Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2010 The Android Open Source Project |
| 3 | * |
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | * you may not use this file except in compliance with the License. |
| 6 | * You may obtain a copy of the License at |
| 7 | * |
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | * |
| 10 | * Unless required by applicable law or agreed to in writing, software |
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | * See the License for the specific language governing permissions and |
| 14 | * limitations under the License. |
| 15 | */ |
| 16 | |
| 17 | /* This structure starts 16,384 bytes before the end of a hardware |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 18 | * partition that is encrypted, or in a separate partition. It's location |
| 19 | * is specified by a property set in init.<device>.rc. |
| 20 | * The structure allocates 48 bytes for a key, but the real key size is |
| 21 | * specified in the struct. Currently, the code is hardcoded to use 128 |
| 22 | * bit keys. |
| 23 | * The fields after salt are only valid in rev 1.1 and later stuctures. |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 24 | * Obviously, the filesystem does not include the last 16 kbytes |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 25 | * of the partition if the crypt_mnt_ftr lives at the end of the |
| 26 | * partition. |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 27 | */ |
| 28 | |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 29 | #include <cutils/properties.h> |
Paul Lawrence | 8799917 | 2014-02-20 12:21:31 -0800 | [diff] [blame] | 30 | #include <openssl/sha.h> |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 31 | |
Kenny Root | c96a5f8 | 2013-06-14 12:08:28 -0700 | [diff] [blame] | 32 | /* The current cryptfs version */ |
| 33 | #define CURRENT_MAJOR_VERSION 1 |
Paul Lawrence | f4faa57 | 2014-01-29 13:31:03 -0800 | [diff] [blame] | 34 | #define CURRENT_MINOR_VERSION 3 |
Kenny Root | c96a5f8 | 2013-06-14 12:08:28 -0700 | [diff] [blame] | 35 | |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 36 | #define CRYPT_FOOTER_OFFSET 0x4000 |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 37 | #define CRYPT_FOOTER_TO_PERSIST_OFFSET 0x1000 |
| 38 | #define CRYPT_PERSIST_DATA_SIZE 0x1000 |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 39 | |
| 40 | #define MAX_CRYPTO_TYPE_NAME_LEN 64 |
| 41 | |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 42 | #define MAX_KEY_LEN 48 |
Ken Sumrall | e874407 | 2011-01-18 22:01:55 -0800 | [diff] [blame] | 43 | #define SALT_LEN 16 |
Paul Lawrence | d0c7b17 | 2014-08-08 14:28:10 -0700 | [diff] [blame] | 44 | #define SCRYPT_LEN 32 |
Ken Sumrall | e874407 | 2011-01-18 22:01:55 -0800 | [diff] [blame] | 45 | |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 46 | /* definitions of flags in the structure below */ |
| 47 | #define CRYPT_MNT_KEY_UNENCRYPTED 0x1 /* The key for the partition is not encrypted. */ |
Paul Lawrence | 6bfed20 | 2014-07-28 12:47:22 -0700 | [diff] [blame] | 48 | #define CRYPT_ENCRYPTION_IN_PROGRESS 0x2 /* Encryption partially completed, |
| 49 | encrypted_upto valid*/ |
| 50 | #define CRYPT_INCONSISTENT_STATE 0x4 /* Set when starting encryption, clear when |
| 51 | exit cleanly, either through success or |
| 52 | correctly marked partial encryption */ |
Paul Lawrence | 74f29f1 | 2014-08-28 15:54:10 -0700 | [diff] [blame] | 53 | #define CRYPT_DATA_CORRUPT 0x8 /* Set when encryption is fine, but the |
| 54 | underlying volume is corrupt */ |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 55 | |
