Top | ![]() |
![]() |
![]() |
![]() |
#define | BD_CRYPTO_LUKS_METADATA_SIZE |
#define | BD_CRYPTO_ERROR |
enum | BDCryptoError |
#define | BD_CRYPTO_BACKUP_PASSPHRASE_CHARSET |
#define | BD_CRYPTO_BACKUP_PASSPHRASE_LENGTH |
#define | DEFAULT_LUKS_KEYSIZE_BITS |
#define | DEFAULT_LUKS_CIPHER |
A plugin for operations with encrypted devices. For now, only LUKS devices are supported.
Functions taking a parameter called "device" require the backing device to be passed. On the other hand functions taking the "luks_device" parameter require the LUKS device (/dev/mapper/SOMETHING").
Sizes are given in bytes unless stated otherwise.
void
bd_crypto_close ();
Cleans up after the plugin. **This function is called automatically by the library's functions that unload it.**
gboolean bd_crypto_init ();
Initializes the plugin. **This function is called automatically by the library's initialization functions.**
gchar *
bd_crypto_generate_backup_passphrase (GError **error
);
A newly generated BD_CRYPTO_BACKUP_PASSPHRASE_LENGTH
-long passphrase.
See BD_CRYPTO_BACKUP_PASSPHRASE_CHARSET
for the definition of the charset used for the passphrase.
gboolean bd_crypto_device_is_luks (const gchar *device
,GError **error
);
gchar * bd_crypto_luks_uuid (const gchar *device
,GError **error
);
UUID of the device
or NULL
if failed to determine (error
)
is populated with the error in such cases)
gchar * bd_crypto_luks_status (const gchar *luks_device
,GError **error
);
one of "invalid", "inactive", "active" or "busy" or
NULL
if failed to determine (error
is populated with the error in
such cases).
[transfer none]
gboolean bd_crypto_luks_format (const gchar *device
,const gchar *cipher
,guint64 key_size
,const gchar *passphrase
,const gchar *key_file
,guint64 min_entropy
,GError **error
);
Formats the given device
as LUKS according to the other parameters given. If
min_entropy
is specified (greater than 0), the function waits for enough
entropy to be available in the random data pool (WHICH MAY POTENTIALLY TAKE
FOREVER).
device |
a device to format as LUKS |
|
cipher |
cipher specification (type-mode, e.g. "aes-xts-plain64") or |
[allow-none] |
key_size |
size of the volume key in bits or 0 to use the default |
|
passphrase |
a passphrase for the new LUKS device or |
[allow-none] |
key_file |
a key file for the new LUKS device or |
[allow-none] |
min_entropy |
minimum random data entropy (in bits) required to format |
|
error |
place to store error (if any). |
[out] |
gboolean bd_crypto_luks_format_blob (const gchar *device
,const gchar *cipher
,guint64 key_size
,const guint8 *pass_data
,gsize data_len
,guint64 min_entropy
,GError **error
);
Formats the given device
as LUKS according to the other parameters given. If
min_entropy
is specified (greater than 0), the function waits for enough
entropy to be available in the random data pool (WHICH MAY POTENTIALLY TAKE
FOREVER).
device |
a device to format as LUKS |
|
cipher |
cipher specification (type-mode, e.g. "aes-xts-plain64") or |
[allow-none] |
key_size |
size of the volume key in bits or 0 to use the default |
|
pass_data |
a passphrase for the new LUKS device (may contain arbitrary binary data). |
[array length=data_len] |
data_len |
length of the |
|
min_entropy |
minimum random data entropy (in bits) required to format |
|
error |
place to store error (if any). |
[out] |
gboolean bd_crypto_luks_open (const gchar *device
,const gchar *name
,const gchar *passphrase
,const gchar *key_file
,gboolean read_only
,GError **error
);
device |
the device to open |
|
name |
name for the LUKS device |
|
passphrase |
passphrase to open the |
[allow-none] |
key_file |
key file path to use for opening the |
[allow-none] |
read_only |
whether to open as read-only or not (meaning read-write) |
|
error |
place to store error (if any). |
[out] |
whether the device
was successfully opened or not
One of passphrase
, key_file
has to be != NULL
.
gboolean bd_crypto_luks_open_blob (const gchar *device
,const gchar *name
,const guint8 *pass_data
,gsize data_len
,gboolean read_only
,GError **error
);
device |
the device to open |
|
name |
name for the LUKS device |
|
pass_data |
a passphrase for the new LUKS device (may contain arbitrary binary data). |
[array length=data_len] |
data_len |
length of the |
|
read_only |
whether to open as read-only or not (meaning read-write) |
|
error |
place to store error (if any). |
[out] |
gboolean bd_crypto_luks_add_key (const gchar *device
,const gchar *pass
,const gchar *key_file
,const gchar *npass
,const gchar *nkey_file
,GError **error
);
whether the npass
or nkey_file
was successfully added to device
or not
One of pass
, key_file
has to be != NULL
and the same applies to npass
,
nkey_file
.
gboolean bd_crypto_luks_add_key_blob (const gchar *device
,const guint8 *pass_data
,gsize data_len
,const guint8 *npass_data
,gsize ndata_len
,GError **error
);
device |
device to add new key to |
|
pass_data |
a passphrase for the new LUKS device (may contain arbitrary binary data). |
[array length=data_len] |
data_len |
length of the |
|
npass_data |
a new passphrase for the new LUKS device (may contain arbitrary binary data). |
[array length=ndata_len] |
ndata_len |
length of the |
|
error |
place to store error (if any). |
[out] |
gboolean bd_crypto_luks_remove_key (const gchar *device
,const gchar *pass
,const gchar *key_file
,GError **error
);
gboolean bd_crypto_luks_remove_key_blob (const gchar *device
,const guint8 *pass_data
,gsize data_len
,GError **error
);
gboolean bd_crypto_luks_change_key (const gchar *device
,const gchar *pass
,const gchar *npass
,GError **error
);
gboolean bd_crypto_luks_change_key_blob (const gchar *device
,const guint8 *pass_data
,gsize data_len
,const guint8 *npass_data
,gsize ndata_len
,GError **error
);
device |
device to change key of |
|
pass_data |
a passphrase for the new LUKS device (may contain arbitrary binary data). |
[array length=data_len] |
data_len |
length of the |
|
npass_data |
a new passphrase for the new LUKS device (may contain arbitrary binary data). |
[array length=ndata_len] |
ndata_len |
length of the |
|
error |
place to store error (if any). |
[out] |
gboolean bd_crypto_luks_resize (const gchar *device
,guint64 size
,GError **error
);
gboolean bd_crypto_tc_open (const gchar *device
,const gchar *name
,const guint8 *pass_data
,gsize data_len
,gboolean read_only
,GError **error
);
device |
the device to open |
|
name |
name for the TrueCrypt/VeraCrypt device |
|
pass_data |
a passphrase for the TrueCrypt/VeraCrypt volume (may contain arbitrary binary data). |
[array length=data_len] |
data_len |
length of the |
|
read_only |
whether to open as read-only or not (meaning read-write) |
|
error |
place to store error (if any). |
[out] |
gboolean bd_crypto_escrow_device (const gchar *device
,const gchar *passphrase
,const gchar *cert_data
,const gchar *directory
,const gchar *backup_passphrase
,GError **error
);
device |
path of the device to create escrow data for |
|
passphrase |
passphrase used for the device |
|
cert_data |
certificate data to use for escrow. |
[array zero-terminated=1][element-type gchar] |
directory |
directory to put escrow data into |
|
backup_passphrase |
backup passphrase for the device or |
[allow-none] |
error |
place to store error (if any). |
[out] |