void *in, size_t inlen) { + uint8_t *out = (uint8_t *)pout; + blake2b_state blake_state; + uint8_t outlen_bytes[sizeof(uint32_t)] = {0}; + int ret = -1; + + if (outlen > UINT32_MAX) { + goto fail; + } + + /* Ensure little-endian byte order! */ + store32(outlen_bytes, (uint32_t)outlen); + +#define TRY(statement) \ + do { \ + ret = statement; \ + if (ret < 0) { \ + goto fail; \ + } \ + } while ((void)0, 0) + + if (outlen <= BLAKE2B_OUTBYTES) { + TRY(blake2b_init(&blake_state, outlen)); + TRY(blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes))); + TRY(blake2b_update(&blake_state, in, inlen)); + TRY(blake2b_final(&blake_state, out, outlen)); + } else { + uint32_t toproduce; + uint8_t out_buffer[BLAKE2B_OUTBYTES]; + uint8_t in_buffer[BLAKE2B_OUTBYTES]; + TRY(blake2b_init(&blake_state, BLAKE2B_OUTBYTES)); + TRY(blake2b_update(&blake_state, outlen_bytes, sizeof(outlen_bytes))); + TRY(blake2b_update(&blake_state, in, inlen)); + TRY(blake2b_final(&blake_state, out_buffer, BLAKE2B_OUTBYTES)); + memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2); + out += BLAKE2B_OUTBYTES / 2; + toproduce = (uint32_t)outlen - BLAKE2B_OUTBYTES / 2; + + while (toproduce > BLAKE2B_OUTBYTES) { + memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES); + TRY(blake2b(out_buffer, BLAKE2B_OUTBYTES, in_buffer, + BLAKE2B_OUTBYTES, NULL, 0)); + memcpy(out, out_buffer, BLAKE2B_OUTBYTES / 2); + out += BLAKE2B_OUTBYTES / 2; + toproduce -= BLAKE2B_OUTBYTES / 2; + } + + memcpy(in_buffer, out_buffer, BLAKE2B_OUTBYTES); + TRY(blake2b(out_buffer, toproduce, in_buffer, BLAKE2B_OUTBYTES, NULL, + 0)); + memcpy(out, out_buffer, toproduce); + } +fail: + clear_internal_memory(&blake_state, sizeof(blake_state)); + return ret; +#undef TRY +} +/* Argon2 Team - End Code */ diff --git a/lib/argon2/blake2/blamka-round-ref.h b/lib/argon2/blake2/blamka-round-ref.h new file mode 100644 index 00000000000..16cfc1c74af --- /dev/null +++ b/lib/argon2/blake2/blamka-round-ref.h @@ -0,0 +1,56 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef BLAKE_ROUND_MKA_H +#define BLAKE_ROUND_MKA_H + +#include "blake2.h" +#include "blake2-impl.h" + +/* designed by the Lyra PHC team */ +static BLAKE2_INLINE uint64_t fBlaMka(uint64_t x, uint64_t y) { + const uint64_t m = UINT64_C(0xFFFFFFFF); + const uint64_t xy = (x & m) * (y & m); + return x + y + 2 * xy; +} + +#define G(a, b, c, d) \ + do { \ + a = fBlaMka(a, b); \ + d = rotr64(d ^ a, 32); \ + c = fBlaMka(c, d); \ + b = rotr64(b ^ c, 24); \ + a = fBlaMka(a, b); \ + d = rotr64(d ^ a, 16); \ + c = fBlaMka(c, d); \ + b = rotr64(b ^ c, 63); \ + } while ((void)0, 0) + +#define BLAKE2_ROUND_NOMSG(v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, \ + v12, v13, v14, v15) \ + do { \ + G(v0, v4, v8, v12); \ + G(v1, v5, v9, v13); \ + G(v2, v6, v10, v14); \ + G(v3, v7, v11, v15); \ + G(v0, v5, v10, v15); \ + G(v1, v6, v11, v12); \ + G(v2, v7, v8, v13); \ + G(v3, v4, v9, v14); \ + } while ((void)0, 0) + +#endif diff --git a/lib/argon2/core.c b/lib/argon2/core.c new file mode 100644 index 00000000000..e697882eb96 --- /dev/null +++ b/lib/argon2/core.c @@ -0,0 +1,648 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +/*For memory wiping*/ +#ifdef _WIN32 +#include <windows.h> +#include <winbase.h> /* For SecureZeroMemory */ +#endif +#if defined __STDC_LIB_EXT1__ +#define __STDC_WANT_LIB_EXT1__ 1 +#endif +#define VC_GE_2005(version) (version >= 1400) + +/* for explicit_bzero() on glibc */ +#define _DEFAULT_SOURCE + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include "core.h" +#include "thread.h" +#include "blake2/blake2.h" +#include "blake2/blake2-impl.h" + +#ifdef GENKAT +#include "genkat.h" +#endif + +#if defined(__clang__) +#if __has_attribute(optnone) +#define NOT_OPTIMIZED __attribute__((optnone)) +#endif +#elif defined(__GNUC__) +#define GCC_VERSION \ + (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) +#if GCC_VERSION >= 40400 +#define NOT_OPTIMIZED __attribute__((optimize("O0"))) +#endif +#endif +#ifndef NOT_OPTIMIZED +#define NOT_OPTIMIZED +#endif + +/***************Instance and Position constructors**********/ +void init_block_value(block *b, uint8_t in) { memset(b->v, in, sizeof(b->v)); } + +void copy_block(block *dst, const block *src) { + memcpy(dst->v, src->v, sizeof(uint64_t) * ARGON2_QWORDS_IN_BLOCK); +} + +void xor_block(block *dst, const block *src) { + int i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + dst->v[i] ^= src->v[i]; + } +} + +static void load_block(block *dst, const void *input) { + unsigned i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + dst->v[i] = load64((const uint8_t *)input + i * sizeof(dst->v[i])); + } +} + +static void store_block(void *output, const block *src) { + unsigned i; + for (i = 0; i < ARGON2_QWORDS_IN_BLOCK; ++i) { + store64((uint8_t *)output + i * sizeof(src->v[i]), src->v[i]); + } +} + +/***************Memory functions*****************/ + +int allocate_memory(const argon2_context *context, uint8_t **memory, + size_t num, size_t size) { + size_t memory_size = num*size; + if (memory == NULL) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + /* 1. Check for multiplication overflow */ + if (size != 0 && memory_size / size != num) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + /* 2. Try to allocate with appropriate allocator */ + if (context->allocate_cbk) { + (context->allocate_cbk)(memory, memory_size); + } else { + *memory = malloc(memory_size); + } + + if (*memory == NULL) { + return ARGON2_MEMORY_ALLOCATION_ERROR; + } + + return ARGON2_OK; +} + +void free_memory(const argon2_context *context, uint8_t *memory, + size_t num, size_t size) { + size_t memory_size = num*size; + clear_internal_memory(memory, memory_size); + if (context->free_cbk) { + (context->free_cbk)(memory, memory_size); + } else { + free(memory); + } +} + +#if defined(__OpenBSD__) +#define HAVE_EXPLICIT_BZERO 1 +#elif defined(__GLIBC__) && defined(__GLIBC_PREREQ) +#if __GLIBC_PREREQ(2,25) +#define HAVE_EXPLICIT_BZERO 1 +#endif +#endif + +void NOT_OPTIMIZED secure_wipe_memory(void *v, size_t n) { +#if defined(_MSC_VER) && VC_GE_2005(_MSC_VER) || defined(__MINGW32__) + SecureZeroMemory(v, n); +#elif defined memset_s + memset_s(v, n, 0, n); +#elif defined(HAVE_EXPLICIT_BZERO) + explicit_bzero(v, n); +#else + static void *(*const volatile memset_sec)(void *, int, size_t) = &memset; + memset_sec(v, 0, n); +#endif +} + +/* Memory clear flag defaults to true. */ +int FLAG_clear_internal_memory = 1; +void clear_internal_memory(void *v, size_t n) { + if (FLAG_clear_internal_memory && v) { + secure_wipe_memory(v, n); + } +} + +void finalize(const argon2_context *context, argon2_instance_t *instance) { + if (context != NULL && instance != NULL) { + block blockhash; + uint32_t l; + + copy_block(&blockhash, instance->memory + instance->lane_length - 1); + + /* XOR the last blocks */ + for (l = 1; l < instance->lanes; ++l) { + uint32_t last_block_in_lane = + l * instance->lane_length + (instance->lane_length - 1); + xor_block(&blockhash, instance->memory + last_block_in_lane); + } + + /* Hash the result */ + { + uint8_t blockhash_bytes[ARGON2_BLOCK_SIZE]; + store_block(blockhash_bytes, &blockhash); + blake2b_long(context->out, context->outlen, blockhash_bytes, + ARGON2_BLOCK_SIZE); + /* clear blockhash and blockhash_bytes */ + clear_internal_memory(blockhash.v, ARGON2_BLOCK_SIZE); + clear_internal_memory(blockhash_bytes, ARGON2_BLOCK_SIZE); + } + +#ifdef GENKAT + print_tag(context->out, context->outlen); +#endif + + free_memory(context, (uint8_t *)instance->memory, + instance->memory_blocks, sizeof(block)); + } +} + +uint32_t index_alpha(const argon2_instance_t *instance, + const argon2_position_t *position, uint32_t pseudo_rand, + int same_lane) { + /* + * Pass 0: + * This lane : all already finished segments plus already constructed + * blocks in this segment + * Other lanes : all already finished segments + * Pass 1+: + * This lane : (SYNC_POINTS - 1) last segments plus already constructed + * blocks in this segment + * Other lanes : (SYNC_POINTS - 1) last segments + */ + uint32_t reference_area_size; + uint64_t relative_position; + uint32_t start_position, absolute_position; + + if (0 == position->pass) { + /* First pass */ + if (0 == position->slice) { + /* First slice */ + reference_area_size = + position->index - 1; /* all but the previous */ + } else { + if (same_lane) { + /* The same lane => add current segment */ + reference_area_size = + position->slice * instance->segment_length + + position->index - 1; + } else { + reference_area_size = + position->slice * instance->segment_length + + ((position->index == 0) ? (-1) : 0); + } + } + } else { + /* Second pass */ + if (same_lane) { + reference_area_size = instance->lane_length - + instance->segment_length + position->index - + 1; + } else { + reference_area_size = instance->lane_length - + instance->segment_length + + ((position->index == 0) ? (-1) : 0); + } + } + + /* 1.2.4. Mapping pseudo_rand to 0..<reference_area_size-1> and produce + * relative position */ + relative_position = pseudo_rand; + relative_position = relative_position * relative_position >> 32; + relative_position = reference_area_size - 1 - + (reference_area_size * relative_position >> 32); + + /* 1.2.5 Computing starting position */ + start_position = 0; + + if (0 != position->pass) { + start_position = (position->slice == ARGON2_SYNC_POINTS - 1) + ? 0 + : (position->slice + 1) * instance->segment_length; + } + + /* 1.2.6. Computing absolute position */ + absolute_position = (start_position + relative_position) % + instance->lane_length; /* absolute position */ + return absolute_position; +} + +/* Single-threaded version for p=1 case */ +static int fill_memory_blocks_st(argon2_instance_t *instance) { + uint32_t r, s, l; + + for (r = 0; r < instance->passes; ++r) { + for (s = 0; s < ARGON2_SYNC_POINTS; ++s) { + for (l = 0; l < instance->lanes; ++l) { + argon2_position_t position = {r, l, (uint8_t)s, 0}; + fill_segment(instance, position); + } + } +#ifdef GENKAT + internal_kat(instance, r); /* Print all memory blocks */ +#endif + } + return ARGON2_OK; +} + +#if !defined(ARGON2_NO_THREADS) + +#ifdef _WIN32 +static unsigned __stdcall fill_segment_thr(void *thread_data) +#else +static void *fill_segment_thr(void *thread_data) +#endif +{ + argon2_thread_data *my_data = thread_data; + fill_segment(my_data->instance_ptr, my_data->pos); + argon2_thread_exit(); + return 0; +} + +/* Multi-threaded version for p > 1 case */ +static int fill_memory_blocks_mt(argon2_instance_t *instance) { + uint32_t r, s; + argon2_thread_handle_t *thread = NULL; + argon2_thread_data *thr_data = NULL; + int rc = ARGON2_OK; + + /* 1. Allocating space for threads */ + thread = calloc(instance->lanes, sizeof(argon2_thread_handle_t)); + if (thread == NULL) { + rc = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + thr_data = calloc(instance->lanes, sizeof(argon2_thread_data)); + if (thr_data == NULL) { + rc = ARGON2_MEMORY_ALLOCATION_ERROR; + goto fail; + } + + for (r = 0; r < instance->passes; ++r) { + for (s = 0; s < ARGON2_SYNC_POINTS; ++s) { + uint32_t l, ll; + + /* 2. Calling threads */ + for (l = 0; l < instance->lanes; ++l) { + argon2_position_t position; + + /* 2.1 Join a thread if limit is exceeded */ + if (l >= instance->threads) { + if (argon2_thread_join(thread[l - instance->threads])) { + rc = ARGON2_THREAD_FAIL; + goto fail; + } + } + + /* 2.2 Create thread */ + position.pass = r; + position.lane = l; + position.slice = (uint8_t)s; + position.index = 0; + thr_data[l].instance_ptr = + instance; /* preparing the thread input */ + memcpy(&(thr_data[l].pos), &position, + sizeof(argon2_position_t)); + if (argon2_thread_create(&thread[l], &fill_segment_thr, + (void *)&thr_data[l])) { + /* Wait for already running threads */ + for (ll = 0; ll < l; ++ll) + argon2_thread_join(thread[ll]); + rc = ARGON2_THREAD_FAIL; + goto fail; + } + + /* fill_segment(instance, position); */ + /*Non-thread equivalent of the lines above */ + } + + /* 3. Joining remaining threads */ + for (l = instance->lanes - instance->threads; l < instance->lanes; + ++l) { + if (argon2_thread_join(thread[l])) { + rc = ARGON2_THREAD_FAIL; + goto fail; + } + } + } + +#ifdef GENKAT + internal_kat(instance, r); /* Print all memory blocks */ +#endif + } + +fail: + if (thread != NULL) { + free(thread); + } + if (thr_data != NULL) { + free(thr_data); + } + return rc; +} + +#endif /* ARGON2_NO_THREADS */ + +int fill_memory_blocks(argon2_instance_t *instance) { + if (instance == NULL || instance->lanes == 0) { + return ARGON2_INCORRECT_PARAMETER; + } +#if defined(ARGON2_NO_THREADS) + return fill_memory_blocks_st(instance); +#else + return instance->threads == 1 ? + fill_memory_blocks_st(instance) : fill_memory_blocks_mt(instance); +#endif +} + +int validate_inputs(const argon2_context *context) { + if (NULL == context) { + return ARGON2_INCORRECT_PARAMETER; + } + + if (NULL == context->out) { + return ARGON2_OUTPUT_PTR_NULL; + } + + /* Validate output length */ + if (ARGON2_MIN_OUTLEN > context->outlen) { + return ARGON2_OUTPUT_TOO_SHORT; + } + + if (ARGON2_MAX_OUTLEN < context->outlen) { + return ARGON2_OUTPUT_TOO_LONG; + } + + /* Validate password (required param) */ + if (NULL == context->pwd) { + if (0 != context->pwdlen) { + return ARGON2_PWD_PTR_MISMATCH; + } + } + + if (ARGON2_MIN_PWD_LENGTH > context->pwdlen) { + return ARGON2_PWD_TOO_SHORT; + } + + if (ARGON2_MAX_PWD_LENGTH < context->pwdlen) { + return ARGON2_PWD_TOO_LONG; + } + + /* Validate salt (required param) */ + if (NULL == context->salt) { + if (0 != context->saltlen) { + return ARGON2_SALT_PTR_MISMATCH; + } + } + + if (ARGON2_MIN_SALT_LENGTH > context->saltlen) { + return ARGON2_SALT_TOO_SHORT; + } + + if (ARGON2_MAX_SALT_LENGTH < context->saltlen) { + return ARGON2_SALT_TOO_LONG; + } + + /* Validate secret (optional param) */ + if (NULL == context->secret) { + if (0 != context->secretlen) { + return ARGON2_SECRET_PTR_MISMATCH; + } + } else { + if (ARGON2_MIN_SECRET > context->secretlen) { + return ARGON2_SECRET_TOO_SHORT; + } + if (ARGON2_MAX_SECRET < context->secretlen) { + return ARGON2_SECRET_TOO_LONG; + } + } + + /* Validate associated data (optional param) */ + if (NULL == context->ad) { + if (0 != context->adlen) { + return ARGON2_AD_PTR_MISMATCH; + } + } else { + if (ARGON2_MIN_AD_LENGTH > context->adlen) { + return ARGON2_AD_TOO_SHORT; + } + if (ARGON2_MAX_AD_LENGTH < context->adlen) { + return ARGON2_AD_TOO_LONG; + } + } + + /* Validate memory cost */ + if (ARGON2_MIN_MEMORY > context->m_cost) { + return ARGON2_MEMORY_TOO_LITTLE; + } + + if (ARGON2_MAX_MEMORY < context->m_cost) { + return ARGON2_MEMORY_TOO_MUCH; + } + + if (context->m_cost < 8 * context->lanes) { + return ARGON2_MEMORY_TOO_LITTLE; + } + + /* Validate time cost */ + if (ARGON2_MIN_TIME > context->t_cost) { + return ARGON2_TIME_TOO_SMALL; + } + + if (ARGON2_MAX_TIME < context->t_cost) { + return ARGON2_TIME_TOO_LARGE; + } + + /* Validate lanes */ + if (ARGON2_MIN_LANES > context->lanes) { + return ARGON2_LANES_TOO_FEW; + } + + if (ARGON2_MAX_LANES < context->lanes) { + return ARGON2_LANES_TOO_MANY; + } + + /* Validate threads */ + if (ARGON2_MIN_THREADS > context->threads) { + return ARGON2_THREADS_TOO_FEW; + } + + if (ARGON2_MAX_THREADS < context->threads) { + return ARGON2_THREADS_TOO_MANY; + } + + if (NULL != context->allocate_cbk && NULL == context->free_cbk) { + return ARGON2_FREE_MEMORY_CBK_NULL; + } + + if (NULL == context->allocate_cbk && NULL != context->free_cbk) { + return ARGON2_ALLOCATE_MEMORY_CBK_NULL; + } + + return ARGON2_OK; +} + +void fill_first_blocks(uint8_t *blockhash, const argon2_instance_t *instance) { + uint32_t l; + /* Make the first and second block in each lane as G(H0||0||i) or + G(H0||1||i) */ + uint8_t blockhash_bytes[ARGON2_BLOCK_SIZE]; + for (l = 0; l < instance->lanes; ++l) { + + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, 0); + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH + 4, l); + blake2b_long(blockhash_bytes, ARGON2_BLOCK_SIZE, blockhash, + ARGON2_PREHASH_SEED_LENGTH); + load_block(&instance->memory[l * instance->lane_length + 0], + blockhash_bytes); + + store32(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, 1); + blake2b_long(blockhash_bytes, ARGON2_BLOCK_SIZE, blockhash, + ARGON2_PREHASH_SEED_LENGTH); + load_block(&instance->memory[l * instance->lane_length + 1], + blockhash_bytes); + } + clear_internal_memory(blockhash_bytes, ARGON2_BLOCK_SIZE); +} + +void initial_hash(uint8_t *blockhash, argon2_context *context, + argon2_type type) { + blake2b_state BlakeHash; + uint8_t value[sizeof(uint32_t)]; + + if (NULL == context || NULL == blockhash) { + return; + } + + blake2b_init(&BlakeHash, ARGON2_PREHASH_DIGEST_LENGTH); + + store32(&value, context->lanes); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->outlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->m_cost); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->t_cost); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->version); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, (uint32_t)type); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + store32(&value, context->pwdlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->pwd != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->pwd, + context->pwdlen); + + if (context->flags & ARGON2_FLAG_CLEAR_PASSWORD) { + secure_wipe_memory(context->pwd, context->pwdlen); + context->pwdlen = 0; + } + } + + store32(&value, context->saltlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->salt != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->salt, + context->saltlen); + } + + store32(&value, context->secretlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->secret != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->secret, + context->secretlen); + + if (context->flags & ARGON2_FLAG_CLEAR_SECRET) { + secure_wipe_memory(context->secret, context->secretlen); + context->secretlen = 0; + } + } + + store32(&value, context->adlen); + blake2b_update(&BlakeHash, (const uint8_t *)&value, sizeof(value)); + + if (context->ad != NULL) { + blake2b_update(&BlakeHash, (const uint8_t *)context->ad, + context->adlen); + } + + blake2b_final(&BlakeHash, blockhash, ARGON2_PREHASH_DIGEST_LENGTH); +} + +int initialize(argon2_instance_t *instance, argon2_context *context) { + uint8_t blockhash[ARGON2_PREHASH_SEED_LENGTH]; + int result = ARGON2_OK; + + if (instance == NULL || context == NULL) + return ARGON2_INCORRECT_PARAMETER; + instance->context_ptr = context; + + /* 1. Memory allocation */ + result = allocate_memory(context, (uint8_t **)&(instance->memory), + instance->memory_blocks, sizeof(block)); + if (result != ARGON2_OK) { + return result; + } + + /* 2. Initial hashing */ + /* H_0 + 8 extra bytes to produce the first blocks */ + /* uint8_t blockhash[ARGON2_PREHASH_SEED_LENGTH]; */ + /* Hashing all inputs */ + initial_hash(blockhash, context, instance->type); + /* Zeroing 8 extra bytes */ + clear_internal_memory(blockhash + ARGON2_PREHASH_DIGEST_LENGTH, + ARGON2_PREHASH_SEED_LENGTH - + ARGON2_PREHASH_DIGEST_LENGTH); + +#ifdef GENKAT + initial_kat(blockhash, context, instance->type); +#endif + + /* 3. Creating first blocks, we always have at least two blocks in a slice + */ + fill_first_blocks(blockhash, instance); + /* Clearing the hash */ + clear_internal_memory(blockhash, ARGON2_PREHASH_SEED_LENGTH); + + return ARGON2_OK; +} diff --git a/lib/argon2/core.h b/lib/argon2/core.h new file mode 100644 index 00000000000..59e25646cbc --- /dev/null +++ b/lib/argon2/core.h @@ -0,0 +1,228 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#ifndef ARGON2_CORE_H +#define ARGON2_CORE_H + +#include "argon2.h" + +#define CONST_CAST(x) (x)(uintptr_t) + +/**********************Argon2 internal constants*******************************/ + +enum argon2_core_constants { + /* Memory block size in bytes */ + ARGON2_BLOCK_SIZE = 1024, + ARGON2_QWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 8, + ARGON2_OWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 16, + ARGON2_HWORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 32, + ARGON2_512BIT_WORDS_IN_BLOCK = ARGON2_BLOCK_SIZE / 64, + + /* Number of pseudo-random values generated by one call to Blake in Argon2i + to + generate reference block positions */ + ARGON2_ADDRESSES_IN_BLOCK = 128, + + /* Pre-hashing digest length and its extension*/ + ARGON2_PREHASH_DIGEST_LENGTH = 64, + ARGON2_PREHASH_SEED_LENGTH = 72 +}; + +/*************************Argon2 internal data types***********************/ + +/* + * Structure for the (1KB) memory block implemented as 128 64-bit words. + * Memory blocks can be copied, XORed. Internal words can be accessed by [] (no + * bounds checking). + */ +typedef struct block_ { uint64_t v[ARGON2_QWORDS_IN_BLOCK]; } block; + +/*****************Functions that work with the block******************/ + +/* Initialize each byte of the block with @in */ +void init_block_value(block *b, uint8_t in); + +/* Copy block @src to block @dst */ +void copy_block(block *dst, const block *src); + +/* XOR @src onto @dst bytewise */ +void xor_block(block *dst, const block *src); + +/* + * Argon2 instance: memory pointer, number of passes, amount of memory, type, + * and derived values. + * Used to evaluate the number and location of blocks to construct in each + * thread + */ +typedef struct Argon2_instance_t { + block *memory; /* Memory pointer */ + uint32_t version; + uint32_t passes; /* Number of passes */ + uint32_t memory_blocks; /* Number of blocks in memory */ + uint32_t segment_length; + uint32_t lane_length; + uint32_t lanes; + uint32_t threads; + argon2_type type; + int print_internals; /* whether to print the memory blocks */ + argon2_context *context_ptr; /* points back to original context */ +} argon2_instance_t; + +/* + * Argon2 position: where we construct the block right now. Used to distribute + * work between threads. + */ +typedef struct Argon2_position_t { + uint32_t pass; + uint32_t lane; + uint8_t slice; + uint32_t index; +} argon2_position_t; + +/*Struct that holds the inputs for thread handling FillSegment*/ +typedef struct Argon2_thread_data { + argon2_instance_t *instance_ptr; + argon2_position_t pos; +} argon2_thread_data; + +/*************************Argon2 core functions********************************/ + +/* Allocates memory to the given pointer, uses the appropriate allocator as + * specified in the context. Total allocated memory is num*size. + * @param context argon2_context which specifies the allocator + * @param memory pointer to the pointer to the memory + * @param size the size in bytes for each element to be allocated + * @param num the number of elements to be allocated + * @return ARGON2_OK if @memory is a valid pointer and memory is allocated + */ +int allocate_memory(const argon2_context *context, uint8_t **memory, + size_t num, size_t size); + +/* + * Frees memory at the given pointer, uses the appropriate deallocator as + * specified in the context. Also cleans the memory using clear_internal_memory. + * @param context argon2_context which specifies the deallocator + * @param memory pointer to buffer to be freed + * @param size the size in bytes for each element to be deallocated + * @param num the number of elements to be deallocated + */ +void free_memory(const argon2_context *context, uint8_t *memory, + size_t num, size_t size); + +/* Function that securely cleans the memory. This ignores any flags set + * regarding clearing memory. Usually one just calls clear_internal_memory. + * @param mem Pointer to the memory + * @param s Memory size in bytes + */ +void secure_wipe_memory(void *v, size_t n); + +/* Function that securely clears the memory if FLAG_clear_internal_memory is + * set. If the flag isn't set, this function does nothing. + * @param mem Pointer to the memory + * @param s Memory size in bytes + */ +void clear_internal_memory(void *v, size_t n); + +/* + * Computes absolute position of reference block in the lane following a skewed + * distribution and using a pseudo-random value as input + * @param instance Pointer to the current instance + * @param position Pointer to the current position + * @param pseudo_rand 32-bit pseudo-random value used to determine the position + * @param same_lane Indicates if the block will be taken from the current lane. + * If so we can reference the current segment + * @pre All pointers must be valid + */ +uint32_t index_alpha(const