/* Copyright (c) 2008-2010 TrueCrypt Developers Association. All rights reserved. Governed by the TrueCrypt License 3.0 the full text of which is contained in the file License.txt included in TrueCrypt binary and source code distribution packages. */ /* If native 64-bit data types are not available, define TC_NO_COMPILER_INT64. For big-endian platforms define BYTE_ORDER as BIG_ENDIAN. */ #ifdef TC_MINIMIZE_CODE_SIZE // Preboot/boot version # ifndef TC_NO_COMPILER_INT64 # define TC_NO_COMPILER_INT64 # endif # pragma optimize ("tl", on) #endif #ifdef TC_NO_COMPILER_INT64 # include #endif #include "Xts.h" #ifndef TC_NO_COMPILER_INT64 // length: number of bytes to encrypt; may be larger than one data unit and must be divisible by the cipher block size // ks: the primary key schedule // ks2: the secondary key schedule // startDataUnitNo: The sequential number of the data unit with which the buffer starts. // startCipherBlockNo: The sequential number of the first plaintext block to encrypt inside the data unit startDataUnitNo. // When encrypting the data unit from its first block, startCipherBlockNo is 0. // The startCipherBlockNo value applies only to the first data unit in the buffer; each successive // data unit is encrypted from its first block. The start of the buffer does not have to be // aligned with the start of a data unit. If it is aligned, startCipherBlockNo must be 0; if it // is not aligned, startCipherBlockNo must reflect the misalignment accordingly. void EncryptBufferXTS (unsigned __int8 *buffer, TC_LARGEST_COMPILER_UINT length, const UINT64_STRUCT *startDataUnitNo, unsigned int startCipherBlockNo, unsigned __int8 *ks, unsigned __int8 *ks2, int cipher) { if (CipherSupportsIntraDataUnitParallelization (cipher)) EncryptBufferXTSParallel (buffer, length, startDataUnitNo, startCipherBlockNo, ks, ks2, cipher); else EncryptBufferXTSNonParallel (buffer, length, startDataUnitNo, startCipherBlockNo, ks, ks2, cipher); } // Optimized for encryption algorithms supporting intra-data-unit parallelization static void EncryptBufferXTSParallel (unsigned __int8 *buffer, TC_LARGEST_COMPILER_UINT length, const UINT64_STRUCT *startDataUnitNo, unsigned int startCipherBlockNo, unsigned __int8 *ks, unsigned __int8 *ks2, int cipher) { unsigned __int8 finalCarry; unsigned __int8 whiteningValues [ENCRYPTION_DATA_UNIT_SIZE]; unsigned __int8 whiteningValue [BYTES_PER_XTS_BLOCK]; unsigned __int8 byteBufUnitNo [BYTES_PER_XTS_BLOCK]; unsigned __int64 *whiteningValuesPtr64 = (unsigned __int64 *) whiteningValues; unsigned __int64 *whiteningValuePtr64 = (unsigned __int64 *) whiteningValue; unsigned __int64 *bufPtr = (unsigned __int64 *) buffer; unsigned __int64 *dataUnitBufPtr; unsigned int startBlock = startCipherBlockNo, endBlock, block; unsigned __int64 *const finalInt64WhiteningValuesPtr = whiteningValuesPtr64 + sizeof (whiteningValues) / sizeof (*whiteningValuesPtr64) - 1; TC_LARGEST_COMPILER_UINT blockCount, dataUnitNo; /* The encrypted data unit number (i.e. the resultant ciphertext block) is to be multiplied in the finite field GF(2^128) by j-th power of n, where j is the sequential plaintext/ciphertext block number and n is 2, a primitive element of GF(2^128). This can be (and is) simplified and implemented as a left shift of the preceding whitening value by one bit (with carry propagating). In addition, if the shift of the highest byte results in a carry, 135 is XORed into the lowest byte. The value 135 is derived from the modulus of the Galois Field (x^128+x^7+x^2+x+1). */ // Convert the 64-bit data unit number into a little-endian 16-byte array. // Note that as we are converting a 64-bit number into a 16-byte array we can always zero the last 8 bytes. dataUnitNo = startDataUnitNo->Value; *((unsigned __int64 *) byteBufUnitNo) = LE64 (dataUnitNo); *((unsigned __int64 *) byteBufUnitNo + 1) = 0; if (length % BYTES_PER_XTS_BLOCK) TC_THROW_FATAL_EXCEPTION; blockCount = length / BYTES_PER_XTS_BLOCK; // Process