bd_crypto_close ()

void
bd_crypto_close (void);

Cleans up after the plugin. **This function is called automatically by the library's functions that unload it.**

bd_crypto_init ()

gboolean
bd_crypto_init (void);

Initializes the plugin. **This function is called automatically by the library's initialization functions.**

bd_crypto_error_quark ()

GQuark
bd_crypto_error_quark (void);

[skip]

bd_crypto_generate_backup_passphrase ()

gchar *
bd_crypto_generate_backup_passphrase (GError **error);

bd_crypto_device_is_luks ()

gboolean
bd_crypto_device_is_luks (const gchar *device,
                          GError **error);

bd_crypto_device_seems_encrypted ()

gboolean
bd_crypto_device_seems_encrypted (const gchar *device,
                                  GError **error);

Determines whether a block device seems to be encrypted.

TCRYPT volumes are not easily identifiable, because they have no cleartext header, but are completely encrypted. This function is used to determine whether a block device is a candidate for being TCRYPT encrypted.

To achieve this, we calculate the chi square value of the first 512 Bytes and treat devices with a chi square value between 136 and 426 as candidates for being encrypted. For the reasoning, see: https://tails.boum.org/blueprint/veracrypt/

bd_crypto_luks_status ()

const gchar *
bd_crypto_luks_status (const gchar *luks_device,
                       GError **error);

bd_crypto_luks_format ()

gboolean
bd_crypto_luks_format (const gchar *device,
                       const gchar *cipher,
                       guint64 key_size,
                       BDCryptoKeyslotContext *context,
                       guint64 min_entropy,
                       BDCryptoLUKSVersion luks_version,
                       BDCryptoLUKSExtra *extra,
                       GError **error);

Formats the given device as LUKS according to the other parameters given. If min_entropy is specified (greater than 0), the function waits for enough entropy to be available in the random data pool (WHICH MAY POTENTIALLY TAKE FOREVER).

Supported context types for this function: passphrase, key file

bd_crypto_luks_extra_free ()

void
bd_crypto_luks_extra_free (BDCryptoLUKSExtra *extra);

Frees extra .

[skip]

bd_crypto_luks_extra_copy ()

BDCryptoLUKSExtra *
bd_crypto_luks_extra_copy (BDCryptoLUKSExtra *extra);

Creates a new copy of extra .

[skip]

bd_crypto_luks_extra_new ()

BDCryptoLUKSExtra *
bd_crypto_luks_extra_new (guint64 data_alignment,
                          const gchar *data_device,
                          const gchar *integrity,
                          guint32 sector_size,
                          const gchar *label,
                          const gchar *subsystem,
                          BDCryptoLUKSPBKDF *pbkdf);

[constructor]

bd_crypto_luks_pbkdf_free ()

void
bd_crypto_luks_pbkdf_free (BDCryptoLUKSPBKDF *pbkdf);

Frees pbkdf .

[skip]

bd_crypto_luks_pbkdf_copy ()

BDCryptoLUKSPBKDF *
bd_crypto_luks_pbkdf_copy (BDCryptoLUKSPBKDF *pbkdf);

Creates a new copy of pbkdf .

[skip]

bd_crypto_luks_pbkdf_new ()

BDCryptoLUKSPBKDF *
bd_crypto_luks_pbkdf_new (const gchar *type,
                          const gchar *hash,
                          guint32 max_memory_kb,
                          guint32 iterations,
                          guint32 time_ms,
                          guint32 parallel_threads);

[constructor]

bd_crypto_keyslot_context_free ()

void
bd_crypto_keyslot_context_free (BDCryptoKeyslotContext *context);

Frees context .

[skip]

bd_crypto_keyslot_context_copy ()

BDCryptoKeyslotContext *
bd_crypto_keyslot_context_copy (BDCryptoKeyslotContext *context);

Creates a new copy of context .

