| /OK3568_Linux_fs/kernel/Documentation/filesystems/ |
| H A D | fscrypt.rst | 2 Filesystem-level encryption (fscrypt)
9 transparent encryption of files and directories.
15 use encryption, see the documentation for the userspace tool `fscrypt
20 <https://source.android.com/security/encryption/file-based>`_, over
56 Provided that userspace chooses a strong encryption key, fscrypt
72 fscrypt (and storage encryption in general) can only provide limited
89 After an encryption key has been added, fscrypt does not hide the
97 encryption but rather only by the correctness of the kernel.
98 Therefore, any encryption-specific access control checks would merely
107 security vulnerability, can compromise all encryption keys that are
[all …]
|
| /OK3568_Linux_fs/kernel/Documentation/block/ |
| H A D | inline-encryption.rst | 4 Inline Encryption
10 Inline encryption hardware sits logically between memory and the disk, and can
11 en/decrypt data as it goes in/out of the disk. Inline encryption hardware has a
12 fixed number of "keyslots" - slots into which encryption contexts (i.e. the
13 encryption key, encryption algorithm, data unit size) can be programmed by the
15 of a keyslot (and also a data unit number to act as an encryption tweak), and
16 the inline encryption hardware will en/decrypt the data in the request with the
17 encryption context programmed into that keyslot. This is very different from
18 full disk encryption solutions like self encrypting drives/TCG OPAL/ATA
19 Security standards, since with inline encryption, any block on disk could be
[all …]
|
| /OK3568_Linux_fs/kernel/Documentation/x86/ |
| H A D | amd-memory-encryption.rst | 4 AMD Memory Encryption
7 Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV) are
23 A page is encrypted when a page table entry has the encryption bit set (see
24 below on how to determine its position). The encryption bit can also be
26 successive level of page tables can also be encrypted by setting the encryption
29 encryption bit is set in cr3, doesn't imply the full hierarchy is encrypted.
30 Each page table entry in the hierarchy needs to have the encryption bit set to
31 achieve that. So, theoretically, you could have the encryption bit set in cr3
32 so that the PGD is encrypted, but not set the encryption bit in the PGD entry
38 memory. Since the memory encryption bit is controlled by the guest OS when it
[all …]
|
| /OK3568_Linux_fs/kernel/include/linux/ |
| H A D | cc_platform.h | 24 * @CC_ATTR_MEM_ENCRYPT: Memory encryption is active
26 * The platform/OS is running with active memory encryption. This
28 * and actively using memory encryption or as a guest/virtual machine
29 * and actively using memory encryption.
36 * @CC_ATTR_HOST_MEM_ENCRYPT: Host memory encryption is active
39 * and actively using memory encryption.
46 * @CC_ATTR_GUEST_MEM_ENCRYPT: Guest memory encryption is active
49 * using memory encryption.
56 * @CC_ATTR_GUEST_STATE_ENCRYPT: Guest state encryption is active
59 * using memory encryption and register state encryption.
|
| H A D | fscrypt.h | 3 * fscrypt.h: declarations for per-file encryption
5 * Filesystems that implement per-file encryption must include this header
95 * contents encryption
111 * as a result of the encryption key being added, DCACHE_NOKEY_NAME must be
127 * encryption key added yet. Such dentries may be either positive or negative.
136 * encryption key, but just checking for the key on the directory inode during
484 /* Encryption support disabled; use standard comparison */ in fscrypt_match_name()
690 * encryption
693 * Return: true if the inode requires file contents encryption and if the
694 * encryption should be done in the block layer via blk-crypto rather
[all …]
|
| H A D | blk-crypto.h | 23 * struct blk_crypto_config - an inline encryption key's crypto configuration
24 * @crypto_mode: encryption algorithm this key is for
25 * @data_unit_size: the data unit size for all encryption/decryptions with this
31 * encryption hardware that accepts wrapped keys.
41 * struct blk_crypto_key - an inline encryption key
63 * struct bio_crypt_ctx - an inline encryption context
127 * bio_crypt_clone - clone bio encryption context
132 * If @src has an encryption context, clone it to @dst.
|
| /OK3568_Linux_fs/external/security/rk_tee_user/v2/export-ta_arm64/include/mbedtls/ |
| H A D | aes.h | 7 * The Advanced Encryption Standard (AES) specifies a FIPS-approved
13 * <em>FIPS Publication 197: Advanced Encryption Standard</em> and
15 * techniques -- Encryption algorithms -- Part 2: Asymmetric
54 #define MBEDTLS_AES_ENCRYPT 1 /**< AES encryption. */
108 encryption or decryption. */
159 * \brief This function sets the encryption key.