Paul Lawrence | f4faa57 | 2014-01-29 13:31:03 -0800 | [diff] [blame] | 56 | /* Allowed values for type in the structure below */ |
| 57 | #define CRYPT_TYPE_PASSWORD 0 /* master_key is encrypted with a password |
| 58 | * Must be zero to be compatible with pre-L |
| 59 | * devices where type is always password.*/ |
| 60 | #define CRYPT_TYPE_DEFAULT 1 /* master_key is encrypted with default |
| 61 | * password */ |
| 62 | #define CRYPT_TYPE_PATTERN 2 /* master_key is encrypted with a pattern */ |
| 63 | #define CRYPT_TYPE_PIN 3 /* master_key is encrypted with a pin */ |
| 64 | #define CRYPT_TYPE_MAX_TYPE 3 /* type cannot be larger than this value */ |
| 65 | |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 66 | #define CRYPT_MNT_MAGIC 0xD0B5B1C4 |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 67 | #define PERSIST_DATA_MAGIC 0xE950CD44 |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 68 | |
Kenny Root | c4c70f1 | 2013-06-14 12:11:38 -0700 | [diff] [blame] | 69 | #define SCRYPT_PROP "ro.crypto.scrypt_params" |
| 70 | #define SCRYPT_DEFAULTS { 15, 3, 1 } |
| 71 | |
| 72 | /* Key Derivation Function algorithms */ |
| 73 | #define KDF_PBKDF2 1 |
| 74 | #define KDF_SCRYPT 2 |
Shawn Willden | 47ba10d | 2014-09-03 17:07:06 -0600 | [diff] [blame^] | 75 | #define KDF_SCRYPT_KEYMASTER_IMPROPER 3 |
| 76 | #define KDF_SCRYPT_KEYMASTER 4 |
Paul Lawrence | 69f4ebd | 2014-04-14 12:17:14 -0700 | [diff] [blame] | 77 | |
| 78 | /* Maximum allowed keymaster blob size. */ |
| 79 | #define KEYMASTER_BLOB_SIZE 2048 |
Kenny Root | c4c70f1 | 2013-06-14 12:11:38 -0700 | [diff] [blame] | 80 | |
Mark Salyzyn | 3e97127 | 2014-01-21 13:27:04 -0800 | [diff] [blame] | 81 | /* __le32 and __le16 defined in system/extras/ext4_utils/ext4_utils.h */ |
Kenny Root | c4c70f1 | 2013-06-14 12:11:38 -0700 | [diff] [blame] | 82 | #define __le8 unsigned char |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 83 | |
| 84 | struct crypt_mnt_ftr { |
Paul Lawrence | f4faa57 | 2014-01-29 13:31:03 -0800 | [diff] [blame] | 85 | __le32 magic; /* See above */ |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 86 | __le16 major_version; |
| 87 | __le16 minor_version; |
Paul Lawrence | f4faa57 | 2014-01-29 13:31:03 -0800 | [diff] [blame] | 88 | __le32 ftr_size; /* in bytes, not including key following */ |
| 89 | __le32 flags; /* See above */ |
| 90 | __le32 keysize; /* in bytes */ |
| 91 | __le32 crypt_type; /* how master_key is encrypted. Must be a |
| 92 | * CRYPT_TYPE_XXX value */ |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 93 | __le64 fs_size; /* Size of the encrypted fs, in 512 byte sectors */ |
| 94 | __le32 failed_decrypt_count; /* count of # of failed attempts to decrypt and |
Paul Lawrence | 8799917 | 2014-02-20 12:21:31 -0800 | [diff] [blame] | 95 | mount, set to 0 on successful mount */ |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 96 | unsigned char crypto_type_name[MAX_CRYPTO_TYPE_NAME_LEN]; /* The type of encryption |
Paul Lawrence | 8799917 | 2014-02-20 12:21:31 -0800 | [diff] [blame] | 97 | needed to decrypt this |
| 98 | partition, null terminated */ |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 99 | __le32 spare2; /* ignored */ |
| 100 | unsigned char master_key[MAX_KEY_LEN]; /* The encrypted key for decrypting the filesystem */ |
| 101 | unsigned char salt[SALT_LEN]; /* The salt used for this encryption */ |
| 102 | __le64 persist_data_offset[2]; /* Absolute offset to both copies of crypt_persist_data |
| 103 | * on device with that info, either the footer of the |
| 104 | * real_blkdevice or the metadata partition. */ |
| 105 | |