argon2_instance_t *instance, + const argon2_position_t *position, uint32_t pseudo_rand, + int same_lane); + +/* + * Function that validates all inputs against predefined restrictions and return + * an error code + * @param context Pointer to current Argon2 context + * @return ARGON2_OK if everything is all right, otherwise one of error codes + * (all defined in <argon2.h> + */ +int validate_inputs(const argon2_context *context); + +/* + * Hashes all the inputs into @a blockhash[PREHASH_DIGEST_LENGTH], clears + * password and secret if needed + * @param context Pointer to the Argon2 internal structure containing memory + * pointer, and parameters for time and space requirements. + * @param blockhash Buffer for pre-hashing digest + * @param type Argon2 type + * @pre @a blockhash must have at least @a PREHASH_DIGEST_LENGTH bytes + * allocated + */ +void initial_hash(uint8_t *blockhash, argon2_context *context, + argon2_type type); + +/* + * Function creates first 2 blocks per lane + * @param instance Pointer to the current instance + * @param blockhash Pointer to the pre-hashing digest + * @pre blockhash must point to @a PREHASH_SEED_LENGTH allocated values + */ +void fill_first_blocks(uint8_t *blockhash, const argon2_instance_t *instance); + +/* + * Function allocates memory, hashes the inputs with Blake, and creates first + * two blocks. Returns the pointer to the main memory with 2 blocks per lane + * initialized + * @param context Pointer to the Argon2 internal structure containing memory + * pointer, and parameters for time and space requirements. + * @param instance Current Argon2 instance + * @return Zero if successful, -1 if memory failed to allocate. @context->state + * will be modified if successful. + */ +int initialize(argon2_instance_t *instance, argon2_context *context); + +/* + * XORing the last block of each lane, hashing it, making the tag. Deallocates + * the memory. + * @param context Pointer to current Argon2 context (use only the out parameters + * from it) + * @param instance Pointer to current instance of Argon2 + * @pre instance->state must point to necessary amount of memory + * @pre context->out must point to outlen bytes of memory + * @pre if context->free_cbk is not NULL, it should point to a function that + * deallocates memory + */ +void finalize(const argon2_context *context, argon2_instance_t *instance); + +/* + * Function that fills the segment using previous segments also from other + * threads + * @param context current context + * @param instance Pointer to the current instance + * @param position Current position + * @pre all block pointers must be valid + */ +void fill_segment(const argon2_instance_t *instance, + argon2_position_t position); + +/* + * Function that fills the entire memory t_cost times based on the first two + * blocks in each lane + * @param instance Pointer to the current instance + * @return ARGON2_OK if successful, @context->state + */ +int fill_memory_blocks(argon2_instance_t *instance); + +#endif diff --git a/lib/argon2/ref.c b/lib/argon2/ref.c new file mode 100644 index 00000000000..10e45eba64e --- /dev/null +++ b/lib/argon2/ref.c @@ -0,0 +1,194 @@ +/* + * Argon2 reference source code package - reference C implementations + * + * Copyright 2015 + * Daniel Dinu, Dmitry Khovratovich, Jean-Philippe Aumasson, and Samuel Neves + * + * You may use this work under the terms of a Creative Commons CC0 1.0 + * License/Waiver or the Apache Public License 2.0, at your option. The terms of + * these licenses can be found at: + * + * - CC0 1.0 Universal : https://creativecommons.org/publicdomain/zero/1.0 + * - Apache 2.0 : https://www.apache.org/licenses/LICENSE-2.0 + * + * You should have received a copy of both of these licenses along with this + * software. If not, they may be obtained at the above URLs. + */ + +#include <stdint.h> +#include <string.h> +#include <stdlib.h> + +#include "argon2.h" +#include "core.h" + +#include "blake2/blamka-round-ref.h" +#include "blake2/blake2-impl.h" +#include "blake2/blake2.h" + + +/* + * Function fills a new memory block and optionally XORs the old block over the new one. + * @next_block must be initialized. + * @param prev_block Pointer to the previous block + * @param ref_block Pointer to the reference block + * @param next_block Pointer to the block to be constructed + * @param with_xor Whether to XOR into the new block (1) or just overwrite (0) + * @pre all block pointers must be valid + */ +static void fill_block(const block *prev_block, const block *ref_block, + block *next_block, int with_xor) { + block blockR, block_tmp; + unsigned i; + + copy_block(&blockR, ref_block); + xor_block(&blockR, prev_block); + copy_block(&block_tmp, &blockR); + /* Now blockR = ref_block + prev_block and block_tmp = ref_block + prev_block */ + if (with_xor) { + /* Saving the next block contents for XOR over: */ + xor_block(&block_tmp, next_block); + /* Now blockR = ref_block + prev_block and + block_tmp = ref_block + prev_block + next_block */ + } + + /* Apply Blake2 on columns of 64-bit words: (0,1,...,15) , then + (16,17,..31)... finally (112,113,...127) */ + for (i = 0; i < 8; ++i) { + BLAKE2_ROUND_NOMSG( + blockR.v[16 * i], blockR.v[16 * i + 1], blockR.v[16 * i + 2], + blockR.v[16 * i + 3], blockR.v[16 * i + 4], blockR.v[16 * i + 5], + blockR.v[16 * i + 6], blockR.v[16 * i + 7], blockR.v[16 * i + 8], + blockR.v[16 * i + 9], blockR.v[16 * i + 10], blockR.v[16 * i + 11], + blockR.v[16 * i + 12], blockR.v[16 * i + 13], blockR.v[16 * i + 14], + blockR.v[16 * i + 15]); + } + + /* Apply Blake2 on rows of 64-bit words: (0,1,16,17,...112,113), then + (2,3,18,19,...,114,115).. finally (14,15,30,31,...,126,127) */ + for (i = 0; i < 8; i++) { + BLAKE2_ROUND_NOMSG( + blockR.v[2 * i], blockR.v[2 * i + 1], blockR.v[2 * i + 16], + blockR.v[2 * i + 17], blockR.v[2 * i + 32], blockR.v[2 * i + 33], + blockR.v[2 * i + 48], blockR.v[2 * i + 49], blockR.v[2 * i + 64], + blockR.v[2 * i + 65], blockR.v[2 * i + 80], blockR.v[2 * i + 81], + blockR.v[2 * i + 96], blockR.v[2 * i + 97], blockR.v[2 * i + 112], + blockR.v[2 * i + 113]); + } + + copy_block(next_block, &block_tmp); + xor_block(next_block, &blockR); +} + +static void next_addresses(block *address_block, block *input_block, + const block *zero_block) { + input_block->v[6]++; + fill_block(zero_block, input_block, address_block, 0); + fill_block(zero_block, address_block, address_block, 0); +} + +void fill_segment(const argon2_instance_t *instance, + argon2_position_t position) { + block *ref_block = NULL, *curr_block = NULL; + block address_block, input_block, zero_block; + uint64_t pseudo_rand, ref_index, ref_lane; + uint32_t prev_offset, curr_offset; + uint32_t starting_index; + uint32_t i; + int data_independent_addressing; + + if (instance == NULL) { + return; + } + + data_independent_addressing = + (instance->type == Argon2_i) || + (instance->type == Argon2_id && (position.pass == 0) && + (position.slice < ARGON2_SYNC_POINTS / 2)); + + if (data_independent_addressing) { + init_block_value(&zero_block, 0); + init_block_value(&input_block, 0); + + input_block.v[0] = position.pass; + input_block.v[1] = position.lane; + input_block.v[2] = position.slice; + input_block.v[3] = instance->memory_blocks; + input_block.v[4] = instance->passes; + input_block.v[5] = instance->type; + } + + starting_index = 0; + + if ((0 == position.pass) && (0 == position.slice)) { + starting_index = 2; /* we have already generated the first two blocks */ + + /* Don't forget to generate the first block of addresses: */ + if (data_independent_addressing) { + next_addresses(&address_block, &input_block, &zero_block); + } + } + + /* Offset of the current block */ + curr_offset = position.lane * instance->lane_length + + position.slice * instance->segment_length + starting_index; + + if (0 == curr_offset % instance->lane_length) { + /* Last block in this lane */ + prev_offset = curr_offset + instance->lane_length - 1; + } else { + /* Previous block */ + prev_offset = curr_offset - 1; + } + + for (i = starting_index; i < instance->segment_length; + ++i, ++curr_offset, ++prev_offset) { + /*1.1 Rotating prev_offset if needed */ + if (curr_offset % instance->lane_length == 1) { + prev_offset = curr_offset - 1; + } + + /* 1.2 Computing the index of the reference block */ + /* 1.2.1 Taking pseudo-random value from the previous block */ + if (data_independent_addressing) { + if (i % ARGON2_ADDRESSES_IN_BLOCK == 0) { + next_addresses(&address_block, &input_block, &zero_block); + } + pseudo_rand = address_block.v[i % ARGON2_ADDRESSES_IN_BLOCK]; + } else { + pseudo_rand = instance->memory[prev_offset].v[0]; + } + + /* 1.2.2 Computing the lane of the reference block */ + ref_lane = ((pseudo_rand >> 32)) % instance->lanes; + + if ((position.pass == 0) && (position.slice == 0)) { + /* Can not reference other lanes yet */ + ref_lane = position.lane; + } + + /* 1.2.3 Computing the number of possible reference block within the + * lane. + */ + position.index = i; + ref_index = index_alpha(instance, &position, pseudo_rand & 0xFFFFFFFF, + ref_lane == position.lane); + + /* 2 Creating a new block */ + ref_block = + instance->memory + instance->lane_length * ref_lane + ref_index; + curr_block = instance->memory + curr_offset; + if (ARGON2_VERSION_10 == instance->version) { + /* version 1.2.1 and earlier: overwrite, not XOR */ + fill_block(instance->memory + prev_offset, ref_block, curr_block, 0); + } else { + if(0 == position.pass) { + fill_block(instance->memory + prev_offset, ref_block, + curr_block, 0); + } else { + fill_block(instance->memory + prev_offset, ref_block, + curr_block, 1); + } + } + } +} -- 2.43.0

From: Simon Glass <simon.glass@canonical.com> Add a Kconfig optiion to enable this library and add it to the lib/ Makefile, being careful to avoid a conflict with the existing blake2b implementation. Co-developed-by: Claude <noreply@anthropic.com> Signed-off-by: Simon Glass <simon.glass@canonical.com> --- drivers/misc/Kconfig | 2 +- fs/btrfs/Kconfig | 2 +- lib/Kconfig | 14 +++++++++++++- lib/Makefile | 4 ++++ 4 files changed, 19 insertions(+), 3 deletions(-) diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig index a352fa5fee0..7a217ad055d 100644 --- a/drivers/misc/Kconfig +++ b/drivers/misc/Kconfig @@ -37,7 +37,7 @@ config TKEY bool "TKey security token support" depends on DM default y if SANDBOX - select BLAKE2 + select BLAKE2 if !ARGON2 help Enable driver model support for Tillitis TKey security tokens. This provides a common interface for TKey operations including diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig index e31afe595f3..c6430f83452 100644 --- a/fs/btrfs/Kconfig +++ b/fs/btrfs/Kconfig @@ -6,7 +6,7 @@ config FS_BTRFS select ZSTD select RBTREE select SHA256 - select BLAKE2 + select BLAKE2 if !ARGON2 help This provides a single-device read-only BTRFS support. BTRFS is a next-generation Linux file system based on the copy-on-write diff --git a/lib/Kconfig b/lib/Kconfig index c8bf4b4b049..662b1a44d45 100644 --- a/lib/Kconfig +++ b/lib/Kconfig @@ -542,11 +542,12 @@ menu "Hashing Support" config BLAKE2 bool "Enable BLAKE2 support" + depends on !ARGON2 help This option enables support of hashing using BLAKE2B algorithm. The hash is calculated in software. The BLAKE2 algorithm produces a hash value (digest) between 1 and - 64 bytes. + 64 bytes. Note: ARGON2 includes its own BLAKE2 implementation. config SHA1 bool "Enable SHA1 support" @@ -983,6 +984,17 @@ config JSON printing functions. JSON is used for structured data representation, such as LUKS2 metadata. +config ARGON2 + bool "Enable Argon2 password hashing" + help + This enables the Argon2 password hashing algorithm, winner of the + Password Hashing Competition (PHC). Argon2 is used for key derivation + in LUKS2 encrypted volumes. It provides better resistance to GPU + cracking attacks compared to PBKDF2. + + Note: This option includes its own BLAKE2 implementation and is + mutually exclusive with CONFIG_BLAKE2. + config OF_LIBFDT bool "Enable the FDT library" default y if OF_CONTROL diff --git a/lib/Makefile b/lib/Makefile index 71c9c0d1766..5cbf3071f96 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -80,7 +80,10 @@ obj-$(CONFIG_$(PHASE_)ACPI) += acpi/ obj-$(CONFIG_ECDSA) += ecdsa/ obj-$(CONFIG_$(PHASE_)RSA) += rsa/ obj-$(CONFIG_HASH) += hash-checksum.o + +# argon2 provides its own blake2b; just build blake2s when ARGON2 is enabled obj-$(CONFIG_BLAKE2) += blake2/blake2b.o blake2/blake2s.o +obj-$(CONFIG_ARGON2) += blake2/blake2s.o obj-$(CONFIG_$(PHASE_)MD5_LEGACY) += md5.o obj-$(CONFIG_$(PHASE_)SHA1_LEGACY) += sha1.o @@ -89,6 +92,7 @@ obj-$(CONFIG_$(PHASE_)SHA256_LEGACY) += sha256.o obj-$(CONFIG_$(PHASE_)SHA512_LEGACY) += sha512.o obj-$(CONFIG_CRYPT_PW) += crypt/ +obj-$(CONFIG_ARGON2) += argon2/ obj-$(CONFIG_$(PHASE_)ASN1_DECODER_LEGACY) += asn1_decoder.o obj-$(CONFIG_$(PHASE_)ZLIB) += zlib/ -- 2.43.0

