Skip to content
Snippets Groups Projects
  • Daniel P. Berrangé's avatar
    83bee4b5
    crypto: replace 'des-rfb' cipher with 'des' · 83bee4b5
    Daniel P. Berrangé authored
    
    Currently the crypto layer exposes support for a 'des-rfb'
    algorithm which is just normal single-DES, with the bits
    in each key byte reversed. This special key munging is
    required by the RFB protocol password authentication
    mechanism.
    
    Since the crypto layer is generic shared code, it makes
    more sense to do the key byte munging in the VNC server
    code, and expose normal single-DES support.
    
    Replacing cipher 'des-rfb' by 'des' looks like an incompatible
    interface change, but it doesn't matter.  While the QMP schema
    allows any QCryptoCipherAlgorithm for the 'cipher-alg' field
    in QCryptoBlockCreateOptionsLUKS, the code restricts what can
    be used at runtime. Thus the only effect is a change in error
    message.
    
    Original behaviour:
    
     $ qemu-img create -f luks --object secret,id=sec0,data=123 -o cipher-alg=des-rfb,key-secret=sec0 demo.luks 1G
     Formatting 'demo.luks', fmt=luks size=1073741824 key-secret=sec0 cipher-alg=des-rfb
     qemu-img: demo.luks: Algorithm 'des-rfb' not supported
    
    New behaviour:
    
     $ qemu-img create -f luks --object secret,id=sec0,data=123 -o cipher-alg=des-rfb,key-secret=sec0 demo.luks 1G
     Formatting 'demo.luks', fmt=luks size=1073741824 key-secret=sec0 cipher-alg=des-fish
     qemu-img: demo.luks: Invalid parameter 'des-rfb'
    
    Reviewed-by: default avatarMarkus Armbruster <armbru@redhat.com>
    Reviewed-by: default avatarEric Blake <eblake@redhat.com>
    Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>
    83bee4b5
    History
    crypto: replace 'des-rfb' cipher with 'des'
    Daniel P. Berrangé authored
    
    Currently the crypto layer exposes support for a 'des-rfb'
    algorithm which is just normal single-DES, with the bits
    in each key byte reversed. This special key munging is
    required by the RFB protocol password authentication
    mechanism.
    
    Since the crypto layer is generic shared code, it makes
    more sense to do the key byte munging in the VNC server
    code, and expose normal single-DES support.
    
    Replacing cipher 'des-rfb' by 'des' looks like an incompatible
    interface change, but it doesn't matter.  While the QMP schema
    allows any QCryptoCipherAlgorithm for the 'cipher-alg' field
    in QCryptoBlockCreateOptionsLUKS, the code restricts what can
    be used at runtime. Thus the only effect is a change in error
    message.
    
    Original behaviour:
    
     $ qemu-img create -f luks --object secret,id=sec0,data=123 -o cipher-alg=des-rfb,key-secret=sec0 demo.luks 1G
     Formatting 'demo.luks', fmt=luks size=1073741824 key-secret=sec0 cipher-alg=des-rfb
     qemu-img: demo.luks: Algorithm 'des-rfb' not supported
    
    New behaviour:
    
     $ qemu-img create -f luks --object secret,id=sec0,data=123 -o cipher-alg=des-rfb,key-secret=sec0 demo.luks 1G
     Formatting 'demo.luks', fmt=luks size=1073741824 key-secret=sec0 cipher-alg=des-fish
     qemu-img: demo.luks: Invalid parameter 'des-rfb'
    
    Reviewed-by: default avatarMarkus Armbruster <armbru@redhat.com>
    Reviewed-by: default avatarEric Blake <eblake@redhat.com>
    Signed-off-by: default avatarDaniel P. Berrangé <berrange@redhat.com>