From nobody Tue May 07 07:40:39 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4VYVYz2xskz5KG4X; Tue, 07 May 2024 07:40:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4VYVYz2bxFz4MT0; Tue, 7 May 2024 07:40:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1715067639; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dlJ3SxRTknPQcK1L3LdPj1Q+gB0gL6Tu1bm+7RKw87c=; b=Avko6ukAbzNtoHgGjJxCKBRgWKlAkskKzSkjwoSAtSPwdLDyz8MIUTgTpHSn39pYJ+aHiS PCd8NEoAEYGuPA23zlQLqL9HcZTrUQDQk0Fxb9K/wFZZlTOiqucvU3j7QUq1MdyPlmob57 Nr6ORCY1dc5oSjWL7QpuG/oGHh8kocEQDvjsJ2/Voe8zTeTPXHvtxwInwIrxZmZ+j5ph+7 vgKnQZvU6il6UHLA9xuWmiWGlKN/7p5slg9Q4gp6s4pNEh8J5Oqs/qtvKMkjbA6xDFUKmw cjlVQZZxs5iV+1WFe2OPZ2SC+lC5BjY196kASBslieUjeI3KdSmPltOkXNcDmA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1715067639; a=rsa-sha256; cv=none; b=Ig4CYNUvG40hxrigbcT3Mn4PqWnfdWWoRE4PcuCdhmuhpVKUnMwhV2ll8Qb0mxhNbrGHd8 gUxOrrcH/sqlnYQkev3ACfRlQKe/Vm1NFWRLFrhdgSW4hlBZzZxwy3bzeJEurvbMEdRLpY G2hGrJLkFOAykZpB3VxKwvfO6C083e3AzymnBLe7nt09PaITvhRDzSSQlB082nC8+qb/tQ gMFgNRgdHmOvyIqKNnYy73SUzetGuhdFMKfa6U+XSXHbW1bJ4aMGkTxzcU9HLVL061M0qp wziMimHZ2XaGnQ7uulvVyKbABcDgiV18lBol+9OlQMj1P2oZDla23xNtLZix6g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1715067639; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dlJ3SxRTknPQcK1L3LdPj1Q+gB0gL6Tu1bm+7RKw87c=; b=UCgdB2hAcsbnutlGWnA6ZyMxb3ducWP3RA/DvjK4+V+d4O43qqZ9ZqEmlTtbfUyiVpIFjI bi5h21FCUeNer7Lh9eGWEOS1CwWfnYLw/D6OCkPNvbvFiIBRomJ7495uVfXVEbP63rdlGE CnrTTqslWDALEYpbZvGERp4vxOssaG00femByGvXRayCiACL6thpwclWP6J8Gtcg8sJ9Wk NmzzowQ8CAODgtSdGhI1Auy+HZLAHDF5q4y+OqrQ28zIkq0McCzOuqRQT5Z7GiWfeyf7LO 4eeMr8mVzDMwvVqgqvOULXsA4wu7XgJ/WlArbmQfu1Jt1u6FXFSoM5T6GwKH5Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4VYVYz2CyfzYMb; Tue, 7 May 2024 07:40:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 4477edRq094678; Tue, 7 May 2024 07:40:39 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 4477eddE094676; Tue, 7 May 2024 07:40:39 GMT (envelope-from git) Date: Tue, 7 May 2024 07:40:39 GMT Message-Id: <202405070740.4477eddE094676@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Poul-Henning Kamp Subject: git: eef9887871fd - main - Remove gbde.4 man page List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: phk X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: eef9887871fdf7669564ead73d95bdcfa6cbe228 Auto-Submitted: auto-generated The branch main has been updated by phk: URL: https://cgit.FreeBSD.org/src/commit/?id=eef9887871fdf7669564ead73d95bdcfa6cbe228 commit eef9887871fdf7669564ead73d95bdcfa6cbe228 Author: Poul-Henning Kamp AuthorDate: 2024-05-07 07:21:28 +0000 Commit: Poul-Henning Kamp CommitDate: 2024-05-07 07:21:28 +0000 Remove gbde.4 man page --- share/man/man4/Makefile | 1 - share/man/man4/gbde.4 | 302 ------------------------------------------------ 2 files changed, 303 deletions(-) diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile index 5503637611bd..595da069f73c 100644 --- a/share/man/man4/Makefile +++ b/share/man/man4/Makefile @@ -163,7 +163,6 @@ MAN= aac.4 \ fwip.4 \ fwohci.4 \ fxp.4 \ - gbde.4 \ gdb.4 \ gem.4 \ genet.4 \ diff --git a/share/man/man4/gbde.4 b/share/man/man4/gbde.4 deleted file mode 100644 index 79acfbe81444..000000000000 --- a/share/man/man4/gbde.4 +++ /dev/null @@ -1,302 +0,0 @@ -.\" -.\" Copyright (c) 2002 Poul-Henning Kamp -.\" Copyright (c) 2002 Networks Associates Technology, Inc. -.\" All rights reserved. -.\" -.\" This software was developed for the FreeBSD Project by Poul-Henning Kamp -.\" and NAI Labs, the Security Research Division of Network Associates, Inc. -.\" under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the -.\" DARPA CHATS research program. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND -.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE -.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -.\" SUCH DAMAGE. -.