From: Simon Glass <simon.glass@canonical.com> For LUKS version 2, argon is normally used in preference to pbkdf2. Add an argument to specify this when creating a filesystem. Co-developed-by: Claude <noreply@anthropic.com> Signed-off-by: Simon Glass <simon.glass@canonical.com> --- test/py/tests/fs_helper.py | 40 ++++++++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/test/py/tests/fs_helper.py b/test/py/tests/fs_helper.py index 4812d3f053b..d88cc270b95 100644 --- a/test/py/tests/fs_helper.py +++ b/test/py/tests/fs_helper.py @@ -54,12 +54,20 @@ class FsHelper: fsh.mk_fs() # Creates and encrypts the filesystem with LUKS1 ... + To create an encrypted LUKS2 partition with Argon2id: + + with FsHelper(ubman.config, 'ext4', 10, 'mmc1', + passphrase='test', luks_kdf='argon2id') as fsh: + # create files in the fsh.srcdir directory + fsh.mk_fs() # Creates and encrypts the FS with LUKS2+Argon2 + ... + Properties: fs_img (str): Filename for the filesystem image; this is set to a default value but can be overwritten """ def __init__(self, config, fs_type, size_mb, prefix, part_mb=None, - passphrase=None, luks_version=2): + passphrase=None, luks_version=2, luks_kdf='pbkdf2'): """Set up a new object Args: @@ -74,6 +82,8 @@ class FsHelper: passphrase (str, optional): If provided, encrypt the filesystem with LUKS using this passphrase luks_version (int): LUKS version to use (1 or 2). Defaults to 2. + luks_kdf (str): Key derivation function for LUKS2: 'pbkdf2' or + 'argon2id'. Defaults to 'pbkdf2'. Ignored for LUKS1. """ if ('fat' not in fs_type and 'ext' not in fs_type and fs_type not in ['exfat', 'fs_generic']): @@ -87,6 +97,7 @@ class FsHelper: self.quiet = True self.passphrase = passphrase self.luks_version = luks_version + self.luks_kdf = luks_kdf # Use a default filename; the caller can adjust it leaf = f'{prefix}.{fs_type}.img' @@ -238,13 +249,26 @@ class FsHelper: try: # Format as LUKS (version determined by luks_type) - run(['cryptsetup', 'luksFormat', - '--type', luks_type, - '--cipher', cipher, - '--key-size', key_size_str, - '--hash', hash_alg, - '--iter-time', '10', # Very fast for testing (low security) - luks_img], + cmd = ['cryptsetup', 'luksFormat', + '--type', luks_type, + '--cipher', cipher, + '--key-size', key_size_str, + '--hash', hash_alg, + '--iter-time', '10'] # Very fast for testing (low security) + + # For LUKS2, specify the KDF (pbkdf2 or argon2id) + if self.luks_version == 2: + cmd.extend(['--pbkdf', self.luks_kdf]) + # For Argon2, use low memory/time settings suitable for testing + if self.luks_kdf == 'argon2id': + cmd.extend([ + '--pbkdf-memory', '65536', # 64MB + '--pbkdf-parallel', '4', + ]) + + cmd.append(luks_img) + + run(cmd, input=f'{passphrase}\n'.encode(), stdout=DEVNULL if self.quiet else None, stderr=DEVNULL if self.quiet else None, -- 2.43.0

From: Simon Glass <simon.glass@canonical.com> Provide this function through an internal header, so that luks2 will be able to use it. Co-developed-by: Claude <noreply@anthropic.com> Signed-off-by: Simon Glass <simon.glass@canonical.com> --- drivers/block/luks.c | 5 +++-- drivers/block/luks_internal.h | 30 ++++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 drivers/block/luks_internal.h diff --git a/drivers/block/luks.c b/drivers/block/luks.c index 4400f1cfd84..826fe062757 100644 --- a/drivers/block/luks.c +++ b/drivers/block/luks.c @@ -25,6 +25,7 @@ #include <mbedtls/pkcs5.h> #include <u-boot/sha256.h> #include <u-boot/sha512.h> +#include "luks_internal.h" int luks_get_version(struct udevice *blk, struct disk_partition *pinfo) { @@ -206,8 +207,8 @@ static int af_hash(struct hash_algo *algo, size_t key_size, u8 *block_buf) * @hash_spec: Hash algorithm name (e.g., "sha256") * Return: 0 on success, -ve on error */ -static int af_merge(const u8 *src, u8 *dst, size_t key_size, uint stripes, - const char *hash_spec) +int af_merge(const u8 *src, u8 *dst, size_t key_size, uint stripes, + const char *hash_spec) { struct hash_algo *algo; u8 block_buf[128]; diff --git a/drivers/block/luks_internal.h b/drivers/block/luks_internal.h new file mode 100644 index 00000000000..32714787550 --- /dev/null +++ b/drivers/block/luks_internal.h @@ -0,0 +1,30 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * LUKS (Linux Unified Key Setup) internal interfaces + * + * Copyright (C) 2025 Canonical Ltd + */ + +#ifndef __LUKS_INTERNAL_H__ +#define __LUKS_INTERNAL_H__ + +#include <hash.h> + +/** + * af_merge() - Merge anti-forensic split key into original key + * + * This performs the LUKS AF-merge operation to recover the original key from + * its AF-split representation. The algorithm XORs all stripes together, + * applying diffusion between each stripe. Used by both LUKS1 and LUKS2. + * + * @src: AF-split key material (key_size * stripes bytes) + * @dst: Output buffer for merged key (key_size bytes) + * @key_size: Size of the original key + * @stripes: Number of anti-forensic stripes + * @hash_spec: Hash algorithm name (e.g., "sha256") + * Return: 0 on success, -ve on error + */ +int af_merge(const u8 *src, u8 *dst, size_t key_size, uint stripes, + const char *hash_spec); + +#endif /* __LUKS_INTERNAL_H__ */ -- 2.43.0

From: Simon Glass <simon.glass@canonical.com> Add supports for luks v2 which is a more common version used on modern systems. This makes use of Argon2 and also the JSON->FDT parser. Enable this feature for sandbox, tidying up the defconfig while we are here. Co-developed-by: Claude <noreply@anthropic.com> Signed-off-by: Simon Glass <simon.glass@canonical.com> --- configs/sandbox_defconfig | 4 +- drivers/block/Makefile | 2 +- drivers/block/luks.c | 116 +++- drivers/block/luks2.c | 974 ++++++++++++++++++++++++++++++++++ drivers/block/luks_internal.h | 13 + 5 files changed, 1100 insertions(+), 9 deletions(-) create mode 100644 drivers/block/luks2.c diff --git a/configs/sandbox_defconfig b/configs/sandbox_defconfig index 6a4b3e4363a..006c6916af6 100644 --- a/configs/sandbox_defconfig +++ b/configs/sandbox_defconfig @@ -169,7 +169,6 @@ CONFIG_ADC=y CONFIG_ADC_SANDBOX=y CONFIG_AXI=y CONFIG_AXI_SANDBOX=y -CONFIG_BLKMAP=y CONFIG_SYS_IDE_MAXBUS=1 CONFIG_SYS_ATA_BASE_ADDR=0x100 CONFIG_SYS_ATA_STRIDE=4 @@ -177,6 +176,7 @@ CONFIG_SYS_ATA_DATA_OFFSET=0 CONFIG_SYS_ATA_REG_OFFSET=1 CONFIG_SYS_ATA_ALT_OFFSET=2 CONFIG_SYS_ATA_IDE0_OFFSET=0 +CONFIG_BLK_LUKS=y CONFIG_BOOTCOUNT_LIMIT=y CONFIG_DM_BOOTCOUNT=y CONFIG_DM_BOOTCOUNT_RTC=y @@ -362,12 +362,12 @@ CONFIG_ADDR_MAP=y CONFIG_PANIC_POWEROFF=y CONFIG_CMD_DHRYSTONE=y CONFIG_MBEDTLS_LIB=y -CONFIG_BLK_LUKS=y CONFIG_ECDSA=y CONFIG_ECDSA_VERIFY=y CONFIG_TPM=y CONFIG_ERRNO_STR=y CONFIG_GETOPT=y +CONFIG_ARGON2=y CONFIG_TEST_FDTDEC=y CONFIG_UNIT_TEST=y CONFIG_UT_TIME=y diff --git a/drivers/block/Makefile b/drivers/block/Makefile index b428a5cfb78..538b602790d 100644 --- a/drivers/block/Makefile +++ b/drivers/block/Makefile @@ -11,7 +11,7 @@ endif ifndef CONFIG_XPL_BUILD obj-$(CONFIG_IDE) += ide.o -obj-$(CONFIG_BLK_LUKS) += luks.o +obj-$(CONFIG_BLK_LUKS) += luks.o luks2.o obj-$(CONFIG_RKMTD) += rkmtd.o endif obj-$(CONFIG_SANDBOX) += sandbox.o host-uclass.o host_dev.o diff --git a/drivers/block/luks.c b/drivers/block/luks.c index 05df5b12c53..3bdfd7dba61 100644 --- a/drivers/block/luks.c +++ b/drivers/block/luks.c @@ -8,6 +8,7 @@ #include <blk.h> #include <blkmap.h> #include <dm.h> +#include <dm/ofnode.h> #include <hash.h> #include <hexdump.h> #include <json.h> @@ -21,6 +22,8 @@ #include <linux/err.h> #include <linux/errno.h> #include <linux/string.h> +#include <mbedtls/aes.h> +#include <mbedtls/cipher.h> #include <mbedtls/md.h> #include <mbedtls/pkcs5.h> #include <u-boot/sha256.h> @@ -476,6 +479,9 @@ int luks_unlock(struct udevice *blk, struct disk_partition *pinfo, } version = be16_to_cpu(*(__be16 *)(buffer + LUKS_MAGIC_LEN)); + if (version == LUKS_VERSION_2) + return unlock_luks2(blk, pinfo, pass, master_key, key_size); + if (version != LUKS_VERSION_1) { log_debug("unsupported LUKS version %d\n", version); return -ENOTSUPP; @@ -591,11 +597,12 @@ int luks_create_blkmap(struct udevice *blk, struct disk_partition *pinfo, { u8 essiv_key[SHA256_SUM_LEN]; /* SHA-256 output */ struct luks1_phdr *hdr; + struct luks2_hdr *hdr2; struct blk_desc *desc; struct udevice *dev; uint payload_offset; + int ret, version; bool use_essiv; - int ret; if (!blk || !pinfo || !master_key || !label || !blkmapp) return -EINVAL; @@ -608,7 +615,107 @@ int luks_create_blkmap(struct udevice *blk, struct disk_partition *pinfo, log_debug("failed to read LUKS header\n"); return -EIO; } - hdr = (struct luks1_phdr *)buf; + + /* Check version */ + version = be16_to_cpu(*(__be16 *)(buf + LUKS_MAGIC_LEN)); + + if (version == LUKS_VERSION_2) { + /* LUKS2: Parse JSON for segment offset */ + char *json_data; + u64 hdr_size, segment_offset; + int blocks; + struct abuf fdt_buf; + oftree tree; + ofnode root, segments_node, segment0_node; + const char *offset_str, *encryption; + + abuf_init(&fdt_buf); + + hdr2 = (struct luks2_hdr *)buf; + hdr_size = be64_to_cpu(hdr2->hdr_size); + + /* Read full header with JSON */ + blocks = (hdr_size + desc->blksz - 1) / desc->blksz; + json_data = malloc_cache_aligned(blocks * desc->blksz); + if (!json_data) + return -ENOMEM; + + if (blk_read(blk, pinfo->start, blocks, json_data) != blocks) { + free(json_data); + return -EIO; + } + + /* Convert JSON to FDT */ + ret = json_to_fdt(json_data + 4096, &fdt_buf); + if (ret) { + log_err("Failed to convert JSON to FDT: %d\n", ret); + free(json_data); + return -EINVAL; + } + + /* Create oftree from FDT */ + tree = oftree_from_fdt(abuf_data(&fdt_buf)); + if (!oftree_valid(tree)) { + abuf_uninit(&fdt_buf); + free(json_data); + return -EINVAL; + } + + /* Get root node */ + root = oftree_root(tree); + if (!ofnode_valid(root)) { + abuf_uninit(&fdt_buf); + free(json_data); + return -EINVAL; + } + + /* Navigate to segments node */ + segments_node = ofnode_find_subnode(root, "segments"); + if (!ofnode_valid(segments_node)) { + abuf_uninit(&fdt_buf); + free(json_data); + return -EINVAL; + } + + /* Get first segment (segment 0) */ + segment0_node = ofnode_find_subnode(segments_node, "0"); + if (!ofnode_valid(segment0_node)) { + abuf_uninit(&fdt_buf); + free(json_data); + return -EINVAL; + } + + /* Get offset (string in LUKS2 JSON) */ + offset_str = ofnode_read_string(segment0_node, "offset"); + if (!offset_str) { + abuf_uninit(&fdt_buf); + free(json_data); + return -EINVAL; + } + segment_offset = simple_strtoull(offset_str, NULL, 10); + + /* Convert byte offset to sectors */ + payload_offset = segment_offset / desc->blksz; + + /* Check if ESSIV mode is used */ + encryption = ofnode_read_string(segment0_node, "encryption"); + if (encryption) + use_essiv = strstr(encryption, "essiv"); + else + use_essiv = false; + + abuf_uninit(&fdt_buf); + free(json_data); + } else { + /* LUKS1 */ + hdr = (struct luks1_phdr *)buf; + + /* Check if ESSIV mode is used */ + use_essiv = strstr(hdr->cipher_mode, "essiv"); + + /* Get payload offset */ + payload_offset = be32_to_cpu(hdr->payload_offset); + } /* Create blkmap device */ ret = blkmap_create(label, &dev); @@ -617,9 +724,7 @@ int luks_create_blkmap(struct udevice *blk, struct disk_partition *pinfo, return ret; } - /* Check if ESSIV mode is used */ - use_essiv = strstr(hdr->cipher_mode, "essiv"); - + /* Compute ESSIV key if needed */ if (use_essiv) { int hash_size = SHA256_SUM_LEN; @@ -632,7 +737,6 @@ int luks_create_blkmap(struct udevice *blk, struct disk_partition *pinfo, } /* Map the encrypted partition to the blkmap device */ - payload_offset = be32_to_cpu(hdr->payload_offset); log_debug("mapping