| 106 | __le32 persist_data_size; /* The number of bytes allocated to each copy of the |
| 107 | * persistent data table*/ |
Kenny Root | c4c70f1 | 2013-06-14 12:11:38 -0700 | [diff] [blame] | 108 | |
| 109 | __le8 kdf_type; /* The key derivation function used. */ |
| 110 | |
| 111 | /* scrypt parameters. See www.tarsnap.com/scrypt/scrypt.pdf */ |
| 112 | __le8 N_factor; /* (1 << N) */ |
| 113 | __le8 r_factor; /* (1 << r) */ |
| 114 | __le8 p_factor; /* (1 << p) */ |
Paul Lawrence | 8799917 | 2014-02-20 12:21:31 -0800 | [diff] [blame] | 115 | __le64 encrypted_upto; /* If we are in state CRYPT_ENCRYPTION_IN_PROGRESS and |
| 116 | we have to stop (e.g. power low) this is the last |
| 117 | encrypted 512 byte sector.*/ |
| 118 | __le8 hash_first_block[SHA256_DIGEST_LENGTH]; /* When CRYPT_ENCRYPTION_IN_PROGRESS |
| 119 | set, hash of first block, used |
| 120 | to validate before continuing*/ |
Paul Lawrence | 69f4ebd | 2014-04-14 12:17:14 -0700 | [diff] [blame] | 121 | |
Paul Lawrence | d0c7b17 | 2014-08-08 14:28:10 -0700 | [diff] [blame] | 122 | /* key_master key, used to sign the derived key which is then used to generate |
| 123 | * the intermediate key |
Paul Lawrence | 69f4ebd | 2014-04-14 12:17:14 -0700 | [diff] [blame] | 124 | * This key should be used for no other purposes! We use this key to sign unpadded |
| 125 | * data, which is acceptable but only if the key is not reused elsewhere. */ |
| 126 | __le8 keymaster_blob[KEYMASTER_BLOB_SIZE]; |
| 127 | __le32 keymaster_blob_size; |
Paul Lawrence | d0c7b17 | 2014-08-08 14:28:10 -0700 | [diff] [blame] | 128 | |
| 129 | /* Store scrypt of salted intermediate key. When decryption fails, we can |
| 130 | check if this matches, and if it does, we know that the problem is with the |
| 131 | drive, and there is no point in asking the user for more passwords. |
| 132 | |
| 133 | Note that if any part of this structure is corrupt, this will not match and |
| 134 | we will continue to believe the user entered the wrong password. In that |
| 135 | case the only solution is for the user to enter a password enough times to |
| 136 | force a wipe. |
| 137 | |
| 138 | Note also that there is no need to worry about migration. If this data is |
| 139 | wrong, we simply won't recognise a right password, and will continue to |
| 140 | prompt. On the first password change, this value will be populated and |
| 141 | then we will be OK. |
| 142 | */ |
| 143 | unsigned char scrypted_intermediate_key[SCRYPT_LEN]; |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 144 | }; |
| 145 | |
| 146 | /* Persistant data that should be available before decryption. |
| 147 | * Things like airplane mode, locale and timezone are kept |
| 148 | * here and can be retrieved by the CryptKeeper UI to properly |
| 149 | * configure the phone before asking for the password |
| 150 | * This is only valid if the major and minor version above |
| 151 | * is set to 1.1 or higher. |
| 152 | * |
| 153 | * This is a 4K structure. There are 2 copies, and the code alternates |
| 154 | * writing one and then clearing the previous one. The reading |
| 155 | * code reads the first valid copy it finds, based on the magic number. |
| 156 | * The absolute offset to the first of the two copies is kept in rev 1.1 |
| 157 | * and higher crypt_mnt_ftr structures. |
| 158 | */ |
| 159 | struct crypt_persist_entry { |
| 160 | char key[PROPERTY_KEY_MAX]; |
| 161 | char val[PROPERTY_VALUE_MAX]; |
| 162 | }; |
| 163 | |
| 164 | /* Should be exactly 4K in size */ |
| 165 | struct crypt_persist_data { |
| 166 | __le32 persist_magic; |
| 167 | __le32 persist_valid_entries; |
| 168 | __le32 persist_spare[30]; |