[skip]

bd_crypto_keyslot_context_new_passphrase ()

BDCryptoKeyslotContext *
bd_crypto_keyslot_context_new_passphrase
                               (const guint8 *pass_data,
                                gsize data_len,
                                GError **error);

Returns (transfer full): new BDCryptoKeyslotContext initialized by passphrase or NULL in case of error

Tech category: always available

bd_crypto_keyslot_context_new_keyfile ()

BDCryptoKeyslotContext *
bd_crypto_keyslot_context_new_keyfile (const gchar *keyfile,
                                       guint64 keyfile_offset,
                                       gsize key_size,
                                       GError **error);

Returns (transfer full): new BDCryptoKeyslotContext initialized by key file or NULL in case of error

Tech category: always available

bd_crypto_keyslot_context_new_keyring ()

BDCryptoKeyslotContext *
bd_crypto_keyslot_context_new_keyring (const gchar *key_desc,
                                       GError **error);

Returns (transfer full): new BDCryptoKeyslotContext initialized by key_desc or NULL in case of error

Note: Keyslot passphrase must be stored in 'user' key type and the key has to be reachable by process context on behalf of which this function is called.

Tech category: always available

bd_crypto_keyslot_context_new_volume_key ()

BDCryptoKeyslotContext *
bd_crypto_keyslot_context_new_volume_key
                               (const guint8 *volume_key,
                                gsize volume_key_size,
                                GError **error);

Returns (transfer full): new BDCryptoKeyslotContext initialized by volume key or NULL in case of error

Tech category: always available

bd_crypto_luks_open ()

gboolean
bd_crypto_luks_open (const gchar *device,
                     const gchar *name,
                     BDCryptoKeyslotContext *context,
                     gboolean read_only,
                     GError **error);

Supported context types for this function: passphrase, key file, keyring

1
2
3

BDCryptoKeyslotContext *context = NULL;
context = bd_crypto_keyslot_context_new_passphrase ("passphrase", 10, NULL);
bd_crypto_luks_open ("/dev/vda1", "luks-device", context, FALSE, NULL);

bd_crypto_luks_close ()

gboolean
bd_crypto_luks_close (const gchar *luks_device,
                      GError **error);

bd_crypto_luks_add_key ()

gboolean
bd_crypto_luks_add_key (const gchar *device,
                        BDCryptoKeyslotContext *context,
                        BDCryptoKeyslotContext *ncontext,
                        GError **error);

Supported context types for this function: passphrase, key file

bd_crypto_luks_remove_key ()

gboolean
bd_crypto_luks_remove_key (const gchar *device,
                           BDCryptoKeyslotContext *context,
                           GError **error);

Supported context types for this function: passphrase, key file

bd_crypto_luks_change_key ()

gboolean
bd_crypto_luks_change_key (const gchar *device,
                           BDCryptoKeyslotContext *context,
                           BDCryptoKeyslotContext *ncontext,
                           GError **error);

Supported context types for this function: passphrase, key file

bd_crypto_luks_resize ()

gboolean
bd_crypto_luks_resize (const gchar *luks_device,
                       guint64 size,
                       BDCryptoKeyslotContext *context,
                       GError **error);

Supported context types for this function: passphrase, key file

bd_crypto_luks_suspend ()

gboolean
bd_crypto_luks_suspend (const gchar *luks_device,
                        GError **error);

bd_crypto_luks_resume ()

gboolean
bd_crypto_luks_resume (const gchar *luks_device,
                       BDCryptoKeyslotContext *context,
                       GError **error);

Supported context types for this function: passphrase, key file

bd_crypto_luks_kill_slot ()

gboolean
bd_crypto_luks_kill_slot (const gchar *device,
                          gint slot,
                          GError **error);

Note: This can destroy last remaining keyslot without confirmation making the LUKS device permanently inaccessible.

bd_crypto_luks_header_backup ()

gboolean
bd_crypto_luks_header_backup (const gchar *device,
                              const gchar *backup_file,
                              GError **error);

bd_crypto_luks_header_restore ()

gboolean
bd_crypto_luks_header_restore (const gchar *device,
                               const gchar *backup_file,
                               GError **error);

bd_crypto_luks_set_label ()

gboolean
bd_crypto_luks_set_label (const gchar *device,
                          const gchar *label,
                          const gchar *subsystem,
                          GError **error);

bd_crypto_luks_set_uuid ()

gboolean
bd_crypto_luks_set_uuid (const gchar *device,
                         const gchar *uuid,
                         GError **error);

bd_crypto_luks_info_free ()

void
bd_crypto_luks_info_free (BDCryptoLUKSInfo *info);

Frees info .

[skip]

bd_crypto_luks_info_copy ()

BDCryptoLUKSInfo *
bd_crypto_luks_info_copy (BDCryptoLUKSInfo *info);

Creates a new copy of info .