all blocks in the buffer while (blockCount > 0) { if (blockCount < BLOCKS_PER_XTS_DATA_UNIT) endBlock = startBlock + (unsigned int) blockCount; else endBlock = BLOCKS_PER_XTS_DATA_UNIT; whiteningValuesPtr64 = finalInt64WhiteningValuesPtr; whiteningValuePtr64 = (unsigned __int64 *) whiteningValue; // Encrypt the data unit number using the secondary key (in order to generate the first // whitening value for this data unit) *whiteningValuePtr64 = *((unsigned __int64 *) byteBufUnitNo); *(whiteningValuePtr64 + 1) = 0; EncipherBlock (cipher, whiteningValue, ks2); // Generate subsequent whitening values for blocks in this data unit. Note that all generated 128-bit // whitening values are stored in memory as a sequence of 64-bit integers in reverse order. for (block = 0; block < endBlock; block++) { if (block >= startBlock) { *whiteningValuesPtr64-- = *whiteningValuePtr64++; *whiteningValuesPtr64-- = *whiteningValuePtr64; } else whiteningValuePtr64++; // Derive the next whitening value #if BYTE_ORDER == LITTLE_ENDIAN // Little-endian platforms finalCarry = (*whiteningValuePtr64 & 0x8000000000000000) ? 135 : 0; *whiteningValuePtr64-- <<= 1; if (*whiteningValuePtr64 & 0x8000000000000000) *(whiteningValuePtr64 + 1) |= 1; *whiteningValuePtr64 <<= 1; #else // Big-endian platforms finalCarry = (*whiteningValuePtr64 & 0x80) ? 135 : 0; *whiteningValuePtr64 = LE64 (LE64 (*whiteningValuePtr64) << 1); whiteningValuePtr64--; if (*whiteningValuePtr64 & 0x80) *(whiteningValuePtr64 + 1) |= 0x0100000000000000; *whiteningValuePtr64 = LE64 (LE64 (*whiteningValuePtr64) << 1); #endif whiteningValue[0] ^= finalCarry; } dataUnitBufPtr = bufPtr; whiteningValuesPtr64 = finalInt64WhiteningValuesPtr; // Encrypt all blocks in this data unit for (block = startBlock; block < endBlock; block++) { // Pre-whitening *bufPtr++ ^= *whiteningValuesPtr64--; *bufPtr++ ^= *whiteningValuesPtr64--; } // Actual encryption EncipherBlocks (cipher, dataUnitBufPtr, ks, endBlock - startBlock); bufPtr = dataUnitBufPtr; whiteningValuesPtr64 = finalInt64WhiteningValuesPtr; for (block = startBlock; block < endBlock; block++) { // Post-whitening *bufPtr++ ^= *whiteningValuesPtr64--; *bufPtr++ ^= *whiteningValuesPtr64--; } blockCount -= endBlock - startBlock; startBlock = 0; dataUnitNo++; *((unsigned __int64 *) byteBufUnitNo) = LE64 (dataUnitNo); } FAST_ERASE64 (whiteningValue, sizeof (whiteningValue)); FAST_ERASE64 (whiteningValues, sizeof (whiteningValues)); } // Optimized for encryption algorithms not supporting intra-data-unit parallelization static void EncryptBufferXTSNonParallel (unsigned __int8 *buffer, TC_LARGEST_COMPILER_UINT length, const UINT64_STRUCT *startDataUnitNo, unsigned int startCipherBlockNo, unsigned __int8 *ks, unsigned __int8 *ks2, int cipher) { unsigned __int8 finalCarry; unsigned __int8 whiteningValue [BYTES_PER_XTS_BLOCK]; unsigned __int8 byteBufUnitNo [BYTES_PER_XTS_BLOCK]; unsigned __int64 *whiteningValuePtr64 = (unsigned __int64 *) whiteningValue; unsigned __int64 *bufPtr = (unsigned __int64 *) buffer; unsigned int startBlock = startCipherBlockNo, endBlock, block; TC_LARGEST_COMPILER_UINT blockCount, dataUnitNo; /* The encrypted data unit number (i.e. the resultant ciphertext block) is to be multiplied in the finite field GF(2^128) by j-th power of n, where j is the sequential plaintext/ciphertext blo
/*
 Legal Notice: Some portions of the source code contained in this file were
 derived from the source code of Encryption for the Masses 2.02a, which is
 Copyright (c) 1998-2000 Paul Le Roux and which is governed by the 'License
 Agreement for Encryption for the Masses'. Modifications and additions to
 the original source code (contained in this file) and all other portions
 of this file are Copyright (c) 2003-2010 TrueCrypt Developers Association
 and are governed by the TrueCrypt License 3.0 the full text of which is
 contained in the file License.txt included in TrueCrypt binary and source
 code distribution packages. */

