Repository navigation
crypto: Add BitLocker Clear Key detection and passwordless open - #1212
Marcondiro wants to merge 1 commit into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
3071eba to
07596c9
Compare
Pre-provisioned and suspended BitLocker devices contain an on-disk Clear Key protector. In cryptsetup 2.8+, passing a NULL passphrase allows extracting the VMK using this Clear Key. - Extend BDCryptoBITLKInfo with has_clearkey field - In bd_crypto_bitlk_info(), probe for clear key presence - In bd_crypto_bitlk_open_flags(), allow NULL context to trigger clear key activation - Add test cases in tests/crypto_test.py Assisted-by: Gemini Signed-off-by: Marco Cavenati <cavenati.marco@gmail.com>
| info->backing_device = g_strdup (crypt_get_device_name (cd)); | ||
| ret = crypt_get_sector_size (cd); | ||
| info->sector_size = ret > 0 ? ret : 0; | ||
| info->has_clearkey = (crypt_activate_by_passphrase (cd, NULL, CRYPT_ANY_SLOT, NULL, 0, 0) >= 0); |
There was a problem hiding this comment.
I am not sure if this is a good idea. crypt_activate_by_passphrase can be quite "heavy" function and in general the bd_crypto_*_info functions can be called as a reaction to udev event (device being added). I'll try talking to cryptsetup developer to check if we could get some "cheaper" API to get this information.
There was a problem hiding this comment.
Ok thanks, I'm not extremely familiar with the whole thing but crypt_activate_by_passphrase calls BITLK_get_volume_key that has an happy path for clearkey (when password == NULL)
this combined with the dry-run mode (name == NULL) skips a lot of the expensive code. Overall shouldn't be much more than a 64KiB read (most likely in page cache?).
This branch has not been deployed
2 participants
Hi,
This PR introduces support for Bitlocker Clear Keys: pre-provisioned and suspended BitLocker devices contain this on-disk key in clear, more info on Microsoft's FAQ.
In cryptsetup 2.8+, passing a NULL passphrase allows extracting the VMK using this Clear Key.
Assisted-by: Gemini
Thanks!