qemu/qapi/crypto.json

1 # -*- Mode: Python -*-
24 { 'enum': 'QCryptoTLSCredsEndpoint',
30 # The data format that the secret is provided in
32 # @raw: raw bytes.  When encoded in JSON only valid UTF-8 sequences
39 { 'enum': 'QCryptoSecretFormat',
49 # @sha1: SHA-1.  Should not be used in any new code, legacy compat only
51 # @sha224: SHA-224.  (since 2.7)
53 # @sha256: SHA-256.  Current recommended strong hash.
55 # @sha384: SHA-384.  (since 2.7)
57 # @sha512: SHA-512.  (since 2.7)
59 # @ripemd160: RIPEMD-160.  (since 2.7)
65 { 'enum': 'QCryptoHashAlgo',
73 # @aes-128: AES with 128 bit / 16 byte keys
75 # @aes-192: AES with 192 bit / 24 byte keys
77 # @aes-256: AES with 256 bit / 32 byte keys
84 # @cast5-128: Cast5 with 128 bit / 16 byte keys
86 # @serpent-128: Serpent with 128 bit / 16 byte keys
88 # @serpent-192: Serpent with 192 bit / 24 byte keys
90 # @serpent-256: Serpent with 256 bit / 32 byte keys
92 # @twofish-128: Twofish with 128 bit / 16 byte keys
94 # @twofish-192: Twofish with 192 bit / 24 byte keys
96 # @twofish-256: Twofish with 256 bit / 32 byte keys
102 { 'enum': 'QCryptoCipherAlgo',
103   'data': ['aes-128', 'aes-192', 'aes-256',
105            'cast5-128',
106            'serpent-128', 'serpent-192', 'serpent-256',
107            'twofish-128', 'twofish-192', 'twofish-256',
125 { 'enum': 'QCryptoCipherMode',
134 # compatibility with pre-existing Linux dm-crypt volumes is required.
136 # @plain: 64-bit sector number truncated to 32-bits
138 # @plain64: 64-bit sector number
140 # @essiv: 64-bit sector number encrypted with a hash of the encryption
145 { 'enum': 'QCryptoIVGenAlgo',
153 # @qcow: QCow/QCow2 built-in AES-CBC encryption.  Use only for
156 # @luks: LUKS encryption format.  Recommended for new images
160 { 'enum': 'QCryptoBlockFormat',
168 # @format: the encryption format
173   'data': { 'format': 'QCryptoBlockFormat' }}
178 # The options that apply to QCow/QCow2 AES-CBC encryption format
180 # @key-secret: the ID of a QCryptoSecret object providing the
187   'data': { '*key-secret': 'str' }}
192 # The options that apply to LUKS encryption format
194 # @key-secret: the ID of a QCryptoSecret object providing the
201   'data': { '*key-secret': 'str' }}
206 # The options that apply to LUKS encryption format initialization
208 # @cipher-alg: the cipher algorithm for data encryption.  Currently
209 #     defaults to 'aes-256'.
211 # @cipher-mode: the cipher mode for data encryption.  Currently
214 # @ivgen-alg: the initialization vector generator.  Currently defaults
217 # @ivgen-hash-alg: the initialization vector generator hash.
220 # @hash-alg: the master key hash algorithm.  Currently defaults to
223 # @iter-time: number of milliseconds to spend in PBKDF passphrase
230   'data': { '*cipher-alg': 'QCryptoCipherAlgo',
231             '*cipher-mode': 'QCryptoCipherMode',
232             '*ivgen-alg': 'QCryptoIVGenAlgo',
233             '*ivgen-hash-alg': 'QCryptoHashAlgo',
234             '*hash-alg': 'QCryptoHashAlgo',
235             '*iter-time': 'int' }}
247   'discriminator': 'format',
261   'discriminator': 'format',
271 # @format: the encryption format
276   'data': { 'format': 'QCryptoBlockFormat' }}
285 # @key-offset: offset to the key material in bytes
297            'key-offset': 'int' } }
304 # @cipher-alg: the cipher algorithm for data encryption
306 # @cipher-mode: the cipher mode for data encryption
308 # @ivgen-alg: the initialization vector generator
310 # @ivgen-hash-alg: the initialization vector generator hash
312 # @hash-alg: the master key hash algorithm
314 # @detached-header: whether the LUKS header is detached (Since 9.0)
316 # @payload-offset: offset to the payload data in bytes
318 # @master-key-iters: number of PBKDF2 iterations for key material
327   'data': {'cipher-alg': 'QCryptoCipherAlgo',
328            'cipher-mode': 'QCryptoCipherMode',
329            'ivgen-alg': 'QCryptoIVGenAlgo',
330            '*ivgen-hash-alg': 'QCryptoHashAlgo',
331            'hash-alg': 'QCryptoHashAlgo',
332            'detached-header': 'bool',
333            'payload-offset': 'int',
334            'master-key-iters': 'int',
347   'discriminator': 'format',
362 { 'enum': 'QCryptoBlockLUKSKeyslotState',
368 # This struct defines the update parameters that activate/de-activate
373 # @new-secret: The ID of a QCryptoSecret object providing the password
376 # @old-secret: Optional (for deactivation only).  If given will
380 # @iter-time: Optional (for activation only).  Number of milliseconds to
401             '*new-secret': 'str',
402             '*old-secret': 'str',
404             '*iter-time': 'int',
417   'discriminator': 'format',
424 # Properties for objects of classes derived from secret-common.
426 # @format: the data format that the secret is provided in
435 #     16-byte IV.  Mandatory if @keyid is given.  Ignored if @keyid is
441   'data': { '*format': 'QCryptoSecretFormat',
480 # Properties for objects of classes derived from tls-creds.
482 # @verify-peer: if true the peer credentials will be verified once the
483 #     handshake is completed.  This is a no-op for anonymous
493 #     https://gnutls.org/manual/html_node/Priority-Strings.html
498   'data': { '*verify-peer': 'bool',
506 # Properties for tls-creds-anon objects.
517 # Properties for tls-creds-psk objects.
532 # Properties for tls-creds-x509 objects.
534 # @sanity-check: if true, perform some sanity checks before using the
537 # @passwordid: For the server-key.pem and client-key.pem files which
547   'data': { '*sanity-check': 'bool',
558 { 'enum': 'QCryptoAkCipherAlgo',
572 { 'enum': 'QCryptoAkCipherKeyType',
586 { 'enum': 'QCryptoRSAPaddingAlgo',
594 # @hash-alg: `QCryptoHashAlgo`
596 # @padding-alg: `QCryptoRSAPaddingAlgo`
601   'data': { 'hash-alg':'QCryptoHashAlgo',
602             'padding-alg': 'QCryptoRSAPaddingAlgo'}}