package LUKS2_proto

Get desktop application:
View/edit binary Protocol Buffers messages

• required LUKS2_header primary_header = 1

• required LUKS2_header secondary_header = 2

• required seqid_description seqid = 3

• required json_area_description json_area = 4

message luks2_hdr_disk { char magic[LUKS2_MAGIC_L]; //uint16_t version; /* Version 2 */ uint64_t hdr_size; /* in bytes, including JSON area */ uint64_t seqid; /* increased on every update */ char label[LUKS2_LABEL_L]; char checksum_alg[LUKS2_CHECKSUM_ALG_L]; uint8_t salt[LUKS2_SALT_L]; /* unique for every header/offset */ char uuid[LUKS2_UUID_L]; char subsystem[LUKS2_LABEL_L]; /* owner subsystem label */ uint64_t hdr_offset; /* offset from device start in bytes */ char _padding[184]; uint8_t csum[LUKS2_CHECKSUM_L]; }

Used in: LUKS2_both_headers

• required luks_version version = 1

• required luks2_magic magic = 2

• required hdr_size hdr_size = 3

• required bool use_correct_checksum = 4

• optional uint64 selected_offset = 5

Used in: json_area_description

• required bool use_primary_hdr_size = 2

• repeated config_flag config_flags = 3

• repeated config_requirement requirements = 4

- allow-discards allows TRIM (discards) on the active device. - same-cpu-crypt compatibility performance flag for dm-crypt [3] to per- form encryption using the same CPU that originated the request. - submit-from-crypt-cpus compatibility performance flag for dm-crypt [3] to disable offloading write requests to a separate thread after encryption. - no-journal disable data journalling for dm-integrity [10]. - no-read-workqueue compatibility performance flag for dm-crypt [3] to bypass dm-crypt read workqueue and process read requests synchronously. - no-write-workqueue compatibility performance flag for dm-crypt [3] to bypass dm-crypt write workqueue and process write requests synchronously.

Used in: config_description

• CONFIG_FLAG_ALLOW_DISCARDS = 1

• CONFIG_FLAG_SAME_CPU_CRYPT = 2

• CONFIG_FLAG_SUBMIT_FROM_CRYPT_CPUS = 3

• CONFIG_FLAG_NO_JOURNAL = 4

• CONFIG_FLAG_NO_READ_WORKQUEUE = 5

• CONFIG_FLAG_NO_WRITE_WORKQUEUE = 6

Used in: config_description

• CONFIG_REQUIREMENT_OFFLINE_REENCRYPT = 1

• CONFIG_REQUIREMENT_ONLINE_REENCRYPT_V2 = 2

Used in: json_area_description

• required object_id oid = 1

• optional keyslot_kdf_type type = 2

• repeated object_id keyslots = 3

• repeated object_id segments = 4

• optional string salt = 5

• optional string digest = 6

• optional hash_algorithm hash = 7

  pbkdf2 digest fields

• optional int32 iterations = 8

Used in: digest_description, keyslot_af_description, keyslot_area_description, keyslot_kdf_description

• HASH_ALG_SHA1 = 1

• HASH_ALG_SHA256 = 2

we limit the size to 64KiB to make the fuzzing faster because the checksum needs to be calculated for the whole image

Used in: LUKS2_header

• size_16_KB = 16384

• size_32_KB = 32768

• size_64_KB = 65536

  size_128_KB = 131072; size_256_KB = 262144; size_512_KB = 524288; size_1_MB = 1048576; size_2_MB = 2097152; size_4_MB = 4194304;