163 * \param key The encryption key.
196 * \brief This function prepares an XTS context for encryption and
197 * sets the encryption key.
201 * \param key The encryption key. This is comprised of the XTS key1
[all …]
|
| H A D | aria.h | 44 #define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */
108 * \brief This function sets the encryption key.
112 * \param key The encryption key. This must be a readable buffer
146 * \brief This function performs an ARIA single-block encryption or
149 * It performs encryption or decryption (depending on whether
150 * the key was set for encryption on decryption) on the input
157 * \param ctx The ARIA context to use for encryption or decryption.
171 * \brief This function performs an ARIA-CBC encryption or decryption operation
194 * \param ctx The ARIA context to use for encryption or decryption.
197 * #MBEDTLS_ARIA_ENCRYPT for encryption, or
[all …]
|
| /OK3568_Linux_fs/external/security/rk_tee_user/v2/export-ta_arm32/host_include/mbedtls/ |
| H A D | aes.h | 7 * The Advanced Encryption Standard (AES) specifies a FIPS-approved
13 * <em>FIPS Publication 197: Advanced Encryption Standard</em> and
15 * techniques -- Encryption algorithms -- Part 2: Asymmetric
54 #define MBEDTLS_AES_ENCRYPT 1 /**< AES encryption. */
108 encryption or decryption. */
159 * \brief This function sets the encryption key.
163 * \param key The encryption key.
196 * \brief This function prepares an XTS context for encryption and
197 * sets the encryption key.
201 * \param key The encryption key. This is comprised of the XTS key1
[all …]
|
| H A D | aria.h | 44 #define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */
108 * \brief This function sets the encryption key.
112 * \param key The encryption key. This must be a readable buffer
146 * \brief This function performs an ARIA single-block encryption or
149 * It performs encryption or decryption (depending on whether
150 * the key was set for encryption on decryption) on the input
157 * \param ctx The ARIA context to use for encryption or decryption.
171 * \brief This function performs an ARIA-CBC encryption or decryption operation
194 * \param ctx The ARIA context to use for encryption or decryption.
197 * #MBEDTLS_ARIA_ENCRYPT for encryption, or
[all …]
|
| /OK3568_Linux_fs/external/security/rk_tee_user/v2/export-ta_arm32/include/mbedtls/ |
| H A D | aes.h | 7 * The Advanced Encryption Standard (AES) specifies a FIPS-approved
13 * <em>FIPS Publication 197: Advanced Encryption Standard</em> and
15 * techniques -- Encryption algorithms -- Part 2: Asymmetric
54 #define MBEDTLS_AES_ENCRYPT 1 /**< AES encryption. */
108 encryption or decryption. */
159 * \brief This function sets the encryption key.
163 * \param key The encryption key.
196 * \brief This function prepares an XTS context for encryption and
197 * sets the encryption key.
201 * \param key The encryption key. This is comprised of the XTS key1
[all …]
|
| H A D | aria.h | 44 #define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */
108 * \brief This function sets the encryption key.
112 * \param key The encryption key. This must be a readable buffer
146 * \brief This function performs an ARIA single-block encryption or
149 * It performs encryption or decryption (depending on whether
150 * the key was set for encryption on decryption) on the input
157 * \param ctx The ARIA context to use for encryption or decryption.
171 * \brief This function performs an ARIA-CBC encryption or decryption operation
194 * \param ctx The ARIA context to use for encryption or decryption.
197 * #MBEDTLS_ARIA_ENCRYPT for encryption, or
[all …]
|
| /OK3568_Linux_fs/external/security/rk_tee_user/v2/export-ta_arm64/host_include/mbedtls/ |
| H A D | aes.h | 7 * The Advanced Encryption Standard (AES) specifies a FIPS-approved
13 * <em>FIPS Publication 197: Advanced Encryption Standard</em> and
15 * techniques -- Encryption algorithms -- Part 2: Asymmetric
54 #define MBEDTLS_AES_ENCRYPT 1 /**< AES encryption. */
108 encryption or decryption. */
159 * \brief This function sets the encryption key.
163 * \param key The encryption key.
196 * \brief This function prepares an XTS context for encryption and
197 * sets the encryption key.
201 * \param key The encryption key. This is comprised of the XTS key1
[all …]
|
| H A D | aria.h | 44 #define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */
108 * \brief This function sets the encryption key.
