From 1d3ae2d92f40567910303205da090fc86c7351b8 Mon Sep 17 00:00:00 2001 From: Gary Lockyer Date: Fri, 15 Dec 2017 07:21:10 +1300 Subject: dsdb encrypted secrets module Encrypt the samba secret attributes on disk. This is intended to mitigate the inadvertent disclosure of the sam.ldb file, and to mitigate memory read attacks. Currently the key file is stored in the same directory as sam.ldb but this could be changed at a later date to use an HSM or similar mechanism to protect the key. Data is encrypted with AES 128 GCM. The encryption uses gnutls where available and if it supports AES 128 GCM AEAD modes, otherwise nettle is used. Signed-off-by: Gary Lockyer Reviewed-by: Andrew Bartlett --- librpc/idl/drsblobs.idl | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'librpc') diff --git a/librpc/idl/drsblobs.idl b/librpc/idl/drsblobs.idl index 9fca2cb8b1f..5fd11bbc880 100644 --- a/librpc/idl/drsblobs.idl +++ b/librpc/idl/drsblobs.idl @@ -721,4 +721,34 @@ interface drsblobs { [nopython] void decode_ForestTrustInfo( [in] ForestTrustInfo blob ); + + typedef enum { + ENC_SECRET_AES_128_AEAD = 1 + } EncryptedSecretAlgorithm; + + const uint32 ENCRYPTED_SECRET_MAGIC_VALUE = 0xCA5CADED; + + typedef [public] struct { + DATA_BLOB cleartext; + } PlaintextSecret; + + /* The AEAD routines uses this as the additional authenticated data */ + typedef [public] struct { + uint32 magic; + uint32 version; + uint32 algorithm; + uint32 flags; + } EncryptedSecretHeader; + + typedef [public] struct { + /* + * The iv is before the header to ensure that the first bytes of + * the encrypted values are not predictable. + * We do this so that if the decryption gets disabled, we don't + * end up with predictable unicodePasswords. + */ + DATA_BLOB iv; + EncryptedSecretHeader header; + [flag(NDR_REMAINING)] DATA_BLOB encrypted; + } EncryptedSecret; } -- cgit v1.2.1