74 lines · plain
1==========================================2Encrypted keys for the eCryptfs filesystem3==========================================4 5ECryptfs is a stacked filesystem which transparently encrypts and decrypts each6file using a randomly generated File Encryption Key (FEK).7 8Each FEK is in turn encrypted with a File Encryption Key Encryption Key (FEKEK)9either in kernel space or in user space with a daemon called 'ecryptfsd'. In10the former case the operation is performed directly by the kernel CryptoAPI11using a key, the FEKEK, derived from a user prompted passphrase; in the latter12the FEK is encrypted by 'ecryptfsd' with the help of external libraries in order13to support other mechanisms like public key cryptography, PKCS#11 and TPM based14operations.15 16The data structure defined by eCryptfs to contain information required for the17FEK decryption is called authentication token and, currently, can be stored in a18kernel key of the 'user' type, inserted in the user's session specific keyring19by the userspace utility 'mount.ecryptfs' shipped with the package20'ecryptfs-utils'.21 22The 'encrypted' key type has been extended with the introduction of the new23format 'ecryptfs' in order to be used in conjunction with the eCryptfs24filesystem. Encrypted keys of the newly introduced format store an25authentication token in its payload with a FEKEK randomly generated by the26kernel and protected by the parent master key.27 28In order to avoid known-plaintext attacks, the datablob obtained through29commands 'keyctl print' or 'keyctl pipe' does not contain the overall30authentication token, which content is well known, but only the FEKEK in31encrypted form.32 33The eCryptfs filesystem may really benefit from using encrypted keys in that the34required key can be securely generated by an Administrator and provided at boot35time after the unsealing of a 'trusted' key in order to perform the mount in a36controlled environment. Another advantage is that the key is not exposed to37threats of malicious software, because it is available in clear form only at38kernel level.39 40Usage::41 42 keyctl add encrypted name "new ecryptfs key-type:master-key-name keylen" ring43 keyctl add encrypted name "load hex_blob" ring44 keyctl update keyid "update key-type:master-key-name"45 46Where::47 48 name:= '<16 hexadecimal characters>'49 key-type:= 'trusted' | 'user'50 keylen:= 6451 52 53Example of encrypted key usage with the eCryptfs filesystem:54 55Create an encrypted key "1000100010001000" of length 64 bytes with format56'ecryptfs' and save it using a previously loaded user key "test"::57 58 $ keyctl add encrypted 1000100010001000 "new ecryptfs user:test 64" @u59 1918453060 61 $ keyctl print 1918453062 ecryptfs user:test 64 490045d4bfe48c99f0d465fbbbb79e7500da954178e2de069763 dd85091f5450a0511219e9f7cd70dcd498038181466f78ac8d4c19504fcc72402bfc41c264 f253a41b7507ccaa4b2b03fff19a69d1cc0b16e71746473f023a95488b6edfd86f7fdd4065 9d292e4bacded1258880122dd553a66166 67 $ keyctl pipe 19184530 > ecryptfs.blob68 69Mount an eCryptfs filesystem using the created encrypted key "1000100010001000"70into the '/secret' directory::71 72 $ mount -i -t ecryptfs -oecryptfs_sig=1000100010001000,\73 ecryptfs_cipher=aes,ecryptfs_key_bytes=32 /secret /secret74