cb730894ae
There are a number of different algorithms that can be used to generate initialization vectors for disk encryption. This introduces a simple internal QCryptoBlockIV object to provide a consistent internal API to the different algorithms. The initially implemented algorithms are 'plain', 'plain64' and 'essiv', each matching the same named algorithm provided by the Linux kernel dm-crypt driver. Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Fam Zheng <famz@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
100 lines
2.5 KiB
Python
100 lines
2.5 KiB
Python
# -*- Mode: Python -*-
|
|
#
|
|
# QAPI crypto definitions
|
|
|
|
##
|
|
# QCryptoTLSCredsEndpoint:
|
|
#
|
|
# The type of network endpoint that will be using the credentials.
|
|
# Most types of credential require different setup / structures
|
|
# depending on whether they will be used in a server versus a
|
|
# client.
|
|
#
|
|
# @client: the network endpoint is acting as the client
|
|
#
|
|
# @server: the network endpoint is acting as the server
|
|
#
|
|
# Since: 2.5
|
|
##
|
|
{ 'enum': 'QCryptoTLSCredsEndpoint',
|
|
'prefix': 'QCRYPTO_TLS_CREDS_ENDPOINT',
|
|
'data': ['client', 'server']}
|
|
|
|
|
|
##
|
|
# QCryptoSecretFormat:
|
|
#
|
|
# The data format that the secret is provided in
|
|
#
|
|
# @raw: raw bytes. When encoded in JSON only valid UTF-8 sequences can be used
|
|
# @base64: arbitrary base64 encoded binary data
|
|
# Since: 2.6
|
|
##
|
|
{ 'enum': 'QCryptoSecretFormat',
|
|
'prefix': 'QCRYPTO_SECRET_FORMAT',
|
|
'data': ['raw', 'base64']}
|
|
|
|
|
|
##
|
|
# QCryptoHashAlgorithm:
|
|
#
|
|
# The supported algorithms for computing content digests
|
|
#
|
|
# @md5: MD5. Should not be used in any new code, legacy compat only
|
|
# @sha1: SHA-1. Should not be used in any new code, legacy compat only
|
|
# @sha256: SHA-256. Current recommended strong hash.
|
|
# Since: 2.6
|
|
##
|
|
{ 'enum': 'QCryptoHashAlgorithm',
|
|
'prefix': 'QCRYPTO_HASH_ALG',
|
|
'data': ['md5', 'sha1', 'sha256']}
|
|
|
|
|
|
##
|
|
# QCryptoCipherAlgorithm:
|
|
#
|
|
# The supported algorithms for content encryption ciphers
|
|
#
|
|
# @aes-128: AES with 128 bit / 16 byte keys
|
|
# @aes-192: AES with 192 bit / 24 byte keys
|
|
# @aes-256: AES with 256 bit / 32 byte keys
|
|
# @des-rfb: RFB specific variant of single DES. Do not use except in VNC.
|
|
# Since: 2.6
|
|
##
|
|
{ 'enum': 'QCryptoCipherAlgorithm',
|
|
'prefix': 'QCRYPTO_CIPHER_ALG',
|
|
'data': ['aes-128', 'aes-192', 'aes-256', 'des-rfb']}
|
|
|
|
|
|
##
|
|
# QCryptoCipherMode:
|
|
#
|
|
# The supported modes for content encryption ciphers
|
|
#
|
|
# @ecb: Electronic Code Book
|
|
# @cbc: Cipher Block Chaining
|
|
# Since: 2.6
|
|
##
|
|
{ 'enum': 'QCryptoCipherMode',
|
|
'prefix': 'QCRYPTO_CIPHER_MODE',
|
|
'data': ['ecb', 'cbc']}
|
|
|
|
|
|
##
|
|
# QCryptoIVGenAlgorithm:
|
|
#
|
|
# The supported algorithms for generating initialization
|
|
# vectors for full disk encryption. The 'plain' generator
|
|
# should not be used for disks with sector numbers larger
|
|
# than 2^32, except where compatibility with pre-existing
|
|
# Linux dm-crypt volumes is required.
|
|
#
|
|
# @plain: 64-bit sector number truncated to 32-bits
|
|
# @plain64: 64-bit sector number
|
|
# @essiv: 64-bit sector number encrypted with a hash of the encryption key
|
|
# Since: 2.6
|
|
##
|
|
{ 'enum': 'QCryptoIVGenAlgorithm',
|
|
'prefix': 'QCRYPTO_IVGEN_ALG',
|
|
'data': ['plain', 'plain64', 'essiv']}
|