cryptfs

package
v0.7.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 19, 2016 License: MIT Imports: 21 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// Understood Feature Flags.
	// Also teach isFeatureFlagKnown() about any additions and
	// add it to CreateConfFile() if you want to have it enabled by default.
	FlagPlaintextNames = "PlaintextNames"
	FlagDirIV          = "DirIV"
	FlagEMENames       = "EMENames"
	FlagGCMIV128       = "GCMIV128"
)
View Source 
const (
	DEFAULT_PLAINBS = 4096
	KEY_LEN         = 32 // AES-256
	AUTH_TAG_LEN    = 16
	DIRIV_LEN       = 16 // identical to AES block size
	DIRIV_FILENAME  = "gocryptfs.diriv"
)
View Source 
const (
	HEADER_CURRENT_VERSION = 2                                  // Current on-disk-format version
	HEADER_VERSION_LEN     = 2                                  // uint16
	HEADER_ID_LEN          = 16                                 // 128 bit random file id
	HEADER_LEN             = HEADER_VERSION_LEN + HEADER_ID_LEN // Total header length
)
View Source 
const (
	OpEncrypt = iota
	OpDecrypt
)
View Source 
const (
	// The dot "." is not used in base64url (RFC4648), hence
	// we can never clash with an encrypted file.
	ConfDefaultName = "gocryptfs.conf"
)
View Source 
const (
	// 1 << 16 uses 64MB of memory,
	// takes 4 seconds on my Atom Z3735F netbook
	SCRYPT_DEFAULT_LOGN = 16
)

Variables

View Source 
var Debug = logChannel{false}

Debug messages

View Source 
var Info = logChannel{true}

Informational message e.g. startup information

View Source 
var Warn = logChannel{true}

A warning, meaning nothing serious by itself but might indicate problems

Functions

func CreateConfFile 

func CreateConfFile(filename string, password string, plaintextNames bool, logN int) error

CreateConfFile - create a new config with a random key encrypted with "password" and write it to "filename". Uses scrypt with cost parameter logN.

func MinUint64 

func MinUint64(x uint64, y uint64) uint64

func NewScryptKdf 

func NewScryptKdf(logN int) scryptKdf

func RandBytes 

func RandBytes(n int) []byte

Get "n" random bytes from /dev/urandom or panic

func RandUint64 added in v0.7.1 

func RandUint64() uint64

Return a secure random uint64

func WriteDirIV added in v0.5.1 

func WriteDirIV(dir string) error

WriteDirIV - create diriv file inside "dir" (absolute ciphertext path) This function is exported because it is used from pathfs_frontend, main, and also the automated tests.

Types

type ConfFile 

type ConfFile struct {

	// Encrypted AES key, unlocked using a password hashed with scrypt
	EncryptedKey []byte
	// Stores parameters for scrypt hashing (key derivation)
	ScryptObject scryptKdf
	// The On-Disk-Format version this filesystem uses
	Version uint16
	// List of feature flags this filesystem has enabled.
	// If gocryptfs encounters a feature flag it does not support, it will refuse
	// mounting. This mechanism is analogous to the ext4 feature flags that are
	// stored in the superblock.
	FeatureFlags []string
	// contains filtered or unexported fields
}

func LoadConfFile 

func LoadConfFile(filename string, password string) ([]byte, *ConfFile, error)

LoadConfFile - read config file from disk and decrypt the contained key using password.

Returns the decrypted key and the ConfFile object

func (*ConfFile) EncryptKey 

func (cf *ConfFile) EncryptKey(key []byte, password string, logN int)

EncryptKey - encrypt "key" using an scrypt hash generated from "password" and store it in cf.EncryptedKey. Uses scrypt with cost parameter logN and stores the scrypt parameters in cf.ScryptObject.

func (*ConfFile) IsFeatureFlagSet added in v0.5.1 

func (cf *ConfFile) IsFeatureFlagSet(flagWant string) bool

isFeatureFlagSet - is the feature flag "flagWant" enabled?

func (*ConfFile) WriteFile 

func (cf *ConfFile) WriteFile() error

WriteFile - write out config in JSON format to file "filename.tmp" then rename over "filename". This way a password change atomically replaces the file.

