From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41642) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bjl5r-0007q4-0L for qemu-devel@nongnu.org; Tue, 13 Sep 2016 06:37:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bjl5m-0006fy-9Q for qemu-devel@nongnu.org; Tue, 13 Sep 2016 06:37:33 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60134) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bjl5m-0006fp-1N for qemu-devel@nongnu.org; Tue, 13 Sep 2016 06:37:30 -0400 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 9EE9783F45 for ; Tue, 13 Sep 2016 10:37:29 +0000 (UTC) Date: Tue, 13 Sep 2016 11:37:26 +0100 From: "Daniel P. Berrange" Message-ID: <20160913103726.GR30949@redhat.com> Reply-To: "Daniel P. Berrange" References: <1473689623-28870-1-git-send-email-berrange@redhat.com> <1473689623-28870-3-git-send-email-berrange@redhat.com> <3f137923-4dba-9e25-6b56-863c0f7e1cf0@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <3f137923-4dba-9e25-6b56-863c0f7e1cf0@redhat.com> Subject: Re: [Qemu-devel] [PATCH v2 2/7] crypto: make PBKDF iterations configurable for LUKS format List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: qemu-devel@nongnu.org On Mon, Sep 12, 2016 at 10:38:25AM -0500, Eric Blake wrote: > On 09/12/2016 09:13 AM, Daniel P. Berrange wrote: > > As protection against bruteforcing passphrases, the PBKDF > > algorithm is tuned by counting the number of iterations > > needed to produce 1 second of running time. If the machine > > that the image will be used on is much faster than the > > machine where the image is created, it can be desirable > > to raise the number of iterations. This change adds a new > > 'iter-time' property that allows the user to choose the > > iteration wallclock time. > > > > Signed-off-by: Daniel P. Berrange > > --- > > > @@ -183,6 +184,11 @@ static QemuOptsList block_crypto_create_opts_luks = { > > .type = QEMU_OPT_STRING, > > .help = "Name of encryption hash algorithm", > > }, > > + { > > + .name = BLOCK_CRYPTO_OPT_LUKS_ITER_TIME, > > + .type = QEMU_OPT_NUMBER, > > + .help = "Time to spend in PBKDF in milliseconds", > > Worth mentioning the default of 1000? I tried to keep all the defaults listed just in the QAPI schema, to avoid remembering to update multiple docs. > > @@ -1075,6 +1078,16 @@ qcrypto_block_luks_create(QCryptoBlock *block, > > goto error; > > } > > > > + if (iters > (ULLONG_MAX / luks_opts.iter_time)) { > > + error_setg_errno(errp, ERANGE, > > + "PBKDF iterations %llu too large to scale", > > + (unsigned long long)iters); > > As in 1/7, you seem to prefer casts over PRIu64 :) > > > +++ b/qapi/crypto.json > > @@ -185,6 +185,9 @@ > > # Currently defaults to 'sha256' > > # @hash-alg: #optional the master key hash algorithm > > # Currently defaults to 'sha256' > > +# @iter-time: #optional number of milliseconds to spend in > > +# PBKDF passphrase processing. Currently defaults > > +# to 1000. (since 2.8) > > Ah, you mentioned the default here. > > Reviewed-by: Eric Blake > > -- > Eric Blake eblake redhat com +1-919-301-3266 > Libvirt virtualization library http://libvirt.org > Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|