Used in: LUKS2_both_headers

• optional config_description config = 1

• repeated keyslot_description keyslots = 2

• repeated digest_description digests = 3

• repeated segment_description segments = 4

• repeated token_description tokens = 5

Used in: keyslot_description

• optional keyslot_af_type type = 1

• optional int32 stripes = 2

• optional hash_algorithm hash = 3

Used in: keyslot_af_description

• KEYSLOT_AF_TYPE_LUKS1 = 1

Used in: keyslot_description

• optional keyslot_area_type type = 1

  mandatory fields

• optional string_uint64 offset = 2

• optional string_uint64 size = 3

• optional string encryption = 4

  raw type fields

• optional int32 key_size = 5

• optional hash_algorithm hash = 6

  checksum type field

• optional int32 sector_size = 7

• optional string_uint64 shift_size = 8

  datashift type fields

Used in: keyslot_area_description

• KEYSLOT_AREA_TYPE_RAW = 1

• KEYSLOT_AREA_TYPE_NONE = 2

• KEYSLOT_AREA_TYPE_JOURNAL = 3

• KEYSLOT_AREA_TYPE_CHECKSUM = 4

• KEYSLOT_AREA_TYPE_DATASHIFT = 5

Used in: json_area_description

• required object_id oid = 1

  type

• optional keyslot_type type = 2

• optional int32 key_size = 3

• optional int32 priority = 4

• optional reencrypt_keyslot_mode mode = 5

  reencrypt extension

• optional reencrypt_keyslot_direction direction = 6

• optional keyslot_area_description area = 7

  objects

• optional keyslot_kdf_description kdf = 8

• optional keyslot_af_description af = 9

Used in: keyslot_description

• optional keyslot_kdf_type type = 1

• optional string salt = 2

• optional hash_algorithm hash = 3

  pbkdf2 type

• optional int32 iterations = 4

• optional int32 time = 5

  argon2i and argon2id types

• optional int32 memory = 6

• optional int32 cpus = 7

Used in: digest_description, keyslot_kdf_description

• KEYSLOT_KDF_TYPE_PBKDF2 = 1

• KEYSLOT_KDF_TYPE_ARGON2I = 2

• KEYSLOT_KDF_TYPE_ARGON2ID = 3

Used in: keyslot_description

• KEYSLOT_TYPE_LUKS2 = 1

• KEYSLOT_TYPE_REENCRYPT = 2

• KEYSLOT_TYPE_PLACEHOLDER = 3

Used in: LUKS2_header

• INVALID = 0

• FIRST = 1

• SECOND = 2

Used in: LUKS2_header

• ONE = 1

• TWO = 2

• THREE = 3

Used in: digest_description, keyslot_description, segment_description, token_description

• oneof id

  • uint32 int_id = 1

    int_id will be mapped to range -16 to 16 (mod 33) this way iy should be easier to generate valid object cross-references

  • string string_id = 2

Used in: keyslot_description

• DIRECTION_FORWARD = 1

• DIRECTION_BACKWARD = 2

Used in: keyslot_description

• MODE_REENCRYPT = 1

• MODE_ENCRYPT = 2

• MODE_DECRYPT = 3

Used in: json_area_description

• required object_id oid = 1

• optional segment_type type = 2

• optional string_uint64 offset = 3

• optional string_uint64 size = 4

• repeated segment_flag flags = 5

• optional string_uint64 iv_tweak = 6

  segment type crypt

• optional string encryption = 7

• optional int32 sector_size = 8

• optional segment_integrity_description integrity = 9

Used in: segment_description

• IN_REENCRYPTION = 1

• BACKUP_FINAL = 2

• BACKUP_PREVIOUS = 3

• BACKUP_MOVED_SEGMENT = 4

Used in: segment_description

• optional string type = 1

• optional string journal_encryption = 2

• optional string journal_integrity = 3

Used in: segment_description

• SEGMENT_TYPE_LINEAR = 1

• SEGMENT_TYPE_CRYPT = 2

Used in: LUKS2_both_headers

• PRIMARY_GREATER = 0

• SECONDARY_GREATER = 1

• EQUAL = 2

Used in: keyslot_area_description, segment_description

• required bool negative = 1

• oneof number

  • uint32 uint_num = 2

  • string string_num = 3

Used in: json_area_description

• required object_id oid = 1

• optional string type = 2

• repeated object_id keyslots = 3

• optional string key_description = 4