#ifndef TC_HEADER_Common_Volumes
#define TC_HEADER_Common_Volumes

#ifdef __cplusplus
extern "C" {
#endif

// Volume header version
#define VOLUME_HEADER_VERSION					0x0005 

// Version number written to volume header during format;
// specifies the minimum program version required to mount the volume
#define TC_VOLUME_MIN_REQUIRED_PROGRAM_VERSION	0x010b

// Version number written (encrypted) to the key data area of an encrypted system partition/drive;
// specifies the minimum program version required to decrypt the system partition/drive
#define TC_SYSENC_KEYSCOPE_MIN_REQ_PROG_VERSION	0x010b

// Current volume format version (created by TrueCrypt 6.0+)
#define TC_VOLUME_FORMAT_VERSION				2

// Version number of volume format created by TrueCrypt 1.0-5.1a
#define TC_VOLUME_FORMAT_VERSION_PRE_6_0		1

// Volume header sizes
#define TC_VOLUME_HEADER_SIZE					(64 * 1024L)
#define TC_VOLUME_HEADER_EFFECTIVE_SIZE			512
#define TC_BOOT_ENCRYPTION_VOLUME_HEADER_SIZE	512
#define TC_VOLUME_HEADER_SIZE_LEGACY			512

#define TC_VOLUME_HEADER_GROUP_SIZE				(2 * TC_VOLUME_HEADER_SIZE)
#define TC_TOTAL_VOLUME_HEADERS_SIZE			(4 * TC_VOLUME_HEADER_SIZE)

// Volume offsets
#define TC_VOLUME_HEADER_OFFSET					0
#define TC_HIDDEN_VOLUME_HEADER_OFFSET			TC_VOLUME_HEADER_SIZE

// Sector sizes
#define TC_MIN_VOLUME_SECTOR_SIZE				512
#define TC_MAX_VOLUME_SECTOR_SIZE				4096
#define TC_SECTOR_SIZE_FILE_HOSTED_VOLUME		512
#define TC_SECTOR_SIZE_LEGACY					512

// Sector size which can be safely assumed to be supported by all BIOSes
#define TC_SECTOR_SIZE_BIOS						512

#define TC_VOLUME_SMALL_SIZE_THRESHOLD			(2 * BYTES_PER_MB)		// Volume sizes below this threshold are considered small

#define TC_HIDDEN_VOLUME_HOST_FS_RESERVED_END_AREA_SIZE			TC_MAX_VOLUME_SECTOR_SIZE	// FAT file system fills the last sector with zeroes (marked as free; observed when quick format was performed using the OS format tool).
#define	TC_HIDDEN_VOLUME_HOST_FS_RESERVED_END_AREA_SIZE_HIGH	TC_VOLUME_HEADER_GROUP_SIZE	// Reserved area size used for hidden volumes larger than TC_VOLUME_SMALL_SIZE_THRESHOLD

#define TC_VOLUME_DATA_OFFSET					TC_VOLUME_HEADER_GROUP_SIZE

// The offset, in bytes, of the legacy hidden volume header position from the end of the file (a positive value).
#define TC_HIDDEN_VOLUME_HEADER_OFFSET_LEGACY	(TC_VOLUME_HEADER_SIZE_LEGACY + TC_SECTOR_SIZE_LEGACY * 2)

#define TC_MAX_128BIT_BLOCK_VOLUME_SIZE	BYTES_PER_PB			// Security bound (128-bit block XTS mode)

// Filesystem size limits
#define TC_MIN_FAT_FS_SIZE				(9 * TC_MAX_VOLUME_SECTOR_SIZE)
#define TC_MAX_FAT_SECTOR_COUNT			0x100000000ULL
#define TC_MIN_NTFS_FS_SIZE				(884 * TC_MAX_VOLUME_SECTOR_SIZE)
#define TC_MAX_NTFS_FS_SIZE				(128LL * BYTES_PER_TB)	// NTFS volume can theoretically be up to 16 exabytes, but Windows XP and 2003 limit the size to that addressable with 32-bit clusters, i.e. max size is 128 TB (if 64-KB clusters are used).
#define TC_MAX_FAT_CLUSTER_SIZE			(256 * BYTES_PER_KB)	// Windows XP/Vista may crash when writing to a filesystem using clusters larger than 256 KB

// Volume size limits
#define TC_MIN_VOLUME_SIZE				(TC_TOTAL_VOLUME_HEADERS_SIZE + TC_MIN_FAT_FS_SIZE)
#define TC_MIN_VOLUME_SIZE_LEGACY		(37 * TC_SECTOR_SIZE_LEGACY)
#define TC_MAX_VOLUME_SIZE_GENERAL		0x7fffFFFFffffFFFFLL	// Signed 64-bit integer file offset values
#define TC_MAX_VOLUME_SIZE				TC_MAX_128BIT_BLOCK_VOLUME_SIZE

