Add support for the Adiantum encryption mode to fscrypt. Adiantum is a
tweakable, length-preserving encryption mode with security provably
reducible to that of XChaCha12 and AES-256, subject to a security bound.
It's also a true wide-block mode, unlike XTS. See the paper
"Adiantum: length-preserving encryption for entry-level processors"
(https://eprint.iacr.org/2018/720.pdf) for more details. Also see
commit 059c2a4d8e16 ("crypto: adiantum - add Adiantum support").
On sufficiently long messages, Adiantum's bottlenecks are XChaCha12 and
the NH hash function. These algorithms are fast even on processors
without dedicated crypto instructions. Adiantum makes it feasible to
enable storage encryption on low-end mobile devices that lack AES
instructions; currently such devices are unencrypted. On ARM Cortex-A7,
on 4096-byte messages Adiantum encryption is about 4 times faster than
AES-256-XTS encryption; decryption is about 5 times faster.
In fscrypt, Adiantum is suitable for encrypting both file contents and
names. With filenames, it fixes a known weakness: when two filenames in
a directory share a common prefix of >= 16 bytes, with CTS-CBC their
encrypted filenames share a common prefix too, leaking information.
Adiantum does not have this problem.
Since Adiantum also accepts long tweaks (IVs), it's also safe to use the
master key directly for Adiantum encryption rather than deriving
per-file keys, provided that the per-file nonce is included in the IVs
and the master key isn't used for any other encryption mode. This
configuration saves memory and improves performance. A new fscrypt
policy flag is added to allow users to opt-in to this configuration.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
(cherry picked from commit 889645b87e96cecbdf7d76ab86447d1f1c6b41d3
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt.git master)
Conflicts:
Documentation/filesystems/fscrypt.rst
include/uapi/linux/fs.h
(replaced refcount_t with atomic_t)
Bug: 112008522
Test: For regression testing, built the kernel for x86_64 KVM and ran
the encryption xfstests using kvm-xfstests:
kvm-xfstests -c ext4,f2fs -g encrypt
Tests for the Adiantum mode and "direct key" specifically aren't yet
included in xfstests, but I also tried it manually with the
following (run in the kvm-xfstests test appliance):
cd /
umount /vdc &> /dev/null
mkfs.f2fs -O encrypt -f /dev/vdc
mount /vdc
cd /vdc
rm -rf edir
mkdir edir
. ~/xfstests/common/encrypt
KEYCTL_PROG=keyctl
FSTYP=fscrypt
_new_session_keyring
k=$(_generate_encryption_key)
xfs_io -c "set_encpolicy -c 9 -n 9 -f 0x4 $k" edir/
cp -a /usr edir/
diff -r /usr edir/usr/
dmesg should show that Adiantum is being used:
fscrypt: Adiantum using implementation "adiantum(xchacha12-generic,aes-aesni,nhpoly1305-generic)"
Change-Id: I29ffaa7ef9cbd23d2f6ed428814c607227241ce9
Signed-off-by: Eric Biggers <ebiggers@google.com>
e33fa31e30