What new functionality do you want? I am looking for a tool/

I do not think there is a tool or that can do this for you. If you write someth

'luksOpen'` encrypted volumes about ceph-csi HOT 1 CLOSED

fevo1971 commented on July 23, 2024

'luksOpen'` encrypted volumes

from ceph-csi.

Comments (1)

nixpanic commented on July 23, 2024

I do not think there is a tool or script that can do this for you. If you write something for it, consider contributing it back to this project.

If you have the keys stored in the metadata of the RBD-image, you can find the encrypted key in the rbd.csi.ceph.com/dek metdata. Each RBD-image has its own key and nounce, stored as JSON.

You can decrypt that the key with the passphrase and nounce (volume id) that were used to encrypt the key. This is the function that does it:

ceph-csi/internal/kms/secretskms.go

Lines 237 to 264 in d376271

 // DecryptDEK takes the JSON formatted `encryptedMetadataDEK` contents, and it 

 // fetches secretKMS passphrase to decrypt the DEK. 

 func (kms secretsMetadataKMS) DecryptDEK(ctx context.Context, volumeID, encryptedDEK string) (string, error) { 

 // use the passphrase from the secretKMS 

 passphrase, err := kms.secretsKMS.FetchDEK(ctx, volumeID) 

 if err != nil { 

 return "", fmt.Errorf("failed to get passphrase: %w", err) 

 } 

 aead, err := generateCipher(passphrase, volumeID) 

 if err != nil { 

 return "", fmt.Errorf("failed to generate cipher: %w", err) 

 } 

 emd := encryptedMetedataDEK{} 

 err = json.Unmarshal([]byte(encryptedDEK), &emd) 

 if err != nil { 

 return "", fmt.Errorf("failed to convert data to "+ 

 "encryptedMetedataDEK: %w", err) 

 } 

 dek, err := aead.Open(nil, emd.Nonce, emd.DEK, nil) 

 if err != nil { 

 return "", fmt.Errorf("failed to decrypt DEK: %w", err) 

 } 

 return string(dek), nil 

 }

from ceph-csi.

'luksOpen'` encrypted volumes about ceph-csi HOT 1 CLOSED

Comments (1)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	// DecryptDEK takes the JSON formatted `encryptedMetadataDEK` contents, and it
	// fetches secretKMS passphrase to decrypt the DEK.
	func (kms secretsMetadataKMS) DecryptDEK(ctx context.Context, volumeID, encryptedDEK string) (string, error) {
	// use the passphrase from the secretKMS
	passphrase, err := kms.secretsKMS.FetchDEK(ctx, volumeID)
	if err != nil {
	return "", fmt.Errorf("failed to get passphrase: %w", err)
	}

	aead, err := generateCipher(passphrase, volumeID)
	if err != nil {
	return "", fmt.Errorf("failed to generate cipher: %w", err)
	}

	emd := encryptedMetedataDEK{}
	err = json.Unmarshal([]byte(encryptedDEK), &emd)
	if err != nil {
	return "", fmt.Errorf("failed to convert data to "+
	"encryptedMetedataDEK: %w", err)
	}

	dek, err := aead.Open(nil, emd.Nonce, emd.DEK, nil)
	if err != nil {
	return "", fmt.Errorf("failed to decrypt DEK: %w", err)
	}

	return string(dek), nil
	}