#define TC_MIN_HIDDEN_VOLUME_SIZE		(TC_MIN_FAT_FS_SIZE + TC_HIDDEN_VOLUME_HOST_FS_RESERVED_END_AREA_SIZE)

#define TC_MIN_HIDDEN_VOLUME_HOST_SIZE	(TC_MIN_VOLUME_SIZE + TC_MIN_HIDDEN_VOLUME_SIZE + 2 * TC_MAX_VOLUME_SECTOR_SIZE)
#define TC_MAX_HIDDEN_VOLUME_HOST_SIZE	(TC_MAX_NTFS_FS_SIZE - TC_TOTAL_VOLUME_HEADERS_SIZE)

#ifndef TC_NO_COMPILER_INT64
#	if TC_MAX_VOLUME_SIZE > TC_MAX_VOLUME_SIZE_GENERAL
#		error TC_MAX_VOLUME_SIZE > TC_MAX_VOLUME_SIZE_GENERAL
#	endif
#endif

#define HEADER_ENCRYPTED_DATA_SIZE			(TC_VOLUME_HEADER_EFFECTIVE_SIZE - HEADER_ENCRYPTED_DATA_OFFSET)

// Volume header field offsets
#define	HEADER_SALT_OFFSET					0
#define HEADER_ENCRYPTED_DATA_OFFSET		PKCS5_SALT_SIZE
#define	HEADER_MASTER_KEYDATA_OFFSET		256
	
#define TC_HEADER_OFFSET_MAGIC					64
#define TC_HEADER_OFFSET_VERSION				68
#define TC_HEADER_OFFSET_REQUIRED_VERSION		70
#define TC_HEADER_OFFSET_KEY_AREA_CRC			72
#define TC_HEADER_OFFSET_VOLUME_CREATION_TIME	76
#define TC_HEADER_OFFSET_MODIFICATION_TIME		84
#define TC_HEADER_OFFSET_HIDDEN_VOLUME_SIZE		92
#define TC_HEADER_OFFSET_VOLUME_SIZE			100
#define TC_HEADER_OFFSET_ENCRYPTED_AREA_START	108
#define TC_HEADER_OFFSET_ENCRYPTED_AREA_LENGTH	116
#define TC_HEADER_OFFSET_FLAGS					124
#define TC_HEADER_OFFSET_SECTOR_SIZE			128
#define TC_HEADER_OFFSET_HEADER_CRC				252

// Volume header flags
#define TC_HEADER_FLAG_ENCRYPTED_SYSTEM			0x1
#define TC_HEADER_FLAG_NONSYS_INPLACE_ENC		0x2		// The volume has been created using non-system in-place encryption


#ifndef TC_HEADER_Volume_VolumeHeader

#include "Password.h"

extern BOOL ReadVolumeHeaderRecoveryMode;

uint16 GetHeaderField16 (byte *header, int offset);
uint32 GetHeaderField32 (byte *header, int offset);
UINT64_STRUCT GetHeaderField64 (byte *header, int offset);
int ReadVolumeHeader (BOOL bBoot, char *encryptedHeader, Password *password, PCRYPTO_INFO *retInfo, CRYPTO_INFO *retHeaderCryptoInfo);

#if !defined (DEVICE_DRIVER) && !defined (TC_WINDOWS_BOOT)
int CreateVolumeHeaderInMemory (BOOL bBoot, char *encryptedHeader, int ea, int mode, Password *password, int pkcs5_prf, char *masterKeydata, PCRYPTO_INFO *retInfo, unsigned __int64 volumeSize, unsigned __int64 hiddenVolumeSize, unsigned __int64 encryptedAreaStart, unsigned __int64 encryptedAreaLength, uint16 requiredProgramVersion, uint32 headerFlags, uint32 sectorSize, BOOL bWipeMode);
BOOL ReadEffectiveVolumeHeader (BOOL device, HANDLE fileHandle, byte *header, DWORD *bytesRead);
BOOL WriteEffectiveVolumeHeader (BOOL device, HANDLE fileHandle, byte *header);
int WriteRandomDataToReservedHeaderAreas (HANDLE dev, CRYPTO_INFO *cryptoInfo, uint64 dataAreaSize, BOOL bPrimaryOnly, BOOL bBackupOnly);
#endif

#endif // !TC_HEADER_Volume_VolumeHeader

#ifdef __cplusplus
}
#endif

#endif // TC_HEADER_Common_Volumes