2019-05-19 21:07:45 +09:00
|
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
2015-05-16 08:26:10 +09:00
|
|
|
config FS_ENCRYPTION
|
2018-12-12 18:50:12 +09:00
|
|
|
bool "FS Encryption (Per-file encryption)"
|
2015-05-16 08:26:10 +09:00
|
|
|
select CRYPTO
|
2019-12-27 11:47:00 +09:00
|
|
|
select CRYPTO_HASH
|
|
|
|
|
select CRYPTO_BLKCIPHER
|
2015-05-16 08:26:10 +09:00
|
|
|
select KEYS
|
|
|
|
|
help
|
|
|
|
|
Enable encryption of files and directories. This
|
|
|
|
|
feature is similar to ecryptfs, but it is more memory
|
|
|
|
|
efficient since it avoids caching the encrypted and
|
2018-12-12 18:50:12 +09:00
|
|
|
decrypted pages in the page cache. Currently Ext4,
|
|
|
|
|
F2FS and UBIFS make use of this feature.
|
2019-10-25 06:44:29 +09:00
|
|
|
|
2019-12-27 11:47:00 +09:00
|
|
|
# Filesystems supporting encryption must select this if FS_ENCRYPTION. This
|
|
|
|
|
# allows the algorithms to be built as modules when all the filesystems are.
|
|
|
|
|
config FS_ENCRYPTION_ALGS
|
|
|
|
|
tristate
|
|
|
|
|
select CRYPTO_AES
|
|
|
|
|
select CRYPTO_CBC
|
|
|
|
|
select CRYPTO_CTS
|
|
|
|
|
select CRYPTO_ECB
|
|
|
|
|
select CRYPTO_HMAC
|
fscrypt: improve format of no-key names
When an encrypted directory is listed without the key, the filesystem
must show "no-key names" that uniquely identify directory entries, are
at most 255 (NAME_MAX) bytes long, and don't contain '/' or '\0'.
Currently, for short names the no-key name is the base64 encoding of the
ciphertext filename, while for long names it's the base64 encoding of
the ciphertext filename's dirhash and second-to-last 16-byte block.
This format has the following problems:
- Since it doesn't always include the dirhash, it's incompatible with
directories that will use a secret-keyed dirhash over the plaintext
filenames. In this case, the dirhash won't be computable from the
ciphertext name without the key, so it instead must be retrieved from
the directory entry and always included in the no-key name.
Casefolded encrypted directories will use this type of dirhash.
- It's ambiguous: it's possible to craft two filenames that map to the
same no-key name, since the method used to abbreviate long filenames
doesn't use a proper cryptographic hash function.
Solve both these problems by switching to a new no-key name format that
is the base64 encoding of a variable-length structure that contains the
dirhash, up to 149 bytes of the ciphertext filename, and (if any bytes
remain) the SHA-256 of the remaining bytes of the ciphertext filename.
This ensures that each no-key name contains everything needed to find
the directory entry again, contains only legal characters, doesn't
exceed NAME_MAX, is unambiguous unless there's a SHA-256 collision, and
that we only take the performance hit of SHA-256 on very long filenames.
Note: this change does *not* address the existing issue where users can
modify the 'dirhash' part of a no-key name and the filesystem may still
accept the name.
Signed-off-by: Daniel Rosenberg <drosen@google.com>
[EB: improved comments and commit message, fixed checking return value
of base64_decode(), check for SHA-256 error, continue to set disk_name
for short names to keep matching simpler, and many other cleanups]
Link: https://lore.kernel.org/r/20200120223201.241390-7-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
2020-01-21 07:32:01 +09:00
|
|
|
select CRYPTO_SHA256
|
2019-12-27 11:47:00 +09:00
|
|
|
select CRYPTO_SHA512
|
|
|
|
|
select CRYPTO_XTS
|
2020-02-21 05:19:28 +09:00
|
|
|
|
2019-10-25 06:44:29 +09:00
|
|
|
config FS_ENCRYPTION_INLINE_CRYPT
|
|
|
|
|
bool "Enable fscrypt to use inline crypto"
|
|
|
|
|
depends on FS_ENCRYPTION && BLK_INLINE_ENCRYPTION
|
|
|
|
|
help
|
|
|
|
|
Enable fscrypt to use inline encryption hardware if available.
|
