Password security for FBE disk encryption keys
Added a new call change_user_key which changes the way that disk
encryption keys are protected; a key can now be protected with a
combination of an auth token and a secret which is a hashed password.
Both of these are passed to unlock_user_key.
This change introduces a security bug, b/26948053, which must be fixed
before we ship.
Bug: 22950892
Change-Id: Iac1e45bb6f86f2af5c472c70a0fe3228b02115bf
diff --git a/KeyStorage.h b/KeyStorage.h
index a35349c..54c3b2c 100644
--- a/KeyStorage.h
+++ b/KeyStorage.h
@@ -22,14 +22,27 @@
namespace android {
namespace vold {
+// Represents the information needed to decrypt a disk encryption key.
+// If "token" is nonempty, it is passed in as a required Gatekeeper auth token.
+// If "secret" is nonempty, it is appended to the application-specific
+// binary needed to unlock.
+class KeyAuthentication {
+public:
+ KeyAuthentication(std::string t, std::string s): token {t}, secret {s} {};
+ const std::string token;
+ const std::string secret;
+};
+
+extern const KeyAuthentication kEmptyAuthentication;
+
// Create a directory at the named path, and store "key" in it,
// in such a way that it can only be retrieved via Keymaster and
// can be securely deleted.
// It's safe to move/rename the directory after creation.
-bool storeKey(const std::string &dir, const std::string &key);
+bool storeKey(const std::string &dir, const KeyAuthentication &auth, const std::string &key);
// Retrieve the key from the named directory.
-bool retrieveKey(const std::string &dir, std::string &key);
+bool retrieveKey(const std::string &dir, const KeyAuthentication &auth, std::string &key);
// Securely destroy the key stored in the named directory and delete the directory.
bool destroyKey(const std::string &dir);