[skip]

bd_crypto_luks_info ()

BDCryptoLUKSInfo *
bd_crypto_luks_info (const gchar *device,
                     GError **error);

bd_crypto_integrity_info_free ()

void
bd_crypto_integrity_info_free (BDCryptoIntegrityInfo *info);

Frees info .

[skip]

bd_crypto_integrity_info_copy ()

BDCryptoIntegrityInfo *
bd_crypto_integrity_info_copy (BDCryptoIntegrityInfo *info);

Creates a new copy of info .

[skip]

bd_crypto_integrity_info ()

BDCryptoIntegrityInfo *
bd_crypto_integrity_info (const gchar *device,
                          GError **error);

bd_crypto_integrity_extra_copy ()

BDCryptoIntegrityExtra *
bd_crypto_integrity_extra_copy (BDCryptoIntegrityExtra *extra);

Creates a new copy of extra .

[skip]

bd_crypto_integrity_extra_free ()

void
bd_crypto_integrity_extra_free (BDCryptoIntegrityExtra *extra);

Frees extra .

[skip]

bd_crypto_integrity_extra_new ()

BDCryptoIntegrityExtra *
bd_crypto_integrity_extra_new (guint32 sector_size,
                               guint64 journal_size,
                               guint journal_watermark,
                               guint journal_commit_time,
                               guint64 interleave_sectors,
                               guint64 tag_size,
                               guint64 buffer_sectors);

[constructor]

bd_crypto_integrity_format ()

gboolean
bd_crypto_integrity_format (const gchar *device,
                            const gchar *algorithm,
                            gboolean wipe,
                            BDCryptoKeyslotContext *context,
                            BDCryptoIntegrityExtra *extra,
                            GError **error);

Formats the given device as integrity according to the other parameters given.

Supported context types for this function: volume key

bd_crypto_integrity_open ()

gboolean
bd_crypto_integrity_open (const gchar *device,
                          const gchar *name,
                          const gchar *algorithm,
                          BDCryptoKeyslotContext *context,
                          BDCryptoIntegrityOpenFlags flags,
                          BDCryptoIntegrityExtra *extra,
                          GError **error);

Supported context types for this function: volume key

bd_crypto_integrity_close ()

gboolean
bd_crypto_integrity_close (const gchar *integrity_device,
                           GError **error);

bd_crypto_luks_token_info_free ()

void
bd_crypto_luks_token_info_free (BDCryptoLUKSTokenInfo *info);

Frees info .

[skip]

bd_crypto_luks_token_info_copy ()

BDCryptoLUKSTokenInfo *
bd_crypto_luks_token_info_copy (BDCryptoLUKSTokenInfo *info);

Creates a new copy of info .

[skip]

bd_crypto_luks_token_info ()

BDCryptoLUKSTokenInfo **
bd_crypto_luks_token_info (const gchar *device,
                           GError **error);

bd_crypto_keyring_add_key ()

gboolean
bd_crypto_keyring_add_key (const gchar *key_desc,
                           const guint8 *key_data,
                           gsize data_len,
                           GError **error);

bd_crypto_tc_open ()

gboolean
bd_crypto_tc_open (const gchar *device,
                   const gchar *name,
                   BDCryptoKeyslotContext *context,
                   const gchar **keyfiles,
                   gboolean hidden,
                   gboolean system,
                   gboolean veracrypt,
                   guint32 veracrypt_pim,
                   gboolean read_only,
                   GError **error);

Supported context types for this function: passphrase

bd_crypto_tc_close ()

gboolean
bd_crypto_tc_close (const gchar *tc_device,
                    GError **error);

bd_crypto_escrow_device ()

gboolean
bd_crypto_escrow_device (const gchar *device,
                         const gchar *passphrase,
                         const gchar *cert_data,
                         const gchar *directory,
                         const gchar *backup_passphrase,
                         GError **error);

bd_crypto_bitlk_info ()

BDCryptoBITLKInfo *
bd_crypto_bitlk_info (const gchar *device,
                      GError **error);

Returns (transfer full): information about the device or NULL in case of error

Tech category: BD_CRYPTO_TECH_BITLK-BD_CRYPTO_TECH_MODE_QUERY

bd_crypto_bitlk_info_copy ()

BDCryptoBITLKInfo *
bd_crypto_bitlk_info_copy (BDCryptoBITLKInfo *info);

Creates a new copy of info .