blkmap: blknr 0 blkcnt %lx payload_offset %x essiv %d\n", (ulong)pinfo->size, payload_offset, use_essiv); ret = blkmap_map_crypt(dev, 0, pinfo->size, blk, pinfo->start, diff --git a/drivers/block/luks2.c b/drivers/block/luks2.c new file mode 100644 index 00000000000..4720f9d92ce --- /dev/null +++ b/drivers/block/luks2.c @@ -0,0 +1,974 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * LUKS2 (Linux Unified Key Setup version 2) support + * + * Copyright (C) 2025 Canonical Ltd + */ + +/* #define LOG_DEBUG */ + +#include <abuf.h> +#include <blk.h> +#include <dm.h> +#include <dm/ofnode.h> +#include <hash.h> +#include <json.h> +#include <log.h> +#include <luks.h> +#include <memalign.h> +#include <part.h> +#include <uboot_aes.h> +#include <asm/unaligned.h> +#include <linux/errno.h> +#include <linux/string.h> +#include <mbedtls/aes.h> +#include <mbedtls/base64.h> +#include <mbedtls/md.h> +#include <mbedtls/pkcs5.h> +#include <u-boot/sha256.h> +#include <argon2.h> +#include "luks_internal.h" + +/** + * enum luks2_kdf_type - LUKS2 KDF type + * + * @LUKS2_KDF_PBKDF2: PBKDF2 key derivation function + * @LUKS2_KDF_ARGON2I: Argon2i key derivation function + * @LUKS2_KDF_ARGON2ID: Argon2id key derivation function + */ +enum luks2_kdf_type { + LUKS2_KDF_PBKDF2, + LUKS2_KDF_ARGON2I, + LUKS2_KDF_ARGON2ID, +}; + +/** + * struct luks2_digest - LUKS2 digest information + * + * @type: Digest KDF type + * @hash: Hash algorithm name (e.g., "sha256") + * @iters: PBKDF2 iteration count (valid if type == LUKS2_KDF_PBKDF2) + * @time: Argon2 time cost parameter (valid if type == LUKS2_KDF_ARGON2*) + * @memory: Argon2 memory cost parameter in KB (type == LUKS2_KDF_ARGON2*) + * @cpus: Argon2 parallelism/lanes parameter (type == LUKS2_KDF_ARGON2*) + * @salt: Decoded salt value + * @salt_len: Actual length of decoded salt + * @digest: Decoded digest (master key verification value) + * @digest_len: Actual length of decoded digest + */ +struct luks2_digest { + enum luks2_kdf_type type; + const char *hash; + u32 iters; + u32 time; + u32 memory; + u32 cpus; + u8 salt[LUKS_SALTSIZE]; + int salt_len; + u8 digest[128]; + int digest_len; +}; + +/** + * struct luks2_kdf - LUKS2 keyslot KDF parameters + * @type: KDF type + * @salt: Decoded KDF salt + * @salt_len: Actual length of decoded salt + * @iters: PBKDF2 iteration count (valid if type == LUKS2_KDF_PBKDF2) + * @time: Argon2 time cost parameter (valid if type == LUKS2_KDF_ARGON2*) + * @memory: Argon2 memory cost parameter in KB (type == LUKS2_KDF_ARGON2*) + * @cpus: Argon2 parallelism/lanes parameter (type == LUKS2_KDF_ARGON2*) + */ +struct luks2_kdf { + enum luks2_kdf_type type; + u8 salt[LUKS_SALTSIZE]; + int salt_len; + u32 iters; + u32 time; + u32 memory; + u32 cpus; +}; + +/** + * struct luks2_area - LUKS2 keyslot encrypted area parameters + * @offset: Byte offset from partition start where key material is stored + * @size: Size of encrypted key material in bytes + * @encryption: Encryption mode string (e.g., "aes-xts-plain64") + * @key_size: Encryption key size in bytes (32 for AES-256, 64 for XTS-512) + */ +struct luks2_area { + u64 offset; + u64 size; + const char *encryption; + u32 key_size; +}; + +/** + * struct luks2_af - LUKS2 keyslot anti-forensic parameters + * @stripes: Number of anti-forensic stripes (typically 4000) + * @hash: Hash algorithm name for AF merge operation + */ +struct luks2_af { + u32 stripes; + const char *hash; +}; + +/** + * struct luks2_keyslot - LUKS2 keyslot information + * @type: Keyslot type (should be "luks2") + * @key_size: Size of the master key in bytes + * @kdf: Key derivation function parameters + * @af: Anti-forensic parameters + * @area: Encrypted key material area parameters + */ +struct luks2_keyslot { + const char *type; + u32 key_size; + struct luks2_kdf kdf; + struct luks2_af af; + struct luks2_area area; +}; + +/** + * str_to_kdf_type() - Convert KDF type string to enum + * + * @type_str: KDF type string ("pbkdf2", "argon2i", or "argon2id") + * Return: enum luks2_kdf_type value, or negative error code if unknown type + */ +static int str_to_kdf_type(const char *type_str) +{ + if (!type_str) + return -EINVAL; + + if (!strcmp(type_str, "pbkdf2")) + return LUKS2_KDF_PBKDF2; + if (!strcmp(type_str, "argon2i")) + return LUKS2_KDF_ARGON2I; + if (!strcmp(type_str, "argon2id")) + return LUKS2_KDF_ARGON2ID; + + return -ENOTSUPP; +} + +/* Base64 decode wrapper for LUKS2 */ +static int base64_decode(const char *in, u8 *out, int out_len) +{ + size_t olen; + int ret; + + ret = mbedtls_base64_decode(out, out_len, &olen, + (const unsigned char *)in, strlen(in)); + if (ret == MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL) + return -ENOSPC; + if (ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER) + return -EINVAL; + if (ret) + return -EINVAL; + + return olen; +} + +/** + * read_digest_info() - Read LUKS2 digest information from ofnode + * + * @digest_node: ofnode for the digest (e.g., digest "0") + * @digest: Pointer to digest structure to fill + * Return: 0 on success, -ve on error + */ +static int read_digest_info(ofnode digest_node, struct luks2_digest *digest) +{ + const char *salt_b64, *digest_b64; + + const char *type_str; + int ret; + + memset(digest, '\0', sizeof(*digest)); + + /* Read and convert digest type */ + type_str = ofnode_read_string(digest_node, "type"); + ret = str_to_kdf_type(type_str); + if (ret < 0) { + log_debug("LUKS2: unsupported digest type %s\n", type_str); + return ret; + } + digest->type = ret; + + /* Check if Argon2 is supported if needed */ + if ((digest->type == LUKS2_KDF_ARGON2I || + digest->type == LUKS2_KDF_ARGON2ID) && + !IS_ENABLED(CONFIG_ARGON2)) { + log_debug("LUKS2: Argon2 not supported\n"); + return -ENOTSUPP; + } + + /* Read hash algorithm */ + digest->hash = ofnode_read_string(digest_node, "hash"); + if (!digest->hash) + return -EINVAL; + + /* Read KDF-specific parameters */ + if (digest->type == LUKS2_KDF_PBKDF2) { + /* PBKDF2 */ + if (ofnode_read_u32(digest_node, "iterations", &digest->iters)) + return -EINVAL; + } else { + /* Argon2 */ + if (ofnode_read_u32(digest_node, "time", &digest->time) || + ofnode_read_u32(digest_node, "memory", &digest->memory) || + ofnode_read_u32(digest_node, "cpus", &digest->cpus)) + return -EINVAL; + } + + /* Read and decode salt */ + salt_b64 = ofnode_read_string(digest_node, "salt"); + if (!salt_b64) + return -EINVAL; + digest->salt_len = base64_decode(salt_b64, digest->salt, + sizeof(digest->salt)); + if (digest->salt_len <= 0) + return -EINVAL; + + /* Read and decode digest */ + digest_b64 = ofnode_read_string(digest_node, "digest"); + if (!digest_b64) + return -EINVAL; + digest->digest_len = base64_decode(digest_b64, digest->digest, + sizeof(digest->digest)); + if (digest->digest_len <= 0) + return -EINVAL; + + return 0; +} + +/** + * read_keyslot_info() - Read LUKS2 keyslot information from ofnode + * + * @keyslot_node: ofnode for the keyslot (e.g., keyslot "0") + * @keyslot: Pointer to keyslot structure to fill + * @hash_name: Hash name to use for AF (from digest) + * Return: 0 on success, -ve on error + */ +static int read_keyslot_info(ofnode keyslot_node, struct luks2_keyslot *keyslot, + const char *hash_name) +{ + const char *salt_b64, *offset_str, *size_str; + ofnode kdf_node, af_node, area_node; + int ret; + + memset(keyslot, '\0', sizeof(*keyslot)); + + /* Read keyslot type */ + keyslot->type = ofnode_read_string(keyslot_node, "type"); + if (!keyslot->type || strcmp(keyslot->type, "luks2")) + return -EINVAL; + + /* Read key size */ + if (ofnode_read_u32(keyslot_node, "key_size", &keyslot->key_size)) + return -EINVAL; + + /* Navigate to and read KDF node */ + kdf_node = ofnode_find_subnode(keyslot_node, "kdf"); + if (!ofnode_valid(kdf_node)) + return -EINVAL; + + offset_str = ofnode_read_string(kdf_node, "type"); + ret = str_to_kdf_type(offset_str); + if (ret < 0) { + log_debug("LUKS2: unsupported KDF type %s\n", offset_str); + return ret; + } + keyslot->kdf.type = ret; + + /* Check if Argon2 is supported if needed */ + if ((keyslot->kdf.type == LUKS2_KDF_ARGON2I || + keyslot->kdf.type == LUKS2_KDF_ARGON2ID) && + !IS_ENABLED(CONFIG_ARGON2)) { + log_debug("LUKS2: Argon2 not supported\n"); + return -ENOTSUPP; + } + + /* Read KDF salt */ + salt_b64 = ofnode_read_string(kdf_node, "salt"); + if (!salt_b64) + return -EINVAL; + keyslot->kdf.salt_len = base64_decode(salt_b64, keyslot->kdf.salt, + sizeof(keyslot->kdf.salt)); + if (keyslot->kdf.salt_len <= 0) + return -EINVAL; + + /* Read KDF-specific parameters */ + if (keyslot->kdf.type == LUKS2_KDF_PBKDF2) { + if (ofnode_read_u32(kdf_node, "iterations", &keyslot->kdf.iters)) + return -EINVAL; + } else { + /* Argon2 */ + if (ofnode_read_u32(kdf_node, "time", &keyslot->kdf.time) || + ofnode_read_u32(kdf_node, "memory", &keyslot->kdf.memory) || + ofnode_read_u32(kdf_node, "cpus", &keyslot->kdf.cpus)) + return -EINVAL; + } + + /* Navigate to and read AF node */ + af_node = ofnode_find_subnode(keyslot_node, "af"); + if (!ofnode_valid(af_node)) + return -EINVAL; + + if (ofnode_read_u32(af_node, "stripes", &keyslot->af.stripes)) + keyslot->af.stripes = 4000; /* Default */ + keyslot->af.hash = hash_name; + + /* Navigate to and read area node */ + area_node = ofnode_find_subnode(keyslot_node, "area"); + if (!ofnode_valid(area_node)) + return -EINVAL; + + /* Read offset and size (strings in LUKS2 JSON) */ + offset_str = ofnode_read_string(area_node, "offset"); + if (!offset_str) + return -EINVAL; + keyslot->area.offset = simple_strtoull(offset_str, NULL, 10); + + size_str = ofnode_read_string(area_node, "size"); + if (!size_str) + return -EINVAL; + keyslot->area.size = simple_strtoull(size_str, NULL, 10); + + /* Read encryption mode */ + keyslot->area.encryption = ofnode_read_string(area_node, "encryption"); + if (!keyslot->area.encryption) + return -EINVAL; + + /* Read area key size */ + if (ofnode_read_u32(area_node, "key_size", &keyslot->area.key_size)) + return -EINVAL; + + return 0; +} + +/** + * read_luks2_info() - Read and parse LUKS2 header and metadata + * + * @blk: Block device + * @pinfo: Partition information + * @fdt_buf: Buffer to hold the converted FDT (caller must uninit) + * @digest: Pointer to digest structure to fill + * @md_type: Pointer to receive mbedtls MD type + * @keyslots_node: Pointer to receive keyslots ofnode + * Return: 0 on success, -ve on error + */ +static int read_luks2_info(struct udevice *blk, struct disk_partition *pinfo, + struct abuf *fdt_buf, struct luks2_digest *digest, + mbedtls_md_type_t *md_typep, ofnode *keyslots_nodep) +{ + struct blk_desc *desc = dev_get_uclass_plat(blk); + ALLOC_CACHE_ALIGN_BUFFER(u8, buffer, desc->blksz); + ofnode root, digests_node, digest0; + struct hash_algo *hash_algo; + mbedtls_md_type_t md_type; + struct luks2_hdr *hdr; + ofnode keyslots_node; + char *json_data; + int count, ret; + u64 hdr_size; + oftree tree; + + abuf_init(fdt_buf); + + /* Read LUKS2 header */ + if (blk_read(blk, pinfo->start, 1, buffer) != 1) + return -EIO; + + hdr = (struct luks2_hdr *)buffer; + hdr_size = be64_to_cpu(hdr->hdr_size); + + log_debug("LUKS2: header size %llu bytes\n", hdr_size); + + /* Allocate and read full header with JSON */ + count = (hdr_size + desc->blksz - 1) / desc->blksz; + json_data = malloc_cache_aligned(count * desc->blksz); + if (!json_data) + return -ENOMEM; + + if (blk_read(blk, pinfo->start, count, json_data) != count) { + ret = -EIO; + goto out; + } + + ret = -EINVAL; + + /* JSON starts after a 4K binary header: convert to FDT */ + if (json_to_fdt(json_data + 4096, fdt_buf)) { + log_err("Failed to convert JSON to FDT\n"); + goto out; + } + + /* Create oftree from FDT */ + tree = oftree_from_fdt(abuf_data(fdt_buf)); + if (!oftree_valid(tree)) + goto out; + + /* Get root node */ + root = oftree_root(tree); + if (!ofnode_valid(root)) + goto out; + + /* Navigate to digests node and get digest 0 */ + digests_node = ofnode_find_subnode(root, "digests"); + if (!ofnode_valid(digests_node)) + goto out; + + digest0 = ofnode_find_subnode(digests_node, "0"); + if (!ofnode_valid(digest0)) + goto out; + + /* Read digest information */ + ret = read_digest_info(digest0, digest); + if (ret) + goto out; + + /* Get hash algorithm */ + ret = hash_lookup_algo(digest->hash, &hash_algo); + if (ret) { + log_debug("Unsupported hash: %s\n", digest->hash); + ret = -ENOTSUPP; + goto out; + } + md_type = hash_mbedtls_type(hash_algo); + + /* Navigate to keyslots node */ + keyslots_node = ofnode_find_subnode(root, "keyslots"); + if (!ofnode_valid(keyslots_node)) { + ret = -EINVAL; + goto out; + } + + *md_typep = md_type; + *keyslots_nodep = keyslots_node; + +out: + memset(json_data, '\0', count * desc->blksz); + free(json_data); + if (ret) + abuf_uninit(fdt_buf); + + return ret; +} + +/** + * essiv_decrypt() - Decrypt key material using ESSIV mode + * + * ESSIV (Encrypted Salt-Sector Initialization Vector) mode generates a unique + * IV for each sector by encrypting the sector number with a key derived from + * hashing the encryption key. + * + * @derived_key: Key derived from passphrase + * @key_size: Size of the encryption key in bytes + * @expkey: Expanded AES key for decryption + * @km: Encrypted key material buffer + * @split_key: Output buffer for decrypted key material + * @km_blocks: Number of blocks of key material + * @blksz: Block size in bytes + */ +static void essiv_decrypt(u8 *derived_key, uint key_size, u8 *expkey, + u8 *km, u8 *split_key, uint km_blocks, uint blksz) +{ + u8 essiv_expkey[AES256_EXPAND_KEY_LENGTH]; + u8 essiv_key_material[SHA256_SUM_LEN]; + u32 num_sectors = km_blocks; + u8 iv[AES_BLOCK_LENGTH]; + uint rel_sect; + + /* Generate ESSIV key by hashing the encryption key */ + log_debug("using ESSIV mode\n"); + sha256_csum_wd(derived_key, key_size, essiv_key_material, + CHUNKSZ_SHA256); + + log_debug_hex("ESSIV key[0-7]:", essiv_key_material, 8); + + /* Expand ESSIV key for AES */ + aes_expand_key(essiv_key_material, 256, essiv_expkey); + + /* + * Decrypt each sector with its own IV + * NOTE: sector number is relative to the key material buffer, + * not an absolute disk sector + */ + for (rel_sect = 0; rel_sect < num_sectors; rel_sect++) { + u8 sector_iv[AES_BLOCK_LENGTH]; + + /* Create IV: little-endian sector number padded to 16 bytes */ + memset(sector_iv, '\0', AES_BLOCK_LENGTH); + put_unaligned_le32(rel_sect, sector_iv); + + /* Encrypt sector number with ESSIV key to get IV */ + aes_encrypt(256, sector_iv, essiv_expkey, iv); + + /* Show the first sector for debugging */ + if (!rel_sect) { + log_debug("rel_sect %x, ", rel_sect); + log_debug_hex("IV[0-7]:", iv, 8); + } + + /* Decrypt this sector */ + aes_cbc_decrypt_blocks(key_size * 8, expkey, iv, + km + (rel_sect * blksz), + split_key + (rel_sect * blksz), + blksz / AES_BLOCK_LENGTH); + } +} + +/** + * decrypt_km_xts() - Decrypt key material using XTS mode + * + * Decrypts LUKS2 keyslot key material encrypted with AES-XTS mode. + * XTS mode uses 512-byte sectors with sector numbers as tweaks. + * + * @derived_key: Key derived from passphrase using KDF + * @key_size: Size of the derived key in bytes (32 or 64 for XTS) + * @km: Encrypted key material buffer + * @split_key: Output buffer for decrypted split key + * @size: Size of the split key in bytes + * Return: 0 on success, negative error code on failure + */ +static int decrypt_km_xts(const u8 *derived_key, uint key_size, const u8 *km, + u8 *split_key, int size) +{ + mbedtls_aes_xts_context ctx; + const int blksize = 512; + u8 data_unit[16]; + u64 sector; + int ret; + + /* Verify key size is valid for XTS (32 or 64 bytes) */ + if (key_size != 32 && key_size != 64) { + log_err("Unsupported XTS key size: %u\n", key_size); + return -EINVAL; + } + + mbedtls_aes_xts_init(&ctx); + ret = mbedtls_aes_xts_setkey_dec(&ctx, derived_key, key_size * 8); + if (ret) { + log_err("Failed to set XTS key: %d\n", ret); + mbedtls_aes_xts_free(&ctx); + return -EINVAL; + } + + /* + * XTS uses data unit (sector) as tweak + * LUKS2 uses 512-byte sectors for keyslot area + * Sector number is relative to start of keyslot area (not absolute) + */ + sector = 0; + + /* + * Decrypt in chunks (XTS requires whole sectors) + * Each sector has its own data_unit/tweak value + */ + for (u64 pos = 0; pos < size; pos += blksize) { + uint todo; + + todo = (size - pos > blksize) ? blksize : (size - pos); + + /* Prepare data_unit (sector number in little-endian) */ + memset(data_unit, '\0', sizeof(data_unit)); + for (int i = 0; i < 8; i++) + data_unit[i] = (sector >> (i * 8)) & 0xFF; + + ret = mbedtls_aes_crypt_xts(&ctx, MBEDTLS_AES_DECRYPT, todo, + data_unit, km + pos, + split_key + pos); + if (ret) { + log_err("XTS decryption failed at sector %llu: %d\n", + sector, ret); + mbedtls_aes_xts_free(&ctx); + return -EINVAL; + } + sector++; + } + + mbedtls_aes_xts_free(&ctx); + + return 0; +} + +/** + * decrypt_km_cbc() - Decrypt key material using CBC mode + * + * Decrypts LUKS keyslot key material encrypted with AES-CBC mode. + * Supports both ESSIV mode and plain CBC with zero IV. + * + * @derived_key: Key derived from passphrase using KDF + * @key_size: Size of the derived key in bytes + * @encrypt: Encryption-specification string (may contain "essiv") + * @km: Encrypted key material buffer + * @split_key: Output buffer for decrypted split key + * @size: Size of the split key in bytes + * @km_blocks: Number of blocks in key material + * @blksz: Block size in bytes + * Return: 0 on success, negative error code on failure + */ +static int decrypt_km_cbc(u8 *derived_key, uint key_size, const char *encrypt, + u8 *km, u8 *split_key, int size, int km_blocks, + int blksz) +{ + u8 expkey[AES256_EXPAND_KEY_LENGTH]; + + aes_expand_key(derived_key, key_size * 8, expkey); + + /* Check if ESSIV mode is used */ + if (strstr(encrypt, "essiv")) { + essiv_decrypt(derived_key, key_size, expkey, km, split_key, + km_blocks, blksz); + } else { + /* Plain CBC with zero IV */ + u8 iv[AES_BLOCK_LENGTH]; + + memset(iv, '\0', sizeof(iv)); + aes_cbc_decrypt_blocks(key_size * 8, expkey, iv, km, split_key, + size / AES_BLOCK_LENGTH); + } + + return 0; +} + +/* LUKS2-specific: Unlock using PBKDF2 keyslot */ +/** + * try_keyslot_pbkdf2() - Try to decrypt a LUKS2 keyslot using PBKDF2 + * + * Attempts to decrypt a LUKS2 keyslot using the PBKDF2 key derivation function. + * This involves deriving a key from the passphrase, reading the encrypted key + * material from disk, decrypting it (using either XTS or CBC mode), and + * recovering the candidate key through anti-forensic splitting. + * + * @blk: Block device containing the LUKS2 volume + * @pinfo: Partition information for the LUKS2 volume + * @ks: Keyslot information including KDF parameters and encryption area + * @pass: User passphrase to try + * @md_type: mbedtls message digest type for PBKDF2 + * @cand_key: Output buffer for the recovered candidate key + * Return: 0 on success, negative error code on failure + */ +static int try_keyslot_pbkdf2(struct udevice *blk, struct disk_partition *pinfo, + const struct luks2_keyslot *ks, const char *pass, + mbedtls_md_type_t md_type, u8 *cand_key) +{ + struct blk_desc *desc = dev_get_uclass_plat(blk); + int ret, km_blocks, size; + u8 derived_key[128]; + u8 *split_key, *km; + + log_debug("LUKS2: trying keyslot with %u iters\n", ks->kdf.iters); + + /* Derive key from passphrase */ + ret = mbedtls_pkcs5_pbkdf2_hmac_ext(md_type, (const u8 *)pass, + strlen(pass), ks->kdf.salt, + ks->kdf.salt_len, ks->kdf.iters, + ks->area.key_size, derived_key); + if (ret) + return -EPROTO; + + size = ks->key_size * ks->af.stripes; + km_blocks = (size + desc->blksz - 1) / desc->blksz; + + /* Allocate buffers */ + split_key = malloc(size); + km = malloc_cache_aligned(km_blocks * desc->blksz); + if (!split_key || !km) { + ret = -ENOMEM; + goto out; + } + + /* Read encrypted key material */ + ret = blk_read(blk, pinfo->start + (ks->area.offset / desc->blksz), + km_blocks, km); + if (ret != km_blocks) { + ret = -EIO; + goto out; + } + + /* Decrypt key material */ + if (strstr(ks->area.encryption, "xts")) + ret = decrypt_km_xts(derived_key, ks->area.key_size, km, + split_key, size); + else + ret = decrypt_km_cbc(derived_key, ks->area.key_size, + ks->area.encryption, km, split_key, size, + km_blocks, desc->blksz); + + if (ret) + goto out; + + /* AF-merge to recover candidate key */ + ret = af_merge(split_key, cand_key, ks->key_size, ks->af.stripes, + ks->af.hash); + +out: + if (split_key) { + memset(split_key, '\0', size); + free(split_key); + } + if (km) { + memset(km, '\0', km_blocks * desc->blksz); + free(km); + } + memset(derived_key, '\0', sizeof(derived_key)); + + return ret; +} + +/* Unlock using Argon2 keyslot */ +static int try_keyslot_argon2(struct udevice *blk, struct disk_partition *pinfo, + const struct luks2_keyslot *ks, const char *pass, + u8 *cand_key) +{ + struct blk_desc *desc = dev_get_uclass_plat(blk); + int ret, km_blocks, size; + u8 derived_key[128]; + u8 *split_key, *km; + + log_debug("LUKS2: trying keyslot with Argon2id (t=%u, m=%u, p=%u)\n", + ks->kdf.time, ks->kdf.memory, ks->kdf.cpus); + + /* Derive key from passphrase using Argon2id */ + log_debug("LUKS2 Argon2: passphrase='%s', t=%u, m=%u, p=%u, saltlen=%d, keylen=%u\n", + pass, ks->kdf.time, ks->kdf.memory, ks->kdf.cpus, + ks->kdf.salt_len, ks->area.key_size); + ret = argon2id_hash_raw(ks->kdf.time, ks->kdf.memory, ks->kdf.cpus, + pass, strlen(pass), ks->kdf.salt, + ks->kdf.salt_len, derived_key, + ks->area.key_size); + if (ret) { + log_err("Argon2id failed: %s\n", argon2_error_message(ret)); + return -EPROTO; + } + log_debug("LUKS2 Argon2: key derivation succeeded\n"); + + size = ks->key_size * ks->af.stripes; + km_blocks = (size + desc->blksz - 1) / desc->blksz; + + /* Allocate buffers */ + split_key = malloc(size); + km = malloc_cache_aligned(km_blocks * desc->blksz); + if (!split_key || !km) { + ret = -ENOMEM; + goto out; + } + + /* Read encrypted key material */ + ret = blk_read(blk, pinfo->start + (ks->area.offset / desc->blksz), + km_blocks, km); + if (ret != km_blocks) { + ret = -EIO; + goto out; + } + + log_debug("LUKS2 Argon2: read %d blocks from offset %llu, encryption=%s\n", + km_blocks, ks->area.offset, ks->area.encryption); + + /* Decrypt key material */ + if (strstr(ks->area.encryption, "xts")) + ret = decrypt_km_xts(derived_key, ks->area.key_size, + km, split_key, size); + else + ret = decrypt_km_cbc(derived_key, ks->area.key_size, + ks->area.encryption, km, split_key, + size, km_blocks, desc->blksz); + + if (ret) + goto out; + log_debug("LUKS2 Argon2: decryption completed successfully\n"); + + /* AF-merge to recover candidate key */ + log_debug("LUKS2 Argon2: calling AF-merge with key_size=%u, stripes=%u, hash=%s\n", + ks->key_size, ks->af.stripes, ks->af.hash); + ret = af_merge(split_key, cand_key, ks->key_size, ks->af.stripes, + ks->af.hash); + log_debug("LUKS2 Argon2: AF-merge returned %d\n", ret); + +out: + if (split_key) { + memset(split_key, '\0', size); + free(split_key); + } + if (km) { + memset(km, '\0', km_blocks * desc->blksz); + free(km); + } + memset(derived_key, '\0', sizeof(derived_key)); + + return ret; +} + +/** + * verify_master_key() - Verify a candidate master key against the digest + * + * This function takes a candidate master key (successfully derived from a + * keyslot) and verifies it matches the stored digest using the appropriate KDF. + * + * @digest: Digest information (KDF type, parameters, expected digest value) + * @md_type: mbedtls message digest type (for PBKDF2) + * @cand_key: The candidate master key to verify + * @key_size: Size of the candidate key + * @master_key: Output buffer for verified master key + * @key_sizep: Output pointer for key size + * Return: 0 if verified and copied to master_key, -EACCES if mismatch, -ve on + * error + */ +static int verify_master_key(const struct luks2_digest *digest, + mbedtls_md_type_t md_type, + const u8 *cand_key, uint key_size, u8 *master_key, + uint *key_sizep) +{ + u8 calculated_digest[128]; + int ret; + + log_debug("LUKS2: keyslot unlock succeeded, verifying digest (type=%d)\n", + digest->type); + + /* Verify against digest using the appropriate KDF */ + if (digest->type == LUKS2_KDF_PBKDF2) { + /* PBKDF2 digest verification */ + log_debug("LUKS2: verifying with PBKDF2 (iters=%u, saltlen=%d, digestlen=%d)\n", + digest->iters, digest->salt_len, digest->digest_len); + ret = mbedtls_pkcs5_pbkdf2_hmac_ext(md_type, cand_key, + key_size, digest->salt, + digest->salt_len, + digest->iters, + digest->digest_len, + calculated_digest); + if (ret) { + log_debug("PBKDF2 digest hash failed: %d\n", ret); + return -EACCES; + } + } else { + /* Argon2 digest verification */ + log_debug("LUKS2: verifying with Argon2 (t=%u, m=%u, p=%u)\n", + digest->time, digest->memory, digest->cpus); + ret = argon2id_hash_raw(digest->time, digest->memory, + digest->cpus, cand_key, key_size, + digest->salt, digest->salt_len, + calculated_digest, digest->digest_len); + if (ret) { + log_debug("Argon2 digest hash failed: %s\n", + argon2_error_message(ret)); + return -EACCES; + } + } + + log_debug("LUKS2: digest calculated, comparing...