| 169 | struct crypt_persist_entry persist_entry[0]; |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 170 | }; |
| 171 | |
Ken Sumrall | 29d8da8 | 2011-05-18 17:20:07 -0700 | [diff] [blame] | 172 | struct volume_info { |
| 173 | unsigned int size; |
| 174 | unsigned int flags; |
| 175 | struct crypt_mnt_ftr crypt_ftr; |
| 176 | char mnt_point[256]; |
| 177 | char blk_dev[256]; |
| 178 | char crypto_blkdev[256]; |
| 179 | char label[256]; |
| 180 | }; |
Jeff Sharkey | ba6ae8d | 2013-07-15 18:14:25 -0700 | [diff] [blame] | 181 | #define VOL_NONREMOVABLE 0x1 |
| 182 | #define VOL_ENCRYPTABLE 0x2 |
| 183 | #define VOL_PRIMARY 0x4 |
| 184 | #define VOL_PROVIDES_ASEC 0x8 |
Ken Sumrall | 29d8da8 | 2011-05-18 17:20:07 -0700 | [diff] [blame] | 185 | |
JP Abgrall | 502dc74 | 2013-11-01 13:06:20 -0700 | [diff] [blame] | 186 | #define DATA_MNT_POINT "/data" |
| 187 | |
Paul Lawrence | 74f29f1 | 2014-08-28 15:54:10 -0700 | [diff] [blame] | 188 | /* Return values for cryptfs_crypto_complete */ |
| 189 | #define CRYPTO_COMPLETE_NOT_ENCRYPTED 1 |
| 190 | #define CRYPTO_COMPLETE_ENCRYPTED 0 |
| 191 | #define CRYPTO_COMPLETE_BAD_METADATA -1 |
| 192 | #define CRYPTO_COMPLETE_PARTIAL -2 |
| 193 | #define CRYPTO_COMPLETE_INCONSISTENT -3 |
| 194 | #define CRYPTO_COMPLETE_CORRUPT -4 |
| 195 | |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 196 | #ifdef __cplusplus |
| 197 | extern "C" { |
| 198 | #endif |
Kenny Root | c4c70f1 | 2013-06-14 12:11:38 -0700 | [diff] [blame] | 199 | |
Paul Lawrence | 69f4ebd | 2014-04-14 12:17:14 -0700 | [diff] [blame] | 200 | typedef int (*kdf_func)(const char *passwd, const unsigned char *salt, |
Paul Lawrence | 1348603 | 2014-02-03 13:28:11 -0800 | [diff] [blame] | 201 | unsigned char *ikey, void *params); |
Kenny Root | c4c70f1 | 2013-06-14 12:11:38 -0700 | [diff] [blame] | 202 | |
Ken Sumrall | 7f7dbaa | 2011-02-01 15:46:41 -0800 | [diff] [blame] | 203 | int cryptfs_crypto_complete(void); |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 204 | int cryptfs_check_passwd(char *pw); |
Ken Sumrall | 3ad9072 | 2011-10-04 20:38:29 -0700 | [diff] [blame] | 205 | int cryptfs_verify_passwd(char *newpw); |
Ken Sumrall | 6864b7e | 2011-01-14 15:20:02 -0800 | [diff] [blame] | 206 | int cryptfs_restart(void); |
Paul Lawrence | 45f1053 | 2014-04-04 18:11:56 +0000 | [diff] [blame] | 207 | int cryptfs_enable(char *flag, int type, char *passwd, int allow_reboot); |
Paul Lawrence | 1348603 | 2014-02-03 13:28:11 -0800 | [diff] [blame] | 208 | int cryptfs_changepw(int type, const char *newpw); |
| 209 | int cryptfs_enable_default(char *flag, int allow_reboot); |
Ken Sumrall | 29d8da8 | 2011-05-18 17:20:07 -0700 | [diff] [blame] | 210 | int cryptfs_setup_volume(const char *label, int major, int minor, |
| 211 | char *crypto_dev_path, unsigned int max_pathlen, |
| 212 | int *new_major, int *new_minor); |
Ken Sumrall | 0b8b597 | 2011-08-31 16:14:23 -0700 | [diff] [blame] | 213 | int cryptfs_revert_volume(const char *label); |
Ken Sumrall | 160b4d6 | 2013-04-22 12:15:39 -0700 | [diff] [blame] | 214 | int cryptfs_getfield(char *fieldname, char *value, int len); |
| 215 | int cryptfs_setfield(char *fieldname, char *value); |
Paul Lawrence | f4faa57 | 2014-01-29 13:31:03 -0800 | [diff] [blame] | 216 | int cryptfs_mount_default_encrypted(void); |
| 217 | int cryptfs_get_password_type(void); |
Paul Lawrence | 399317e | 2014-03-10 13:20:50 -0700 | [diff] [blame] | 218 | char* cryptfs_get_password(void); |
| 219 | void cryptfs_clear_password(void); |
Ken Sumrall | 8f869aa | 2010-12-03 03:47:09 -0800 | [diff] [blame] | 220 | #ifdef __cplusplus |
| 221 | } |
| 222 | #endif |
| 223 | |