CODEWITHSUNDEEP
goencryptionlinux-kernel
Grifenfer
Grifenfer

Reputation: 31

Use of the Linux Crypto API for AES Encryption

I have some issues in using the Linux Crypto API (User Space Interface) of the USB Armory Mk-II. I successfully made hash calculation but not aes encryption or decryption operations.

I am writing a go code that will use the API for AES encryption/decryption. I'm taking example on the following code to help me: https://github.com/f-secure-foundry/mxs-dcp/blob/master/dcp_tool.go. Everything is installed and Here is a part of my encryption function:

    fd, _ := unix.Socket(unix.AF_ALG, unix.SOCK_SEQPACKET, 0)
    addr := &unix.SockaddrALG{Type: "skcipher", Name: "ecb-aes-dcp"}
    unix.Bind(fd, addr)

    KEY := "\x2b\x7e\x15\x16\x28\xae\xd2\xa6\xab\xf7\x15\x88\x09\xcf\x4f\x3c"

    err = syscall.SetsockoptString(fd, unix.SOL_ALG, unix.ALG_SET_KEY, KEY)

    if err != nil {
            return
    }

    //unix.ALG_OP_ENCRYPT = 0x1
    // from https://pkg.go.dev/golang.org/x/sys/unix#pkg-constants

    //ENCRYPT := "\x00"
    err = syscall.SetsockoptInt(fd, unix.SOL_ALG, unix.ALG_SET_OP, unix.ALG_OP_ENCRYPT)

    if err != nil {
            return
    }

The code stop running at syscall.SetsockoptInt and the error is "protocol not available".

I don't know where this come from and the Linux crypto API documentation (https://www.kernel.org/doc/html/v4.19/crypto/index.html) doesn't really help me. If I understand it, I have to make a syscall to tell I want encryption operation (unix.ALG_SET_OP, unix.ALG_OP_ENCRYPT). But this doesn't work.

Does someone have an idea why?

Upvotes: 1

Views: 608

Answers (1)

Grifenfer
Grifenfer

Reputation: 31

Actually, you have to send the operation flag with the data. In this code https://github.com/f-secure-foundry/mxs-dcp/blob/master/dcp_tool.go, you generate a derived key by encryption (aes cbc) of a diversifier with the TEST_KEY. The function DCPDeriveKey will first open the socket then bind it and set the key. Before encryption, made by the function cryptoAPI, we have to send the SYSACCEPT flag to the kernel. The function cryptoAPI will send the operation flag and the data to the kernel and read the answer of the kernel.

Upvotes: 1

Related Questions