diff options
| author |   jsing <jsing@openbsd.org> | 2018-08-10 16:41:35 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2018-08-10 16:41:35 +0000 |
| commit | 27bea9a3c7fdba43cfa7c5fb6f268efe98f7720b (patch) | |
| tree | 1da260d940b6c8ce23eab4507a7d3b21838c9371 /sys/lib/libsa/softraid.h | |
| parent | Run the wycheproof ECDSA test vectors against libcrypto. (diff) | |
| download | wireguard-openbsd-27bea9a3c7fdba43cfa7c5fb6f268efe98f7720b.tar.xz wireguard-openbsd-27bea9a3c7fdba43cfa7c5fb6f268efe98f7720b.zip | |
Retry on incorrect passphrase for softraid crypto boot.
Historically, the softraid crypto support in the boot loaders has only
given one attempt to provide the correct passphrase. There were a
few reasons for this, including the fact that pkcs5_pbkdf2() allows an
empty passphrase and that returning EPERM allowed for another attempt.
With the event of KARL and the need for bsd.booted with hibernate resumption,
this becomes much more of an issue - if you get the passphrase wrong you
fail to resume. There are also other situations like using /etc/boot.conf
to switch serial console, but an incorrect passphrase results in the config
not being read. Also, bcrypt_pbkdf() does not permit empty passphrases.
This reworks the softraid crypto support in the boot loaders so that it
loops requesting a valid passphrase until one is provided, or an empty
passphrase is entered (at which point it will abort).
ok mortimer@ tb@
Diffstat (limited to 'sys/lib/libsa/softraid.h')
| -rw-r--r-- | sys/lib/libsa/softraid.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/lib/libsa/softraid.h b/sys/lib/libsa/softraid.h index fc02f18b04d..f4f7efe99fc 100644 --- a/sys/lib/libsa/softraid.h +++ b/sys/lib/libsa/softraid.h @@ -1,4 +1,4 @@ -/* $OpenBSD: softraid.h,v 1.1 2016/09/11 17:49:36 jsing Exp $ */ +/* $OpenBSD: softraid.h,v 1.2 2018/08/10 16:41:35 jsing Exp $ */ /* * Copyright (c) 2012 Joel Sing <jsing@openbsd.org> @@ -34,6 +34,6 @@ extern struct sr_boot_volume_head sr_volumes; extern struct sr_boot_keydisk_head sr_keydisks; void sr_clear_keys(void); -int sr_crypto_decrypt_keys(struct sr_boot_volume *); +int sr_crypto_unlock_volume(struct sr_boot_volume *); #endif /* _SOFTRAID_H */ |