\" -.Dd October 19, 2002 -.Dt GBDE 4 -.Os -.Sh NAME -.Nm gbde -.Nd Geom Based Disk Encryption -.Sh SYNOPSIS -.Cd "options GEOM_BDE" -.Sh DESCRIPTION -.Bf -symbolic -NOTICE: -Please be aware that this code has not yet received much review -and analysis by qualified cryptographers and therefore should be considered -a slightly suspect experimental facility. -.Pp -We cannot at this point guarantee that the on-disk format will not change -in response to reviews or bug-fixes, so potential users are advised to -be prepared that -.Xr dump 8 Ns / Ns Xr restore 8 -based migrations may be called for in the future. -.Ef -.Pp -The objective of this facility is to provide a high degree of -denial of access to the contents of a -.Dq cold -storage device. -.Pp -Be aware that if the computer is compromised while up and running -.Em and -the storage device is actively attached and opened with a valid -pass-phrase, this facility offers no protection or denial of access -to the contents of the storage device. -.Pp -If, on the other hand, the device is -.Dq cold , -it should present a formidable -challenge for an attacker to gain access to the contents in the absence of -a valid pass-phrase. -.Pp -Four cryptographic barriers must be passed to gain access to the data, -and only a valid pass-phrase will yield this access. -.Pp -When the pass-phrase is entered, it is hashed with SHA2 into a 512 bit -.Dq key-material . -This is a way of producing cryptographic usable keys from a typically -.No all- Ns Tn ASCII -pass-phrase of an unpredictable user-selected length. -.Ss First barrier: the location of the \&"lock-sector". -During initialization, up to four independent but mutually aware -.Dq lock -sectors are written to the device in randomly chosen -locations. -These lock-sectors contain the 2048 random bit master-key and a number -of parameters of the layout geometry (more on this later). -Since the entire device will contain isotropic data, there is no -short-cut to rapidly determine which sequence of bytes contain a lock-sector. -.Pp -To locate a lock-sector, a small piece of data called the -.Dq metadata -and the key-material must be available. -The key-material decrypts the -metadata, which contains the byte offset on the device where the -corresponding lock-sector is located. -If the metadata is lost or unavailable but the key-material is at -hand, it would be feasible to do a brute force scan where each byte offset -of the device is checked to see if it contains the lock-sector data. -.Ss Second barrier: decryption of the master-key using key-material. -The lock-sector contains an encrypted copy of an architecture neutral -byte-sequence which encodes the fields of the lock-structure. -The order in which these fields are encoded is determined from the key-material. -The encoded byte stream is encrypted with 256bit AES in CBC mode. -.Ss Third barrier: decryption of the sector key. -For each sector, an MD5 hash over a -.Dq salt -from the lock-sector and the sector number is used to -.Dq cherry-pick -a subset of the master key, -which hashed together with the sector offset through MD5 produces the -.Dq kkey , -the key which encrypts the sector key. -.Ss Fourth barrier: decryption of the sector data. -The actual payload of the sector is encrypted with 128 bit AES in CBC mode -using a single-use random bits key. -.Ss Examining the reverse path -Assuming an attacker knows an amount of plaintext and has managed to -locate the corresponding encrypted sectors on the device, gaining access -to the plaintext context of other sectors is a daunting task: -.Pp -First he will have to derive from the encrypted sector and the known plain -text the sector key(s) used. -At the time of writing, it has been speculated that it could maybe be -possible to break open AES in only 2^80 operations; even so, that is still -a very impossible task. -.Pp -Armed with one or more sector keys, our