type CryptFS 

type CryptFS struct {

	// DirIV cache for filename encryption
	DirIVCacheEnc DirIVCache
	// contains filtered or unexported fields
}

func NewCryptFS 

func NewCryptFS(key []byte, useOpenssl bool, plaintextNames bool, GCMIV128 bool) *CryptFS

func (*CryptFS) BlockNoToCipherOff 

func (be *CryptFS) BlockNoToCipherOff(blockNo uint64) uint64

get ciphertext offset of block "blockNo"

func (*CryptFS) BlockNoToPlainOff 

func (be *CryptFS) BlockNoToPlainOff(blockNo uint64) uint64

get plaintext offset of block "blockNo"

func (*CryptFS) BlockOverhead added in v0.7.1 

func (be *CryptFS) BlockOverhead() uint64

Per-block storage overhead

func (*CryptFS) CipherOffToBlockNo 

func (be *CryptFS) CipherOffToBlockNo(cipherOffset uint64) uint64

get the block number at ciphter-text offset

func (*CryptFS) CipherSizeToPlainSize 

func (be *CryptFS) CipherSizeToPlainSize(cipherSize uint64) uint64

PlainSize - calculate plaintext size from ciphertext size

func (*CryptFS) DecryptBlock 

func (be *CryptFS) DecryptBlock(ciphertext []byte, blockNo uint64, fileId []byte) ([]byte, error)

DecryptBlock - Verify and decrypt GCM block

Corner case: A full-sized block of all-zero ciphertext bytes is translated to an all-zero plaintext block, i.e. file hole passtrough.

func (*CryptFS) DecryptBlocks 

func (be *CryptFS) DecryptBlocks(ciphertext []byte, firstBlockNo uint64, fileId []byte) ([]byte, error)

DecryptBlocks - Decrypt a number of blocks

func (*CryptFS) DecryptName added in v0.5.1 

func (be *CryptFS) DecryptName(cipherName string, iv []byte, EMENames bool) (string, error)

DecryptName - decrypt base64-encoded encrypted filename "cipherName" The used encryption is either CBC or EME, depending on the "EMENames" argument.

This function is exported because it allows for a very efficient readdir implementation (read IV once, decrypt all names using this function).

func (*CryptFS) DecryptPathDirIV added in v0.5.1 

func (be *CryptFS) DecryptPathDirIV(encryptedPath string, rootDir string, eme bool) (string, error)

DecryptPathDirIV - encrypt path using CBC or EME with DirIV

func (*CryptFS) DecryptPathNoIV added in v0.7.1 

func (be *CryptFS) DecryptPathNoIV(cipherPath string) (plainPath string, err error)

DecryptPathNoIV - decrypt path using CBC without any IV. This function is deprecated by the the more secure DirIV variant and only retained for compatability with old filesystems.

func (*CryptFS) EncryptBlock 

func (be *CryptFS) EncryptBlock(plaintext []byte, blockNo uint64, fileID []byte) []byte

encryptBlock - Encrypt and add IV and MAC

func (*CryptFS) EncryptPathDirIV added in v0.5.1 

func (be *CryptFS) EncryptPathDirIV(plainPath string, rootDir string, eme bool) (cipherPath string, err error)

EncryptPathDirIV - encrypt path using CBC or EME with DirIV

func (*CryptFS) EncryptPathNoIV added in v0.7.1 

func (be *CryptFS) EncryptPathNoIV(plainPath string) (cipherPath string)

EncryptPathNoIV - decrypt path using CBC without any IV. This function is deprecated by the the more secure DirIV variant and only retained for compatability with old filesystems.

func (*CryptFS) ExplodePlainRange 

func (be *CryptFS) ExplodePlainRange(offset uint64, length uint64) []intraBlock

Split a plaintext byte range into (possibly partial) blocks

func (*CryptFS) MergeBlocks 

func (be *CryptFS) MergeBlocks(oldData []byte, newData []byte, offset int) []byte

MergeBlocks - Merge newData into oldData at offset New block may be bigger than both newData and oldData

func (*CryptFS) PlainBS 

func (be *CryptFS) PlainBS() uint64

Get plaintext block size

func (*CryptFS) PlainOffToBlockNo 

func (be *CryptFS) PlainOffToBlockNo(plainOffset uint64) uint64

get the block number at plain-text offset

func (*CryptFS) PlainSizeToCipherSize 

func (be *CryptFS) PlainSizeToCipherSize(plainSize uint64) uint64

CipherSize - calculate ciphertext size from plaintext size

func (*CryptFS) ReadDirIV added in v0.5.1 

func (be *CryptFS) ReadDirIV(dir string) (iv []byte, err error)

readDirIV - read the "gocryptfs.diriv" file from "dir" (absolute ciphertext path)

type CryptFile 

type CryptFile struct {
	// contains filtered or unexported fields
}

type DirIVCache added in v0.5.1 

type DirIVCache struct {
	// contains filtered or unexported fields
}

A simple one-entry DirIV cache

func (*DirIVCache) Clear added in v0.5.1 

func (c *DirIVCache) Clear()

type FileHeader 

type FileHeader struct {
	Version uint16
	Id      []byte
}

func ParseHeader 

func ParseHeader(buf []byte) (*FileHeader, error)

ParseHeader - parse "buf" into fileHeader object

func RandomHeader 

func RandomHeader() *FileHeader

RandomHeader - create new fileHeader object with random Id

func (*FileHeader) Pack 

func (h *FileHeader) Pack() []byte

Pack - serialize fileHeader object

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.