[gentoo-ppc-user] CryptoAPI enabled PPC kernel available

[Olivier Reisch]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

For those interested in advanced security, I put together a CryptoAPI enabled 
PPC kernel for Gentoo. CryptoAPI allows you to attach a crypted partition or 
virtual volume to a loopback device and then mount it as normal volume into 
your file system. This for instance allows you to have your /home directory 
fully encrypted, so if someone gets access to your box, he won't be able to 
mount or read any data without authenticating first (even using a Boot CD), 
as all the data is stored in encrypted form on your disk as soon as the 
partition or virtual volume gets unmounted. Encryption used is pretty strong, 
ciphers included are AES (aka Rijndael), MARS, RC6, Serpent, Twofish, 3DES, 
Blowfish, CAST5 cipher, GOST, IDEA and some more. Most of them support the 
use of 256 bit keys.

For more information about the benefits of CryptoAPI, you can take a look at 
their site at http://www.kerneli.org

The current kernel in Portage is as follows:

*  sys-kernel/ppc-sources-crypto [ Masked ]
      Latest version available: 2.4.20
      Latest version installed: 2.4.20
      Size of downloaded files: 26,980 kB
      Homepage:    http://www.kernel.org/ http://www.kerneli.org/ 
http://www.gentoo.org/
      Description: Full cryptoapi enabled sources for the Gentoo Linux PPC 
kernel

It is currently ~ppc masked for further testing. It's basically a 2.4.20-ben5 
kernel with CryptoAPI 0.1.0, cryptoloop 0.0.1-pre1 and the loop-jari patch 
for 2.4.20.

To try it, you can do the following:

emerge rsync
env ACCEPT_KEYWORDS="~ppc" emerge ppc-sources-crypto
USE="crypt" emerge linux-utils

The sources for the kernel are still being mirrored to the Gentoo mirrors at 
the moment. In the meantime the ebuild will automatically fetch them from my 
local mirror, which may be a bit slower.
We have to remerge linux-utils to have mount and losetup patched for CryptoAPI 
support.

Next step is to go compile our new kernel:

cd /usr/src/linux-ppc-crypto-2.4.20
make oldconfig
#This will generate a default config which should work fine on most machines,
#it also already has all the ciphers enabled as modules, so you can load
#those you'll need into the kernel.
make menuconfig
#Only do this if you want to modify any kernel options; for the CryptoAPI
#settings, i suggest going with the default ones.
make dep clean vmlinux modules
make modules_install
cp vmlinux /boot/vmlinux-2.4.20-ppc-crypto
cp System.map /boot/System.map-2.4.20-ppc-crypto

Add entry to /etc/yaboot.conf and run "ybin".

Finally, we need to update /etc/modules.conf
To do so, add a file cryptoapi to /etc/modules.d with the following content:

keep
path[cciphers]=/lib/modules/`uname -r`/kernel/crypto/ciphers
keep
path[cdigests]=/lib/modules/`uname -r`/kernel/crypto/digests
keep
path[cdrivers]=/lib/modules/`uname -r`/kernel/crypto/drivers

Run modules-update

Reboot.

Once you are booted into the CryptoAPI kernel, we can start experimenting. As 
an example, we will create a 50MB virtual volume which we will crypt with the 
serpent cipher and mount to /mnt/secret.

1) Create the virtual volume (replace /home/doctomoe by your homedir of 
course)

cd /home/doctomoe
dd if=/dev/urandom of=/home/doctomoe/secretvolume bs=1M count=50

This may take a while. We use urandom to better hide the crypted data within 
the volume. If we zeroed it, it would be easy to detect where the encrypted 
data is on the volume.

2) Mount the volume to a loop device

Make sure everything we need is loaded. If you have used the default kernel 
config, all you need to do is to modprobe the cipher you want to use.

modprobe cipher-serpent

If you compiled cryptoloop as a module (not default), make sure to load it 
too:

modprobe cryptoloop

Ok, now to the serious stuff :)

#Attach volume to a loop device
losetup -e serpent -k 256 /dev/loop0 /home/doctomoe/secretvolume

You will be asked a password. Type it carefully, as you won't be asked twice 
and the password is not stored within the volume, so if you want to mount it 
again later, you have to carefully type it again to avoid screwing the volume 
up. The argument after -e is the cipher algorithm used and the -k argument is 
the keysize generated for the encryption. It has nothing to do with the size 
of your password.

Now we create a filesystem on it.

mkfs -t ext3 /dev/loop0

Finally, we can mount it.

mount -t ext3 /dev/loop0 /mnt/secret

Voila, you can now access /mnt/secret like any other volume/directory on your 
system. Once you have stored your sensitive data and want to unmount the 
volume again, do as follows:

umount /mnt/secret
losetup -d /dev/loop0

Do remount again, you do exactly like above, but you don't format the volume 
again of course. If you typed in the wrong password, mount will give you a 
bad filesystem error. Just detach (losetup -d) the loop device and try again.


Tips and tricks:

You can add a line to /etc/fstab which will allow you to mount the volume with 
a single command and also as normal user (no need to be root then):

The line should look like:

/home/doctomoe/secretvolume     /mnt/secret  ext3 
user,defaults,noauto,loop,encryption=serpent,keybits=256   0 0

All on one single line of course.

Once you added the line, you can attach and mount the drive by simply doing:

mount /mnt/secret
#enter password

and unmount and detach it with:

umount /mnt/secret

Finally, you can also write a script that will ask you twice for the password 
and then mount the volume. That way, you will be less prone to enter a wrong 
password. Example:

#!/bin/bash

echo "Mounting crypted volume to /mnt/secret..."

if cat /etc/mtab | grep "/mnt/secret" >/dev/null
	then
		echo "Volume already mounted..."
		exit
	else
	until [ "$PASS1" = "$PASS2" -a -n "$PASS1" ]; do
        	# the bash read buitlin has to support the -s option.
        	# Don't use read without -s!!
        	read -s -p "Enter Passphrase: " PASS1; echo
        	read -s -p "Re-enter Passphrase: " PASS2; echo
done

echo "$PASS1" | mount -p 0 "/mnt/secret"

cd /mnt/secret

fi


That's it for now folks. I hope I didn't forget anything. If you want to 
report about your success or failure or have any questions about using the 
kernel, feel free to mail me (see email addy below)

Greetings,
Olivier Reisch aka DocTomoe

- -- 
________________________________________________
Olivier Reisch                                 doctomoe@g.o
Gentoo PPC Developer
http://www.gentoo.org

For safe mail, get my PGP Key:
http://perso.wanadoo.fr/olivier.reisch/oreisch_public_key.gpg
________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+P6XAXrXcgVpifr0RAtv8AJ9pJ5t84f7g3faAMveFDwKiZLKcsQCdFdMw
xKrqM8+s0RS2uJ/mk+lbQwE=
=CodP
-----END PGP SIGNATURE-----


--
gentoo-ppc-user@g.o mailing list