morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

integritysetup: Add support for hmac-sha512 and wrapped key HMAC algorithms phmac-sha256 and phmac-sha512 (#39719)

Browse Source 
Currently the only supported integrity algorithm using HMAC is
`hmac-sha256`. Add `hmac-sha512` to the list of supported algorithms as
well.

Also add the `PHMAC` integrity algorithm to the list of supported
algorithms. The `PHMAC` algorithm is like the regular HMAC algorithm,
but it takes a wrapped key as input. A key for the `PHMAC` algorithm is
an opaque key blob, who's physical size has nothing to do with the
cryptographic size. Such a wrapped key can for example be a HSM
protected key. Currently PHMAC is only available for the s390x
architecture (Linux on IBM Z).

Support for PHMAC has just been added to the cryptsetup project via MR
https://gitlab.com/cryptsetup/cryptsetup/-/merge_requests/693 by commit

296eb39c60

To allow automatic opening of integrity protected volumes that use PHMAC
via `/etc/integritytab`, this change in systemd's integritysetup tool is
needed as well.
This commit is contained in:
Luca Boccassi
2025-11-14 00:12:34 +00:00
committed by GitHub
parent 7f9c0c31d2 eb7b0d413e
commit 98ae19d9fe
4 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
man/integritytab.xml
View File

@@ -55,8 +55,8 @@
<para>The third field if present contains an absolute filename path to a key file or a <literal>-</literal>
to specify none. When the filename is present, the "integrity-algorithm" defaults to <literal>hmac-sha256</literal>
with the key length derived from the number of bytes in the key file. At this time the only supported integrity algorithm
when using key file is hmac-sha256. The maximum size of the key file is 4096 bytes.
with the key length derived from the number of bytes in the key file. At this time the only supported integrity algorithms
when using key file are hmac-sha256, hmac-sha512, phmac-sha256, and hmac-sha512. The maximum size of the key file is 4096 bytes.
</para>
<para>The fourth field, if present, is a comma-delimited list of options or a <literal>-</literal> to specify none. The following options are
@@ -125,7 +125,7 @@
</varlistentry>
<varlistentry>
<term><option>integrity-algorithm=[crc32c|crc32|xxhash64|sha1|sha256|hmac-sha256]</option></term>
<term><option>integrity-algorithm=[crc32c|crc32|xxhash64|sha1|sha256|hmac-sha256|hmac-sha512|phmac-sha256|phmac-sha512]</option></term>
<listitem><para>
The algorithm used for integrity checking. The default is crc32c. Must match option used during format.

2
src/integritysetup/integrity-util.c
View File

@@ -11,7 +11,7 @@
#include "time-util.h"
static int supported_integrity_algorithm(char *user_supplied) {
if (!STR_IN_SET(user_supplied, "crc32", "crc32c", "xxhash64", "sha1", "sha256", "hmac-sha256"))
if (!STR_IN_SET(user_supplied, "crc32", "crc32c", "xxhash64", "sha1", "sha256", "hmac-sha256", "hmac-sha512", "phmac-sha256", "phmac-sha512"))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unsupported integrity algorithm (%s)", user_supplied);
return 0;
}

3
src/integritysetup/integrity-util.h
View File

@@ -12,4 +12,7 @@ int parse_integrity_options(
char **ret_integrity_alg);
#define DM_HMAC_256 "hmac(sha256)"
#define DM_HMAC_512 "hmac(sha512)"
#define DM_PHMAC_256 "phmac(sha256)"
#define DM_PHMAC_512 "phmac(sha512)"
#define DM_MAX_KEY_SIZE 4096 /* Maximum size of key allowed for dm-integrity */

6
src/integritysetup/integritysetup.c
View File

@@ -77,6 +77,12 @@ static const char *integrity_algorithm_select(const void *key_file_buf) {
if (arg_integrity_algorithm) {
if (streq("hmac-sha256", arg_integrity_algorithm))
return DM_HMAC_256;
if (streq("hmac-sha512", arg_integrity_algorithm))
return DM_HMAC_512;
if (streq("phmac-sha256", arg_integrity_algorithm))
return DM_PHMAC_256;
if (streq("phmac-sha512", arg_integrity_algorithm))
return DM_PHMAC_512;
return arg_integrity_algorithm;
} else if (key_file_buf)
return DM_HMAC_256;