[skip]

bd_crypto_bitlk_info_free ()

void
bd_crypto_bitlk_info_free (BDCryptoBITLKInfo *info);

Frees info .

[skip]

bd_crypto_bitlk_open ()

gboolean
bd_crypto_bitlk_open (const gchar *device,
                      const gchar *name,
                      BDCryptoKeyslotContext *context,
                      gboolean read_only,
                      GError **error);

Supported context types for this function: passphrase, key file

bd_crypto_bitlk_close ()

gboolean
bd_crypto_bitlk_close (const gchar *bitlk_device,
                       GError **error);

bd_crypto_fvault2_open ()

gboolean
bd_crypto_fvault2_open (const gchar *device,
                        const gchar *name,
                        BDCryptoKeyslotContext *context,
                        gboolean read_only,
                        GError **error);

Supported context types for this function: passphrase, key file

bd_crypto_fvault2_close ()

gboolean
bd_crypto_fvault2_close (const gchar *fvault2_device,
                         GError **error);

bd_crypto_is_tech_avail ()

gboolean
bd_crypto_is_tech_avail (BDCryptoTech tech,
                         guint64 mode,
                         GError **error);

BD_CRYPTO_ERROR

#define             BD_CRYPTO_ERROR

enum BDCryptoError

BD_CRYPTO_BACKUP_PASSPHRASE_CHARSET

#define BD_CRYPTO_BACKUP_PASSPHRASE_CHARSET "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz./"

BD_CRYPTO_BACKUP_PASSPHRASE_LENGTH

#define BD_CRYPTO_BACKUP_PASSPHRASE_LENGTH 20

BDCryptoLUKSExtra

typedef struct {
    guint64 data_alignment;
    gchar *data_device;
    gchar *integrity;
    guint32 sector_size;
    gchar *label;
    gchar *subsystem;
    BDCryptoLUKSPBKDF *pbkdf;
} BDCryptoLUKSExtra;

BDCryptoLUKSPBKDF

typedef struct {
    gchar *type;
    gchar *hash;
    guint32 max_memory_kb;
    guint32 iterations;
    guint32 time_ms;
    guint32 parallel_threads;
} BDCryptoLUKSPBKDF;

enum BDCryptoLUKSVersion

BDCryptoKeyslotContext

typedef struct {
    BDCryptoKeyslotContextType type;

    union {
        struct {
            guint8 *pass_data;
            gsize data_len;
        } passphrase;

        struct {
            gchar *keyfile;
            guint64 keyfile_offset;
            gsize key_size;
        } keyfile;

        struct {
            gchar *key_desc;
        } keyring;

        struct {
            guint8 *volume_key;
            gsize volume_key_size;
        } volume_key;
    } u;
} BDCryptoKeyslotContext;

BDCryptoLUKSInfo

typedef struct {
    BDCryptoLUKSVersion version;
    gchar *cipher;
    gchar *mode;
    gchar *uuid;
    gchar *backing_device;
    guint32 sector_size;
    guint64 metadata_size;
    gchar *label;
    gchar *subsystem;
} BDCryptoLUKSInfo;

BDCryptoIntegrityInfo

typedef struct {
    gchar *algorithm;
    guint32 key_size;
    guint32 sector_size;
    guint32 tag_size;
    guint32 interleave_sectors;
    guint64 journal_size;
    gchar *journal_crypt;
    gchar *journal_integrity;
} BDCryptoIntegrityInfo;

BDCryptoIntegrityExtra

typedef struct {
    guint32 sector_size;
    guint64 journal_size;
    guint journal_watermark;
    guint journal_commit_time;
    guint32 interleave_sectors;
    guint32 tag_size;
    guint32 buffer_sectors;
} BDCryptoIntegrityExtra;

enum BDCryptoIntegrityOpenFlags

BDCryptoLUKSTokenInfo

typedef struct {
    guint id;
    gchar *type;
    gint keyslot;
} BDCryptoLUKSTokenInfo;

BDCryptoBITLKInfo

typedef struct {
    gchar *cipher;
    gchar *mode;
    gchar *uuid;
    gchar *backing_device;
    guint32 sector_size;
} BDCryptoBITLKInfo;

enum BDCryptoTech

enum BDCryptoTechMode