patient attacker will then go -through essentially the same exercise, using the sector key and the -encrypted sector key to find the key used to encrypt the sector key. -.Pp -Armed with one or more of these -.Dq kkeys , -our attacker has to -run them backwards through MD5. -Even though he knows that the input to MD5 was 24 bytes and has the value -of 8 of these bytes from the sector number, he is still faced with 2^128 -equally likely possibilities. -.Pp -Having successfully done that, our attacker has successfully discovered -up to 16 bytes of the master-key, but is still unaware which 16 bytes, -and in which other sectors any of these known bytes contribute to the kkey. -.Pp -To unravel the last bit, the attacker has to guess the 16 byte random-bits -salt stored in the lock-sector to recover the indexes into the masterkey. -.Pp -Any attacker with access to the necessary machine power to even attempt -this attack will be better off attempting to brute-force the pass-phrase. -.Ss Positive denial facilities -Considering the infeasibility of the above attack, -gaining access to the pass-phrase will be of paramount importance for an -attacker, -and a number of scenarios can be imagined where undue pressure will be -applied to an individual to divulge the pass-phrase. -.Pp -A -.Dq Blackening -feature provides a way for the user, given a moment of -opportunity, to destroy the master-key in such a way that the pass-phrase -will be acknowledged as good but access to the data will still be -denied. -.Ss A practical analogy -For persons who think cryptography is only slightly more interesting than -watching silicon sublimate the author humbly offers this analogy to the -keying scheme for a protected device: -.Pp -Imagine an installation with a vault with walls of several hundred meters -thick solid steel. -This vault can only be feasibly accessed using the -single key, which has a complexity comparable to a number with 600 digits. -.Pp -This key exists in four copies, each of which is stored in one of -four small safes, each of which can be opened -with unique key which has a complexity comparable to an 80 digit -number. -.Pp -In addition to the masterkey, each of the four safes also contains -the exact locations of all four key-safes which are located in -randomly chosen places on the outside surface of the vault where they -are practically impossible to detect when they are closed. -.Pp -Finally, each safe contains four switches which are wired to a bar -of dynamite inside each of the four safes. -.Pp -In addition to this, a keyholder after opening his key-safe is -also able to install a copy of the master-key and re-key any of -key-safes (including his own). -.Pp -In normal use, the user will open the safe for which he has the key, -take out the master-key and access the vault. -When done, he will lock up the master-key in the safe again. -.Pp -If a keyholder-X for some reason distrusts keyholder-Y, she -has the option of opening her own safe, flipping one of the switches -and detonating the bar of dynamite in safe-Y. -This will obliterate the master-key in that safe and thereby deny -keyholder-Y access to the vault. -.Pp -Should the facility come under attack, any of the keyholders can detonate -all four bars of dynamite and thereby make sure that access to the -vault is denied to everybody, keyholders and attackers alike. -Should the facility fall to the enemy, and a keyholder be forced to apply -his personal key, he can do so in confidence that the contents of his safe -will not yield access to the vault, and the enemy will hopefully realize -that applying further pressure on the personnel will not give access to -the vault. -.Pp -The final point to make here is that it is perfectly possible to -make a detached copy of any one of these keys, including the master -key, and deposit or hide it as one sees fit. -.Ss Steganography