diff options
| author | ebiggers <ebiggers@google.com> | 2020-01-22 18:28:23 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-01-22 18:28:23 -0800 |
| commit | 059482129c5fdafebc582887a4ae4ef80988b708 (patch) | |
| tree | 8ec373c41a677ff6949148b56f4aeaafe22791a6 /metadata/constants.go | |
| parent | 80654f23ebfd552277ed217a2c5e1d0bb1374189 (diff) | |
| parent | fe2939cc7e50f4c6025253efdf7380c04fac9ae1 (diff) | |
Merge pull request #148 from ebiggers/fscrypt-key-mgmt-improvements
Filesystem keyring and v2 encryption policy support
Diffstat (limited to 'metadata/constants.go')
| -rw-r--r-- | metadata/constants.go | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/metadata/constants.go b/metadata/constants.go index 8855ae3..fa6b8a7 100644 --- a/metadata/constants.go +++ b/metadata/constants.go @@ -27,8 +27,12 @@ import ( // Lengths for our keys, buffers, and strings used in fscrypt. const ( - // DescriptorLen is the length of all Protector and Policy descriptors. - DescriptorLen = 2 * unix.FSCRYPT_KEY_DESCRIPTOR_SIZE + // Length of policy descriptor (in hex chars) for v1 encryption policies + PolicyDescriptorLenV1 = 2 * unix.FSCRYPT_KEY_DESCRIPTOR_SIZE + // Length of protector descriptor (in hex chars) + ProtectorDescriptorLen = PolicyDescriptorLenV1 + // Length of policy descriptor (in hex chars) for v2 encryption policies + PolicyDescriptorLenV2 = 2 * unix.FSCRYPT_KEY_IDENTIFIER_SIZE // We always use 256-bit keys internally (compared to 512-bit policy keys). InternalKeyLen = 32 IVLen = 16 @@ -40,11 +44,13 @@ const ( ) var ( - // DefaultOptions use the supported encryption modes and max padding. + // DefaultOptions use the supported encryption modes, max padding, and + // policy version 1. DefaultOptions = &EncryptionOptions{ - Padding: 32, - Contents: EncryptionOptions_AES_256_XTS, - Filenames: EncryptionOptions_AES_256_CTS, + Padding: 32, + Contents: EncryptionOptions_AES_256_XTS, + Filenames: EncryptionOptions_AES_256_CTS, + PolicyVersion: 1, } // DefaultSource is the source we use if none is specified. DefaultSource = SourceType_custom_passphrase |