1b2441318SGreg Kroah-Hartman /* SPDX-License-Identifier: GPL-2.0 */ 2f8f85271SRoberto Sassu #ifndef _LINUX_ECRYPTFS_H 3f8f85271SRoberto Sassu #define _LINUX_ECRYPTFS_H 4f8f85271SRoberto Sassu 5f8f85271SRoberto Sassu /* Version verification for shared data structures w/ userspace */ 6f8f85271SRoberto Sassu #define ECRYPTFS_VERSION_MAJOR 0x00 7f8f85271SRoberto Sassu #define ECRYPTFS_VERSION_MINOR 0x04 8f8f85271SRoberto Sassu #define ECRYPTFS_SUPPORTED_FILE_VERSION 0x03 9f8f85271SRoberto Sassu /* These flags indicate which features are supported by the kernel 10290502beSKees Cook * module; userspace tools such as the mount helper read the feature 11290502beSKees Cook * bits from a sysfs handle in order to determine how to behave. */ 12f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_PASSPHRASE 0x00000001 13f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_PUBKEY 0x00000002 14f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH 0x00000004 15f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_POLICY 0x00000008 16f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_XATTR 0x00000010 17f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_MULTKEY 0x00000020 18f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_DEVMISC 0x00000040 19f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_HMAC 0x00000080 20f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_FILENAME_ENCRYPTION 0x00000100 21f8f85271SRoberto Sassu #define ECRYPTFS_VERSIONING_GCM 0x00000200 22f8f85271SRoberto Sassu #define ECRYPTFS_MAX_PASSWORD_LENGTH 64 23f8f85271SRoberto Sassu #define ECRYPTFS_MAX_PASSPHRASE_BYTES ECRYPTFS_MAX_PASSWORD_LENGTH 24f8f85271SRoberto Sassu #define ECRYPTFS_SALT_SIZE 8 25f8f85271SRoberto Sassu #define ECRYPTFS_SALT_SIZE_HEX (ECRYPTFS_SALT_SIZE*2) 26f8f85271SRoberto Sassu /* The original signature size is only for what is stored on disk; all 27f8f85271SRoberto Sassu * in-memory representations are expanded hex, so it better adapted to 28f8f85271SRoberto Sassu * be passed around or referenced on the command line */ 29f8f85271SRoberto Sassu #define ECRYPTFS_SIG_SIZE 8 30f8f85271SRoberto Sassu #define ECRYPTFS_SIG_SIZE_HEX (ECRYPTFS_SIG_SIZE*2) 31f8f85271SRoberto Sassu #define ECRYPTFS_PASSWORD_SIG_SIZE ECRYPTFS_SIG_SIZE_HEX 32f8f85271SRoberto Sassu #define ECRYPTFS_MAX_KEY_BYTES 64 33f8f85271SRoberto Sassu #define ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES 512 34f8f85271SRoberto Sassu #define ECRYPTFS_FILE_VERSION 0x03 35f8f85271SRoberto Sassu #define ECRYPTFS_MAX_PKI_NAME_BYTES 16 36f8f85271SRoberto Sassu 37f8f85271SRoberto Sassu #define RFC2440_CIPHER_DES3_EDE 0x02 38f8f85271SRoberto Sassu #define RFC2440_CIPHER_CAST_5 0x03 39f8f85271SRoberto Sassu #define RFC2440_CIPHER_BLOWFISH 0x04 40f8f85271SRoberto Sassu #define RFC2440_CIPHER_AES_128 0x07 41f8f85271SRoberto Sassu #define RFC2440_CIPHER_AES_192 0x08 42f8f85271SRoberto Sassu #define RFC2440_CIPHER_AES_256 0x09 43f8f85271SRoberto Sassu #define RFC2440_CIPHER_TWOFISH 0x0a 44f8f85271SRoberto Sassu #define RFC2440_CIPHER_CAST_6 0x0b 45f8f85271SRoberto Sassu 46f8f85271SRoberto Sassu #define RFC2440_CIPHER_RSA 0x01 47f8f85271SRoberto Sassu 48f8f85271SRoberto Sassu /** 49f8f85271SRoberto Sassu * For