support -When the device is initialized, it is possible to restrict the encrypted -data to a single contiguous area of the device. -If configured with care, this area could masquerade as some sort of -valid data or as random trash left behind by the systems operation. -.Pp -This can be used to offer a plausible deniability of existence, where -it will be impossible to prove that this specific area of the device -is in fact used to store encrypted data and not just random junk. -.Pp -The main obstacle in this is that the output from any encryption algorithm -worth its salt is so totally random looking that it stands out like a sore -thumb amongst practically any other sort of data which contains at least -some kind of structure or identifying byte sequences. -.Pp -Certain file formats like ELF contain multiple distinct sections, and it -would be possible to locate things just right in such a way that a device -contains a partition with a file system with a large executable, -.Pq Dq "a backup copy of my kernel" -where a non-loaded ELF section is laid out -consecutively on the device and thereby could be used to contain a -.Nm -encrypted device. -.Pp -Apart from the ability to instruct -.Nm -which those sectors are, no support is provided for creating such a setup. -.Ss Deployment suggestions -For personal use, it may be wise to make a backup copy of the masterkey -or use one of the four keys as a backup. -Fitting protection of this key is up to yourself, your local circumstances and -your imagination. -.Pp -For company or institutional use, it is strongly advised to make a copy -of the master-key and put it under whatever protection you have at your -means. -If you fail to do this, a disgruntled employee can deny you access to -the data -.Dq "by accident" . -(The employee can still intentionally deny access by applying another -encryption scheme to the data, but that problem has no technical solution.) -.Ss Cryptographic strength -This section lists the specific components which contribute to the cryptographic -strength of -.Nm . -.Pp -The payload is encrypted with AES in CBC mode using a 128 bit random -single-use key -.Pq Dq "the skey" . -AES is well documented. -.Pp -No IV is used in the encryption of the sectors, the assumption being -that since the key is random bits and single-use, an IV adds nothing to the -security of AES. -.Pp -The random key is produced with -.Xr arc4rand 9 -which is believed to do a respectable job at producing unpredictable bytes. -.Pp -The skey is stored on the device in a location which can be derived from -the location of the encrypted payload data. -The stored copy is encrypted with AES in CBC mode using a 128 bit key -.Pq Dq "the kkey" -derived -from a subset of the master key chosen by the output of an MD5 hash -over a 16 byte random bit static salt and the sector offset. -Up to 6.25% of the masterkey (16 bytes out of 2048 bits) will be selected -and hashed through MD5 with the sector offset to generate the kkey. -.Pp -Up to four copies of the master-key and associated geometry information -is stored on the device in static randomly chosen sectors. -The exact location inside the sector is randomly chosen. -The order in which the fields are encoded depends on the key-material. -The encoded byte-stream is encrypted with AES in CBC mode using 256 bit -key-material. -.Pp -The key-material is derived from the user-entered pass-phrase using -512 bit SHA2. -.Pp -No chain is stronger than its weakest link, which usually is poor pass-phrases. -.Sh SEE ALSO -.Xr gbde 8 -.Sh HISTORY -This software was developed for the -.Fx -Project by -.An Poul-Henning Kamp -and NAI Labs, the Security Research Division of Network Associates, Inc.\& -under DARPA/SPAWAR contract N66001-01-C-8035 -.Pq Dq CBOSS , -as part of the -DARPA CHATS research program. -.Sh AUTHORS -.An Poul-Henning Kamp Aq Mt phk@FreeBSD.org