Move change key into library (add crypt_keyslot_change_by_passphrase).

[platform/upstream/cryptsetup.git] / lib / libcryptsetup.h

diff --git a/lib/libcryptsetup.h b/lib/libcryptsetup.h
index b1f5f0c..54bcbff 100644 (file)
--- a/lib/libcryptsetup.h
+++ b/lib/libcryptsetup.h
@@ -302,7 +302,7 @@ int crypt_memory_lock(struct crypt_device *cd, int lock);
 #define CRYPT_LOOPAES "LOOPAES"
 /** dm-verity mode */
 #define CRYPT_VERITY "VERITY"
-/** TCRYPT mode */
+/** TCRYPT (TrueCrypt-compatible) mode */
 #define CRYPT_TCRYPT "TCRYPT"
 
 /**
@@ -389,18 +389,22 @@ struct crypt_params_verity {
  * @see crypt_format
  *
  */
+/** Include legacy modes ehn scannig for header*/
+#define CRYPT_TCRYPT_LEGACY_MODES    (1 << 0)
 /** Try to load hidden header (describing hidden device) */
-#define CRYPT_TCRYPT_HIDDEN_HEADER   (1 << 0)
+#define CRYPT_TCRYPT_HIDDEN_HEADER   (1 << 1)
+/** Try to load backup header */
+#define CRYPT_TCRYPT_BACKUP_HEADER   (1 << 2)
 
 struct crypt_params_tcrypt {
-       const char *passphrase;
-       size_t passphrase_size;
-       const char **keyfiles;
-       unsigned int keyfiles_count;
+       const char *passphrase;    /**< passphrase to unlock header (input only) */
+       size_t passphrase_size;    /**< passphrase size (input only) */
+       const char **keyfiles;     /**< keyfile paths to unlock header (input only) */
+       unsigned int keyfiles_count;/**< keyfiles count (input only) */
        const char *hash_name;     /**< hash function for PBKDF */
-       const char *cipher[3];     /**< cipher chain */
+       const char *cipher;        /**< cipher chain c1[-c2[-c3]] */
        const char *mode;          /**< cipher block mode */
-       size_t key_size;           /**< key size in bytes */
+       size_t key_size;           /**< key size in bytes (the whole chain) */
        uint32_t flags;            /**< CRYPT_TCRYPT* flags */
 };
 
@@ -595,6 +599,33 @@ int crypt_keyslot_add_by_passphrase(struct crypt_device *cd,
        size_t new_passphrase_size);
 
 /**
+ * Change defined key slot using provided passphrase
+ *
+ * @pre @e cd contains initialized and formatted LUKS device context
+ *
+ * @param cd crypt device handle
+ * @param keyslot_old old keyslot or @e CRYPT_ANY_SLOT
+ * @param keyslot_new new keyslot (can be the same as old)
+ * @param passphrase passphrase used to unlock volume key, @e NULL for query
+ * @param passphrase_size size of passphrase (binary data)
+ * @param new_passphrase passphrase for new keyslot, @e NULL for query
+ * @param new_passphrase_size size of @e new_passphrase (binary data)
+ *
+ * @return allocated key slot number or negative errno otherwise.
+ *
+ * @note This function is just internal implementation of luksChange
+ * command to avoid reading of volume key outside libcryptsetup boundary
+ * in FIPS mode.
+ */
+int crypt_keyslot_change_by_passphrase(struct crypt_device *cd,
+       int keyslot_old,
+       int keyslot_new,
+       const char *passphrase,
+       size_t passphrase_size,
+       const char *new_passphrase,
+       size_t new_passphrase_size);
+
+/**
 * Add key slot using provided key file path
  *
  * @pre @e cd contains initialized and formatted LUKS device context
@@ -784,6 +815,8 @@ int crypt_activate_by_keyfile(struct crypt_device *cd,
  * @note For VERITY the volume key means root hash required for activation.
  *      Because kernel dm-verity is always read only, you have to provide
  *      CRYPT_ACTIVATE_READONLY flag always.
+ * @note For TCRYPT the volume key should be always NULL and because master
+ *      key from decrypted header is used instead.
  */
 int crypt_activate_by_volume_key(struct crypt_device *cd,
        const char *name,
@@ -816,6 +849,9 @@ int crypt_deactivate(struct crypt_device *cd, const char *name);
  * @param passphrase_size size of @e passphrase
  *
  * @return unlocked key slot number or negative errno otherwise.
+ *
+ * @note For TCRYPT cipher chain is  the volume key concatenated
+ *      for all ciphers in chain.
  */
 int crypt_volume_key_get(struct crypt_device *cd,
        int keyslot,
@@ -896,6 +932,15 @@ int crypt_benchmark(struct crypt_device *cd,
        double *encryption_mbs,
        double *decryption_mbs);
 
+int crypt_benchmark_kdf(struct crypt_device *cd,
+       const char *kdf,
+       const char *hash,
+       const char *password,
+       size_t password_size,
+       const char *salt,
+       size_t salt_size,
+       uint64_t *iterations_sec);
+
 /**
  * Get cipher used in device
  *