112 * \param key The encryption key. This must be a readable buffer
146 * \brief This function performs an ARIA single-block encryption or
149 * It performs encryption or decryption (depending on whether
150 * the key was set for encryption on decryption) on the input
157 * \param ctx The ARIA context to use for encryption or decryption.
171 * \brief This function performs an ARIA-CBC encryption or decryption operation
194 * \param ctx The ARIA context to use for encryption or decryption.
197 * #MBEDTLS_ARIA_ENCRYPT for encryption, or
[all …]
|
| /OK3568_Linux_fs/kernel/arch/x86/mm/ |
| H A D | mem_encrypt_boot.S | 3 * AMD Memory Encryption Support
26 * RCX - virtual address of the encryption workarea, including:
28 * - encryption routine page (PAGE_SIZE)
30 * R8 - physcial address of the pagetables to use for encryption
39 addq $PAGE_SIZE, %rax /* Workarea encryption routine */
46 /* Copy encryption routine into the workarea */
47 movq %rax, %rdi /* Workarea encryption routine */
48 leaq __enc_copy(%rip), %rsi /* Encryption routine */
49 movq $(.L__enc_copy_end - __enc_copy), %rcx /* Encryption routine length */
55 movq %r8, %rdx /* Pagetables used for encryption */
[all …]
|
| /OK3568_Linux_fs/kernel/Documentation/admin-guide/device-mapper/ |
| H A D | dm-crypt.rst | 5 Device-Mapper's "crypt" target provides transparent encryption of block devices
17 Encryption cipher, encryption mode and Initial Vector (IV) generator.
52 Key used for encryption. It is encoded either as a hexadecimal number
66 The encryption key size in bytes. The kernel key payload size must match
112 Perform encryption using the same cpu that IO was submitted on.
113 The default is to use an unbound workqueue so that encryption work
117 Disable offloading writes to a separate thread after encryption.
119 encryption threads to a single thread degrades performance
139 For Authenticated Encryption with Additional Data (AEAD)
145 Use <bytes> as the encryption unit instead of 512 bytes sectors.
[all …]
|
| /OK3568_Linux_fs/kernel/fs/crypto/ |
| H A D | Kconfig | 3 bool "FS Encryption (Per-file encryption)"
10 Enable encryption of files and directories. This
16 # Filesystems supporting encryption must select this if FS_ENCRYPTION. This
20 # Note: this option only pulls in the algorithms that filesystem encryption
21 # needs "by default". If userspace will use "non-default" encryption modes such
22 # as Adiantum encryption, then those other modes need to be explicitly enabled
46 Enable fscrypt to use inline encryption hardware if available.
|
| H A D | fscrypt_private.h | 53 * fscrypt_context - the encryption context of an inode
57 * fields from the fscrypt_policy, in order to identify the encryption algorithm
126 /* Return the contents encryption mode of a valid encryption policy */
139 /* Return the filenames encryption mode of a valid encryption policy */
152 /* Return the flags (FSCRYPT_POLICY_FLAG*) of a valid encryption policy */
175 * struct fscrypt_prepared_key - a key prepared for actual encryption/decryption
189 * fscrypt_info - the "encryption key" for an inode
197 /* The key in a form prepared for actual encryption/decryption */
205 * True if this inode will use inline encryption (blk-crypto) instead of
206 * the traditional filesystem-layer encryption.
[all …]
|
| H A D | policy.c | 3 * Encryption policy functions for per-file encryption support.
20 * fscrypt_policies_equal() - check whether two encryption policies are the same
93 * IV_INO_LBLK_* with other encryption modes arises. in supported_iv_ino_lblk_policy()
136 "Unsupported encryption modes (contents %d, filenames %d)", in fscrypt_supported_v1_policy()
144 fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)", in fscrypt_supported_v1_policy()
172 "Unsupported encryption modes (contents %d, filenames %d)", in fscrypt_supported_v2_policy()
182 fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)", in fscrypt_supported_v2_policy()
191 fscrypt_warn(inode, "Mutually exclusive encryption flags (0x%02x)", in fscrypt_supported_v2_policy()
218 fscrypt_warn(inode, "Reserved bits set in encryption policy"); in fscrypt_supported_v2_policy()
226 * fscrypt_supported_policy() - check whether an encryption policy is supported
[all …]
|
| H A D | keysetup.c | 3 * Key setup facility for FS encryption support.