convenience, we may need to pass around the encrypted session 50f8f85271SRoberto Sassu * key between kernel and userspace because the authentication token 51f8f85271SRoberto Sassu * may not be extractable. For example, the TPM may not release the 52f8f85271SRoberto Sassu * private key, instead requiring the encrypted data and returning the 53f8f85271SRoberto Sassu * decrypted data. 54f8f85271SRoberto Sassu */ 55f8f85271SRoberto Sassu struct ecryptfs_session_key { 56f8f85271SRoberto Sassu #define ECRYPTFS_USERSPACE_SHOULD_TRY_TO_DECRYPT 0x00000001 57f8f85271SRoberto Sassu #define ECRYPTFS_USERSPACE_SHOULD_TRY_TO_ENCRYPT 0x00000002 58f8f85271SRoberto Sassu #define ECRYPTFS_CONTAINS_DECRYPTED_KEY 0x00000004 59f8f85271SRoberto Sassu #define ECRYPTFS_CONTAINS_ENCRYPTED_KEY 0x00000008 60f8f85271SRoberto Sassu u32 flags; 61f8f85271SRoberto Sassu u32 encrypted_key_size; 62f8f85271SRoberto Sassu u32 decrypted_key_size; 63f8f85271SRoberto Sassu u8 encrypted_key[ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES]; 64f8f85271SRoberto Sassu u8 decrypted_key[ECRYPTFS_MAX_KEY_BYTES]; 65f8f85271SRoberto Sassu }; 66f8f85271SRoberto Sassu 67f8f85271SRoberto Sassu struct ecryptfs_password { 68f8f85271SRoberto Sassu u32 password_bytes; 69f8f85271SRoberto Sassu s32 hash_algo; 70f8f85271SRoberto Sassu u32 hash_iterations; 71f8f85271SRoberto Sassu u32 session_key_encryption_key_bytes; 72f8f85271SRoberto Sassu #define ECRYPTFS_PERSISTENT_PASSWORD 0x01 73f8f85271SRoberto Sassu #define ECRYPTFS_SESSION_KEY_ENCRYPTION_KEY_SET 0x02 74f8f85271SRoberto Sassu u32 flags; 75f8f85271SRoberto Sassu /* Iterated-hash concatenation of salt and passphrase */ 76f8f85271SRoberto Sassu u8 session_key_encryption_key[ECRYPTFS_MAX_KEY_BYTES]; 77f8f85271SRoberto Sassu u8 signature[ECRYPTFS_PASSWORD_SIG_SIZE + 1]; 78f8f85271SRoberto Sassu /* Always in expanded hex */ 79f8f85271SRoberto Sassu u8 salt[ECRYPTFS_SALT_SIZE]; 80f8f85271SRoberto Sassu }; 81f8f85271SRoberto Sassu 82f8f85271SRoberto Sassu enum ecryptfs_token_types {ECRYPTFS_PASSWORD, ECRYPTFS_PRIVATE_KEY}; 83f8f85271SRoberto Sassu 84f8f85271SRoberto Sassu struct ecryptfs_private_key { 85f8f85271SRoberto Sassu u32 key_size; 86f8f85271SRoberto Sassu u32 data_len; 87f8f85271SRoberto Sassu u8 signature[ECRYPTFS_PASSWORD_SIG_SIZE + 1]; 88f8f85271SRoberto Sassu char pki_type[ECRYPTFS_MAX_PKI_NAME_BYTES + 1]; 89f8f85271SRoberto Sassu u8 data[]; 90f8f85271SRoberto Sassu }; 91f8f85271SRoberto Sassu 92f8f85271SRoberto Sassu /* May be a password or a private key */ 93f8f85271SRoberto Sassu struct ecryptfs_auth_tok { 94f8f85271SRoberto Sassu u16 version; /* 8-bit major and 8-bit minor */ 95f8f85271SRoberto Sassu u16 token_type; 96f8f85271SRoberto Sassu #define ECRYPTFS_ENCRYPT_ONLY 0x00000001 97f8f85271SRoberto Sassu u32 flags; 98f8f85271SRoberto Sassu struct ecryptfs_session_key session_key; 99f8f85271SRoberto Sassu u8 reserved[32]; 100f8f85271SRoberto Sassu union { 101f8f85271SRoberto Sassu struct ecryptfs_password password; 102f8f85271SRoberto Sassu struct ecryptfs_private_key private_key; 103f8f85271SRoberto Sassu } token; 104f8f85271SRoberto Sassu } __attribute__ ((packed)); 105f8f85271SRoberto Sassu 106f8f85271SRoberto Sassu #endif /* _LINUX_ECRYPTFS_H */ 107