\n"); + if (memcmp(calculated_digest, digest->digest, digest->digest_len)) { + log_debug("LUKS2: digest mismatch!\n"); + return -EACCES; + } + + log_debug("LUKS2: digest match, unlock successful\n"); + memcpy(master_key, cand_key, key_size); + *key_sizep = key_size; + + return 0; /* Success! */ +} + +/** + * try_unlock_keyslot() - Try to unlock a single keyslot and verify master key + * + * This function attempts to unlock one keyslot by: + * 1. Reading keyslot metadata from ofnode + * 2. Deriving the candidate master key using the appropriate KDF + * 3. Verifying the candidate key against the stored digest + * + * @blk: Block device containing the LUKS partition + * @pinfo: Partition information + * @keyslot_node: ofnode for this specific keyslot + * @digest: Digest information for verification + * @md_type: mbedtls message digest type (for PBKDF2) + * @pass: User-provided passphrase + * @master_key: Output buffer for verified master key + * @key_sizep: Returns the key size + * Return: 0 if unlocked successfully, -EAGAIN to continue trying, -ve on error + */ +static int try_unlock_keyslot(struct udevice *blk, struct disk_partition *pinfo, + ofnode keyslot_node, + const struct luks2_digest *digest, + mbedtls_md_type_t md_type, const char *pass, + u8 *master_key, uint *key_sizep) +{ + struct luks2_keyslot keyslot; + u8 cand_key[128]; + uint key_size; + int ret; + + /* Read keyslot information */ + ret = read_keyslot_info(keyslot_node, &keyslot, digest->hash); + if (ret) { + /* Skip unsupported or invalid keyslots */ + return -EAGAIN; + } + + log_debug("LUKS2: trying keyslot (type=%d)\n", keyslot.kdf.type); + + /* Try the keyslot using the appropriate KDF */ + if (keyslot.kdf.type == LUKS2_KDF_PBKDF2) { + log_debug("LUKS2: calling try_keyslot_pbkdf2\n"); + ret = try_keyslot_pbkdf2(blk, pinfo, &keyslot, pass, md_type, + cand_key); + } else { + /* Argon2 (already checked for CONFIG_ARGON2 support) */ + log_debug("LUKS2: calling try_keyslot_argon2\n"); + ret = try_keyslot_argon2(blk, pinfo, &keyslot, pass, cand_key); + } + log_debug("LUKS2: keyslot try returned %d\n", ret); + + if (!ret) { + /* Verify the candidate key against the digest */ + ret = verify_master_key(digest, md_type, cand_key, + keyslot.key_size, master_key, + &key_size); + memset(cand_key, '\0', sizeof(cand_key)); + if (!ret) { + *key_sizep = key_size; + return 0; /* Success! */ + } + /* Verification failed, continue trying */ + } + + memset(cand_key, '\0', sizeof(cand_key)); + + return -EAGAIN; /* Continue trying other keyslots */ +} + +int unlock_luks2(struct udevice *blk, struct disk_partition *pinfo, + const char *pass, u8 *master_key, uint *key_sizep) +{ + ofnode keyslots_node, keyslot_node; + struct luks2_digest digest; + mbedtls_md_type_t md_type; + struct abuf fdt_buf; + int ret; + + /* Read and parse LUKS2 header and metadata */ + ret = read_luks2_info(blk, pinfo, &fdt_buf, &digest, &md_type, + &keyslots_node); + if (ret) + return ret; + + /* Try each keyslot until one succeeds */ + ret = -EACCES; + ofnode_for_each_subnode(keyslot_node, keyslots_node) { + ret = try_unlock_keyslot(blk, pinfo, keyslot_node, &digest, + md_type, pass, master_key, key_sizep); + if (!ret) /* Successfully unlocked! */ + break; + + /* -EAGAIN means skip, other errors also continue trying */ + } + abuf_uninit(&fdt_buf); + if (ret) { + if (ret == -EAGAIN) /* no usable slots */ + log_debug("LUKS2: no supported keyslots found\n"); + else /* no slots worked */ + log_debug("LUKS2: wrong passphrase\n"); + ret = -EACCES; + } + + return ret; +} diff --git a/drivers/block/luks_internal.h b/drivers/block/luks_internal.h index 32714787550..14d3839fe6a 100644 --- a/drivers/block/luks_internal.h +++ b/drivers/block/luks_internal.h @@ -27,4 +27,17 @@ int af_merge(const u8 *src, u8 *dst, size_t key_size, uint stripes, const char *hash_spec); +/** + * unlock_luks2() - Unlock a LUKS2 partition with a passphrase + * + * @blk: Block device + * @pinfo: Partition information + * @pass: Passphrase to unlock the partition + * @master_key: Buffer to receive the decrypted master key + * @key_sizep: Returns the key size + * Return: 0 on success, -ve on error + */ +int unlock_luks2(struct udevice *blk, struct disk_partition *pinfo, + const char *pass, u8 *master_key, uint *key_sizep); + #endif /* __LUKS_INTERNAL_H__ */ -- 2.43.0

From: Simon Glass <simon.glass@canonical.com> Add documentation for the new LUKSv2 feature and update LUKSv1 to mention the more common algorithm. Update the tests to use LUKSv2 for mmc12 Co-developed-by: Claude <noreply@anthropic.com> Signed-off-by: Simon Glass <simon.glass@canonical.com> --- doc/usage/cmd/luks.rst | 42 ++++-- doc/usage/luks.rst | 300 +++++++++++++++++++++++++++++++++++------ test/boot/luks.c | 29 ++++ 3 files changed, 318 insertions(+), 53 deletions(-) diff --git a/doc/usage/cmd/luks.rst b/doc/usage/cmd/luks.rst index 6c262e66200..3c8576dc8a1 100644 --- a/doc/usage/cmd/luks.rst +++ b/doc/usage/cmd/luks.rst @@ -57,7 +57,7 @@ For LUKS1 partitions, the following information is displayed: * Version number * Cipher name (encryption algorithm) -* Cipher mode (e.g., xts-plain64) +* Cipher mode (e.g., cbc-essiv:sha256) * Hash specification (e.g., sha256) * Payload offset (in sectors) * Key bytes (key size) @@ -88,24 +88,35 @@ dev[:part] luks unlock ~~~~~~~~~~~ -Unlock a LUKS1 encrypted partition using a passphrase. This command: +Unlock a LUKS encrypted partition using a passphrase. This command: -1. Verifies the partition is LUKS1 encrypted -2. Derives the encryption key using PBKDF2 with the provided passphrase -3. Attempts to unlock each active key slot -4. Verifies the master key against the stored digest -5. Creates a blkmap device providing on-the-fly decryption +1. Verifies the partition is LUKS encrypted (LUKS1 or LUKS2) +2. Parses LUKS2 JSON metadata (if LUKS2) using FDT conversion +3. Derives the encryption key using PBKDF2 or Argon2id with the provided + passphrase +4. Attempts to unlock each active key slot +5. Verifies the master key against the stored digest +6. Creates a blkmap device providing on-the-fly decryption After successful unlock, the decrypted data is accessible through a blkmap device (typically ``blkmap 0``). Standard U-Boot filesystem commands can then be used to access files on the unlocked partition. -**Currently only LUKS1 is supported for unlocking. LUKS2 unlock is not yet -implemented.** +**Supported LUKS versions:** -Supported cipher modes: +* LUKS1 (fully supported) +* LUKS2 (fully supported with PBKDF2 and Argon2id key derivation) -* aes-cbc-essiv:sha256 (AES in CBC mode with ESSIV) +**Supported cipher modes:** + +* **LUKS1**: aes-cbc-essiv:sha256 (AES in CBC mode with ESSIV) +* **LUKS2**: aes-cbc-essiv:sha256 and aes-xts-plain64 (AES-XTS, modern default) + +**Supported key derivation functions:** + +* **PBKDF2**: Traditional password-based key derivation (LUKS1 and LUKS2) +* **Argon2id**: Memory-hard KDF resistant to GPU attacks (LUKS2 only, requires + CONFIG_ARGON2) interface The storage interface type (e.g., mmc, usb, scsi) @@ -165,7 +176,7 @@ Display LUKS header information for a LUKS2 partition:: "0": { "type": "crypt", "offset": "16777216", - "encryption": "aes-xts-plain64", + "encryption": "aes-cbc-essiv:sha256", ... } }, @@ -232,9 +243,16 @@ For LUKS unlock functionality, additional options are required:: CONFIG_BLK_LUKS=y CONFIG_CMD_LUKS=y CONFIG_BLKMAP=y # For blkmap device support + CONFIG_JSON=y # For LUKS2 JSON metadata parsing (auto-selected by + # CONFIG_BLK_LUKS) CONFIG_AES=y # For AES encryption CONFIG_SHA256=y # For SHA-256 hashing CONFIG_PBKDF2=y # For PBKDF2 key derivation + CONFIG_MBEDTLS_LIB=y # For AES-XTS and mbedTLS crypto (LUKS2) + +For Argon2id support (modern LUKS2 KDF):: + + CONFIG_ARGON2=y # Argon2 password hashing (adds ~50KB to binary) Return value ------------ diff --git a/doc/usage/luks.rst b/doc/usage/luks.rst index 24be8d1ea81..db8558ffb56 100644 --- a/doc/usage/luks.rst +++ b/doc/usage/luks.rst @@ -1,14 +1,14 @@ .. SPDX-License-Identifier: GPL-2.0+ LUKS (Linux Unified Key Setup) -=============================== +============================== Overview -------- U-Boot provides support for accessing LUKS-encrypted partitions through the ``luks`` command and the blkmap device infrastructure. This allows U-Boot to -unlock and read data from LUKS1-encrypted block devices. +unlock and read data from LUKS1 and LUKS2-encrypted block devices. LUKS is a standard for disk encryption that stores encryption metadata in a header on the encrypted device. It supports multiple key slots, allowing @@ -17,19 +17,34 @@ different passphrases to unlock the same encrypted data. Currently, U-Boot supports: * LUKS version 1 (LUKS1) +* LUKS version 2 (LUKS2) with PBKDF2 and Argon2 key derivation * AES-256-CBC encryption with ESSIV (Encrypted Salt-Sector IV) mode -* Passphrase-based unlocking via PBKDF2 key derivation +* AES-256-XTS encryption (modern default for LUKS2) +* Passphrase-based unlocking via PBKDF2 or Argon2id key derivation * Reading ext4 and other filesystems from unlocked devices Supported Cipher Modes ------------------------ +---------------------- -The following LUKS1 cipher configurations are supported: +The following cipher configurations are supported: + +**LUKS1:** * **Cipher**: aes * **Mode**: cbc-essiv:sha256 * **Key sizes**: 128-bit, 192-bit, 256-bit -* **Hash**: sha256 (for PBKDF2) +* **KDF**: PBKDF2 with SHA256 + +**LUKS2:** + +* **Cipher**: aes +* **Mode**: cbc-essiv:sha256 or xts-plain64 +* **Key sizes**: 128-bit, 192-bit, 256-bit (CBC); 256-bit, 512-bit (XTS) +* **KDF**: PBKDF2 with SHA256, or Argon2id +* **Hash**: sha256, sha512 (for PBKDF2 and digests) + +XTS mode is the modern default for LUKS2 and provides better security properties +than CBC-ESSIV for disk encryption. Commands -------- @@ -39,11 +54,15 @@ See the :doc:`cmd/luks` for full details. luks detect ~~~~~~~~~~~ -Detect whether a partition is LUKS-encrypted:: +Detect whether a partition is LUKS-encrypted: + +:: luks detect <interface> <dev[:part]> -Example:: +Example: + +:: => luks detect mmc 0:2 LUKS1 encrypted partition detected @@ -53,11 +72,15 @@ This command checks for the LUKS magic bytes and validates the header structure. luks info ~~~~~~~~~ -Display information about a LUKS partition:: +Display information about a LUKS partition: + +:: luks info <interface> <dev[:part]> -Example:: +Example: + +:: => luks info mmc 0:2 Version: 1 @@ -73,11 +96,15 @@ offset to the encrypted data payload. luks unlock ~~~~~~~~~~~ -Unlock a LUKS partition with a passphrase:: +Unlock a LUKS partition with a passphrase: + +:: luks unlock <interface> <dev[:part]> <passphrase> -Example:: +Example: + +:: => luks unlock mmc 0:2 mypassword Trying to unlock LUKS partition... @@ -96,15 +123,17 @@ This command: 5. Creates a blkmap device that provides on-the-fly decryption Accessing Unlocked Data ------------------------- +----------------------- -After unlocking, the decrypted data is accessible through a blkmap device. -The device number is shown in the unlock output (typically ``blkmap 0``). +After unlocking, the decrypted data is accessible through a blkmap device. The +device number is shown in the unlock output (typically ``blkmap 0``). Listing Files ~~~~~~~~~~~~~ -Use standard filesystem commands to access the unlocked device:: +Use standard filesystem commands to access the unlocked device: + +:: => ls blkmap 0 / ./ @@ -120,15 +149,19 @@ Use standard filesystem commands to access the unlocked device:: Reading Files ~~~~~~~~~~~~~ -Read file contents:: +Read file contents: + +:: => cat blkmap 0 /hello.txt Hello from LUKS! Loading Files to Memory -~~~~~~~~~~~~~~~~~~~~~~~~ +~~~~~~~~~~~~~~~~~~~~~~~ + +Load files for further processing: -Load files for further processing:: +:: => ext4load blkmap 0 ${loadaddr} /boot/vmlinuz 5242880 bytes read in 123 ms (40.6 MiB/s) @@ -136,7 +169,9 @@ Load files for further processing:: Using with Boot Flows ~~~~~~~~~~~~~~~~~~~~~ -LUKS-encrypted partitions can be integrated into boot flows:: +LUKS-encrypted partitions can be integrated into boot flows: + +:: => bootflow scan => bootflow list @@ -149,16 +184,41 @@ Implementation Details Key Derivation ~~~~~~~~~~~~~~ -LUKS uses PBKDF2 (Password-Based Key Derivation Function 2) to derive -encryption keys from passphrases. The process: +LUKS supports two key derivation functions: + +**PBKDF2 (Password-Based Key Derivation Function 2)** + +Used by LUKS1 and LUKS2. The process: 1. Passphrase + salt → PBKDF2 → derived key 2. Derived key decrypts the AF-split key material 3. AF-merge combines the split key material → master key 4. Master key digest is verified against stored value +PBKDF2 applies HMAC-SHA256 iteratively (typically 100,000+ iterations) to make +brute-force attacks computationally expensive. + +**Argon2id (Modern KDF for LUKS2)** + +Argon2id is the winner of the Password Hashing Competition and provides better +resistance to GPU-based cracking attacks. The process: + +1. Passphrase + salt → Argon2id(time, memory, parallelism) → derived key +2. Derived key decrypts the AF-split key material +3. AF-merge combines the split key material → master key +4. Master key digest is verified against stored value + +Argon2id parameters: + +* **time**: Number of iterations through memory +* **memory**: Amount of memory used in KiB (e.g., 1048576 = 1GB) +* **parallelism**: Number of parallel threads/lanes + +Argon2id is memory-hard, making it resistant to ASIC and GPU attacks while +remaining fast on CPUs. + Anti-Forensic (AF) Splitter -~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~~~~~~~~~~~~~~~~~~~~~~~~~~ LUKS uses an anti-forensic information splitter to protect key material: @@ -170,8 +230,8 @@ LUKS uses an anti-forensic information splitter to protect key material: ESSIV Mode ~~~~~~~~~~ -ESSIV (Encrypted Salt-Sector IV) generates unique initialization vectors -for each encrypted sector: +ESSIV (Encrypted Salt-Sector IV) generates unique initialization vectors for +each encrypted sector: 1. ESSIV key = SHA256(master_key) 2. For each sector: IV = AES_encrypt(sector_number, ESSIV_key) @@ -180,23 +240,86 @@ for each encrypted sector: This prevents watermarking attacks where identical plaintext blocks would produce identical ciphertext blocks. +XTS Mode +~~~~~~~~ + +XTS (XEX-based tweaked-codebook mode with ciphertext stealing) is the modern +standard for disk encryption and the default for LUKS2. It provides several +advantages over CBC-ESSIV: + +1. **Tweakable block cipher**: Each 512-byte sector uses the sector number as a + tweak +2. **No IV dependency**: Eliminates the need for ESSIV key derivation +3. **Parallel encryption**: Sectors can be encrypted/decrypted independently +4. **Better security**: Resistant to manipulation attacks on ciphertext + +XTS operation: + +1. Uses two AES keys (concatenated): 256-bit key → two 128-bit keys, or 512-bit + key → two 256-bit keys +2. For each 512-byte sector: + + * Data unit (tweak) = sector number in little-endian format + * Plaintext is encrypted using AES-XTS with the data unit + +3. Each 16-byte block within the sector uses a different tweak value derived + from the sector number + +XTS is specified in IEEE P1619 and is widely used in modern disk encryption. + +LUKS2 JSON Metadata Parsing +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +LUKS2 stores its metadata in JSON format within the header. This is handled as +follows: + +1. **JSON to FDT Conversion**: The JSON metadata is converted to a Flattened + Device Tree (FDT) format using ``json_to_fdt()`` +2. **ofnode Navigation**: ofnode API is used to access the tree structure +3. **Type-Safe Property Reading**: Properties are read using + ``ofnode_read_string()`` and ``ofnode_read_u32()`` for type safety + +This approach provides several advantages: + +* **Robust Parsing**: Uses U-Boot's well-tested FDT/ofnode infrastructure +* **Type Safety**: Explicit type checking for all properties +* **Maintainability**: Clear code structure with proper node navigation +* **No String Searching**: Eliminates fragile string-based parsing + +Example navigation path for reading a keyslot's KDF type: + +:: + + root → keyslots → "0" → kdf → type + +The implementation properly handles LUKS2's mixed data types: + +* JSON numbers (iterations, time, memory) are stored as 32-bit integers +* JSON string-encoded numbers (offset, size) are parsed from strings +* JSON strings (type, hash, salt) are read directly + Blkmap Device Mapping ~~~~~~~~~~~~~~~~~~~~~ When a LUKS partition is unlocked, U-Boot creates a blkmap device that: * Maps to the underlying encrypted device -* Performs on-the-fly AES-CBC decryption with ESSIV +* Performs on-the-fly decryption (AES-CBC-ESSIV for LUKS1, AES-XTS for LUKS2) * Presents decrypted data as a standard block device * Supports whole-disk filesystems (no partition table required) -The blkmap device number can be used with any U-Boot command that accepts -block device specifications. +The blkmap device number can be used with any U-Boot command that accepts block +device specifications. Creating LUKS Partitions for Testing -------------------------------------- +------------------------------------ + +Using cryptsetup on Linux +~~~~~~~~~~~~~~~~~~~~~~~~~ + +**LUKS1 with CBC-ESSIV (legacy):** -Using cryptsetup on Linux:: +:: # Create a 60MB file $ dd if=/dev/zero of=test.img bs=1M count=60 @@ -222,14 +345,71 @@ Using cryptsetup on Linux:: # Close the LUKS device $ cryptsetup close testluks +**LUKS2 with XTS and PBKDF2 (modern default):** + +:: + + # Create a 60MB file + $ dd if=/dev/zero of=test.img bs=1M count=60 + + # Format as LUKS2 with XTS + $ cryptsetup luksFormat --type luks2 \ + --cipher aes-xts-plain64 \ + --key-size 512 \ + --hash sha256 \ + --pbkdf pbkdf2 \ + test.img + + # Open, create filesystem, and add files (same as LUKS1) + $ cryptsetup open test.img testluks + $ mkfs.ext4 /dev/mapper/testluks + $ mount /dev/mapper/testluks /mnt + $ echo "Hello from LUKS2!" > /mnt/hello.txt + $ umount /mnt + $ cryptsetup close testluks + +**LUKS2 with XTS and Argon2id (maximum security):** + +:: + + # Create a 60MB file + $ dd if=/dev/zero of=test.img bs=1M count=60 + + # Format as LUKS2 with XTS and Argon2id + $ cryptsetup luksFormat --type luks2 \ + --cipher aes-xts-plain64 \ + --key-size 512 \ + --hash sha256 \ + --pbkdf argon2id \ + --pbkdf-memory 65536 \ + --pbkdf-parallel 4 \ + --iter-time 2000 \ + test.img + + # Open, create filesystem, and add files (same as above) + $ cryptsetup open test.img testluks + $ mkfs.ext4 /dev/mapper/testluks + $ mount /dev/mapper/testluks /mnt + $ echo "Hello from LUKS2 with Argon2!" > /mnt/hello.txt + $ umount /mnt + $ cryptsetup close testluks + +Note: Argon2 parameters: + +* ``--pbkdf-memory``: Memory in KiB (65536 = 64MB) +* ``--pbkdf-parallel``: Number of parallel threads +* ``--iter-time``: Target time in milliseconds for KDF + Using Python with U-Boot Test Infrastructure -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +See ``test/py/tests/fs_helper.py`` for the ``FsHelper`` class: -See ``test/py/tests/fs_helper.py`` for the ``FsHelper`` class:: +:: from fs_helper import FsHelper, DiskHelper - # Create encrypted filesystem + # Create LUKS2 encrypted filesystem with PBKDF2 (default) with FsHelper(config, 'ext4', 30, 'test', part_mb=60, passphrase='mypassword') as fsh: @@ -240,32 +420,66 @@ See ``test/py/tests/fs_helper.py`` for the ``FsHelper`` class:: # Create encrypted filesystem fsh.mk_fs() + # Create LUKS2 encrypted filesystem with Argon2id + with FsHelper(config, 'ext4', 30, 'test', + part_mb=60, + encrypt_passphrase='mypassword', + luks_kdf='argon2id') as fsh: + # Add files to fsh.srcdir + with open(os.path.join(fsh.srcdir, 'hello.txt'), 'w') as f: + f.write('Hello from LUKS with Argon2!\n') + + # Create encrypted filesystem + fsh.mk_fs() + + # Create LUKS1 encrypted filesystem + with FsHelper(config, 'ext4', 30, 'test', + part_mb=60, + encrypt_passphrase='mypassword', + luks_version=1) as fsh: + # Add files to fsh.srcdir + with open(os.path.join(fsh.srcdir, 'hello.txt'), 'w') as f: + f.write('Hello from LUKS1!\n') + + # Create encrypted filesystem + fsh.mk_fs() + Configuration Options --------------------- CONFIG_CMD_LUKS Enable the ``luks`` command +CONFIG_BLK_LUKS + Enable LUKS block device support + CONFIG_BLKMAP Enable blkmap device support (required for LUKS unlock) -CONFIG_AES - Enable AES encryption support +CONFIG_JSON + Enable JSON parsing support (automatically selected by CONFIG_BLK_LUKS for + LUKS2 metadata parsing) + +CONFIG_MBEDTLS_LIB + Enable mbedTLS library for AES-XTS and key derivation CONFIG_SHA256 Enable SHA-256 hashing support -CONFIG_PBKDF2 - Enable PBKDF2 key derivation +CONFIG_SHA512 + Enable SHA-512 hashing support (optional, for LUKS2) + +CONFIG_ARGON2 + Enable Argon2 key derivation support (optional, for modern LUKS2) Limitations ----------- -* Only LUKS1 is currently supported (LUKS2 not yet implemented) -* Only AES-CBC-ESSIV cipher mode is supported * Only passphrase-based unlocking is supported (no key files) * Unlocked devices are read-only (write support not yet implemented) * Master key remains in memory after unlocking (not securely erased on exit) +* Argon2 support requires CONFIG_ARGON2 to be enabled (adds ~50KB to binary) +* Large Argon2 memory requirements may not be suitable for all embedded systems Security Considerations ----------------------- @@ -302,7 +516,9 @@ Example Use Cases Encrypted Root Filesystem ~~~~~~~~~~~~~~~~~~~~~~~~~ -Boot from an encrypted root partition:: +Boot from an encrypted root partition: + +:: => luks unlock mmc 0:2 ${rootfs_password} => setenv bootargs root=/dev/blkmap0 rootfstype=ext4 @@ -313,7 +529,9 @@ Boot from an encrypted root partition:: Encrypted Configuration Storage ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -Read configuration from encrypted partition:: +Read configuration from encrypted partition: + +:: => luks unlock mmc 0:3 ${config_password} => ext4load blkmap 0 ${loadaddr} /config/boot.conf diff --git a/test/boot/luks.c b/test/boot/luks.c index afa8c9f172e..4ee6081a790 100644 --- a/test/boot/luks.c +++ b/test/boot/luks.c @@ -229,6 +229,7 @@ static int bootstd_test_luks_unlock(struct unit_test_state *uts) /* Test unlocking partition 2 with correct passphrase */ ut_assertok(run_command("luks unlock mmc b:2 test", 0)); + ut_assert_nextline("Unlocking LUKS1 partition..."); ut_assert_nextline("Unlocked LUKS partition as blkmap device 'luks-mmc-b:2'"); ut_assert_console_end(); @@ -239,3 +240,31 @@ static int bootstd_test_luks_unlock(struct unit_test_state *uts) return 0; } BOOTSTD_TEST(bootstd_test_luks_unlock, UTF_DM | UTF_SCAN_FDT | UTF_CONSOLE); + +/* Test LUKS2 unlock command with LUKS2 encrypted partition */ +static int bootstd_test_luks2_unlock(struct unit_test_state *uts) +{ + struct udevice *mmc; + + ut_assertok(setup_mmc12(uts, &mmc)); + + /* Test that unlock command exists and handles errors properly */ + /* Should fail because partition 1 is not LUKS */ + ut_asserteq(1, run_command("luks unlock mmc c:1 test", 0)); + ut_assert_nextline("Not a LUKS partition"); + ut_assert_console_end(); + + /* Test unlocking partition 2 with correct passphrase */ + ut_assertok(run_command("luks unlock mmc c:2 test", 0)); + ut_assert_nextline("Unlocking LUKS2 partition..."); + ut_assert_nextline("Unlocked LUKS partition as blkmap device 'luks-mmc-c:2'"); + ut_assert_console_end(); + + /* Test unlocking with wrong passphrase */ + ut_asserteq(1, run_command("luks unlock mmc c:2 wrongpass", 0)); + ut_assert_nextline("Unlocking LUKS2 partition..."); + ut_assert_skip_to_line("Failed to unlock LUKS partition (err -13: Permission denied)"); + + return 0; +} +BOOTSTD_TEST(bootstd_test_luks2_unlock, UTF_DM | UTF_SCAN_FDT | UTF_CONSOLE); -- 2.43.0