71 …WARN_ONCE(1, "fscrypt: filesystem tried to load encryption info for inode %lu, which is not encryp… in select_encryption_mode()
76 /* Create a symmetric cipher object for the given encryption mode and key */
124 * raw key, encryption mode, and flag indicating which encryption implementation
161 /* Given a per-file encryption key, set up the file's crypto transform object */
204 "Hardware-wrapped keys require inline encryption (-o inlinecrypt)"); in setup_per_mode_enc_key()
211 "Each hardware-wrapped key can only be used with one encryption mode"); in setup_per_mode_enc_key()
355 * DIRECT_KEY: instead of deriving per-file encryption keys, the in fscrypt_setup_v2_file_key()
359 * encryption key. This ensures that the master key is in fscrypt_setup_v2_file_key()
367 * IV_INO_LBLK_64: encryption keys are derived from (master_key, in fscrypt_setup_v2_file_key()
[all …]
|
| H A D | inline_crypt.c | 3 * Inline encryption support for fscrypt
9 * With "inline encryption", the block layer handles the decryption/encryption
11 * crypto API. See Documentation/block/inline-encryption.rst. fscrypt still
68 /* Enable inline encryption for this file if supported. */
79 /* The file must need contents encryption, not filenames encryption */ in fscrypt_select_encryption_impl()
97 * IV_INO_LBLK_32 with blocksize != PAGE_SIZE from inline encryption. in fscrypt_select_encryption_impl()
260 * encryption, then assign the appropriate encryption context to the bio.
265 * The encryption context will be freed automatically when the bio is freed.
340 * encryption (or decryption) via fscrypt, filesystems should call this function
343 * bio because either the encryption key would be different or the encryption
[all …]
|
| H A D | hooks.c | 5 * Encryption hooks for higher-level filesystem operations.
15 * Currently, an encrypted regular file can only be opened if its encryption key
17 * Therefore, we first set up the inode's encryption key (if not already done)
22 * encryption policy. This is needed as part of the enforcement that all files
23 * in an encrypted directory tree use the same encryption policy, as a
43 "Inconsistent encryption context (parent directory: %lu)", in fscrypt_file_open()
149 * if the directory uses a v2 encryption policy. in fscrypt_prepare_setflags()
190 * -ENOKEY if the encryption key is missing, or another -errno code if a problem
191 * occurred while setting up the encryption key.
202 * the encryption policy which will be inherited from the directory. in fscrypt_prepare_symlink()
[all …]
|
| /OK3568_Linux_fs/kernel/drivers/crypto/ |
| H A D | sa2ul.h | 72 #define SA_ENG_ID_EM2 3 /* Encryption/Decryption enginefor pass 2 */
113 #define SA_CTX_ENC_TYPE1_SZ 64 /* Encryption SC with Key only */
114 #define SA_CTX_ENC_TYPE2_SZ 96 /* Encryption SC with Key and Aux1 */
126 * Bit 2-3: Fetch Encryption/Air Ciphering Bytes
227 * @submode: Encryption submodes
228 * @enc_size: Size of first pass encryption size
229 * @enc_size2: Size of second pass encryption size
230 * @enc_offset: Encryption payload offset in the packet
231 * @enc_iv: Encryption initialization vector for pass2
232 * @enc_iv2: Encryption initialization vector for pass2
[all …]
|
| /OK3568_Linux_fs/kernel/Documentation/crypto/ |
| H A D | descore-readme.rst | 5 Fast & Portable DES encryption & decryption
15 des - fast & portable DES encryption & decryption.
41 1. Highest possible encryption/decryption PERFORMANCE.
62 - 30us per encryption (options: 64k tables, no IP/FP)
63 - 33us per encryption (options: 64k tables, FIPS standard bit ordering)
64 - 45us per encryption (options: 2k tables, no IP/FP)
65 - 48us per encryption (options: 2k tables, FIPS standard bit ordering)
68 this has the quickest encryption/decryption routines i've seen.
80 - 53us per encryption (uses 2k of tables)
85 encryption/decryption is still slower on the sparc and 68000.
[all …]
|
| /OK3568_Linux_fs/kernel/crypto/ |
| H A D | Kconfig | 303 published by State Encryption Management Bureau, China.
322 comment "Authenticated Encryption with Associated Data"
395 This IV generator generates an IV based on the encryption of
436 for AES encryption.
471 normally even when applied before encryption.
510 Adiantum encryption mode.
518 Adiantum encryption mode.
527 Adiantum is a tweakable, length-preserving encryption mode
528 designed for fast and secure disk encryption, especially on
538 bound. Unlike XTS, Adiantum is a true wide-block encryption
[all …]
|