init/tpm_encryption/encryption_key.cc - third_party/platform2 - Git at Google

 // Copyright 2018 The ChromiumOS Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "init/tpm_encryption/encryption_key.h"

 #include <fcntl.h>
 #include <sys/stat.h>
 #include <sys/types.h>

 #include <utility>

 #include <base/check.h>
 #include <base/files/file_util.h>
 #include <base/logging.h>
 #include <base/strings/string_number_conversions.h>
 #include <base/strings/string_util.h>
 #include <brillo/file_utils.h>
 #include <brillo/files/file_util.h>
 #include <libhwsec-foundation/crypto/aes.h>
 #include <libhwsec-foundation/crypto/hmac.h>
 #include <libhwsec-foundation/crypto/secure_blob_util.h>
 #include <libhwsec-foundation/crypto/sha.h>
 #include <libstorage/platform/platform.h>
 #include <openssl/sha.h>

 #include "init/tpm_encryption/tpm.h"

 namespace encryption {
 namespace paths {
 const char kKernelCmdline[] = "proc/cmdline";
 const char kProductUUID[] = "sys/class/dmi/id/product_uuid";
 // Using stateful partition mount point as base.
 const char kEncryptedKey[] = "encrypted.key";
 const char kNeedsFinalization[] = "encrypted.needs-finalization";
 const char kStatefulPreservationRequest[] = "preservation_request";
 const char kPreservedPreviousKey[] = "encrypted.key.preserved";
 }  // namespace paths

 namespace {

 const char kKernelCmdlineOption[] = "encrypted-stateful-key=";
 const char kStaticKeyDefault[] = "default unsafe static key";
 const char kStaticKeyFinalizationNeeded[] = "needs finalization";

 const size_t kMaxReadSize = 4 * 1024;

 bool ReadKeyFile(libstorage::Platform* platform,
                  const base::FilePath& path,
                  brillo::SecureBlob* plaintext,
                  const brillo::SecureBlob& encryption_key) {
   brillo::Blob ciphertext;

   // Check the file size: we expect to be really small. In case of filesystem
   // corruption ignore files that are way too big.
   int64_t size;
   if (!platform->GetFileSize(path, &size)) {
     LOG(ERROR) << "Unable to get file size for " << path;
     return false;
   }
   if (size > kMaxReadSize) {
     LOG(ERROR) << "File " << path << " too large: " << size;
     return false;
   }

   if (!platform->ReadFile(path, &ciphertext)) {
     LOG(ERROR) << "Data read failed from " << path;
     return false;
   }

   if (!hwsec_foundation::AesDecryptSpecifyBlockMode(
           ciphertext, 0, ciphertext.size(), encryption_key,
           brillo::Blob(hwsec_foundation::kAesBlockSize),
           hwsec_foundation::PaddingScheme::kPaddingStandard,
           hwsec_foundation::BlockMode::kCbc, plaintext)) {
     LOG(ERROR) << "Decryption failed for data from " << path;
     return false;
   }

   // The decryption is succeed when the plaintext size is correct.
   if (plaintext->size() != SHA256_DIGEST_LENGTH) {
     LOG(ERROR) << "Decryption result size mismatch for data from " << path
                << ", expected size:" << SHA256_DIGEST_LENGTH
                << ", actual size:" << plaintext->size();
     return false;
   }
   return true;
 }

 bool WriteKeyFile(libstorage::Platform* platform,
                   const base::FilePath& path,
                   const brillo::SecureBlob& plaintext,
                   const brillo::SecureBlob& encryption_key) {
   if (platform->FileExists(path)) {
     LOG(ERROR) << path << " already exists.";
     return false;
   }

   // Note that we pass an all-zeros IV. In general, this is dangerous since
   // identical plaintext will lead to identical ciphertext, revealing the fact
   // that the same message has been encrypted. This can potentially be used in
   // chosen plaintext attacks to determine the plaintext for a given ciphertext.
   // In the case at hand, we only ever encrypt a single message using the system
   // key and don't allow attackers to inject plaintext, so we are good.
   //
   // Ideally, we'd generate a random IV and stored it to disk as well, but
   // switching over to the safer scheme would have to be done in a
   // backwards-compatible way, so for now it isn't worth it.
   brillo::Blob ciphertext;
   if (!hwsec_foundation::AesEncryptSpecifyBlockMode(
           plaintext, 0, plaintext.size(), encryption_key,
           brillo::Blob(hwsec_foundation::kAesBlockSize),
           hwsec_foundation::PaddingScheme::kPaddingStandard,
           hwsec_foundation::BlockMode::kCbc, &ciphertext)) {
     LOG(ERROR) << "Encryption failed for " << path;
     return false;
   }

   if (!platform->WriteFileAtomicDurable(path, ciphertext, 0600)) {
     PLOG(ERROR) << "Unable to write " << path;
     return false;
   }

   return true;
 }

 brillo::SecureBlob Sha256(const std::string& str) {
   brillo::SecureBlob blob(str);
   return hwsec_foundation::Sha256(blob);
 }

 brillo::SecureBlob GetUselessKey() {
   return Sha256(kStaticKeyFinalizationNeeded);
 }

 // Extract the desired system key from the kernel's boot command line.
 brillo::SecureBlob GetKeyFromKernelCmdline(libstorage::Platform* platform,
                                            const base::FilePath rootdir) {
   std::string cmdline;
   if (!platform->ReadFileToString(rootdir.Append(paths::kKernelCmdline),
                                   &cmdline)) {
     PLOG(ERROR) << "Failed to read kernel command line";
     return brillo::SecureBlob();
   }

   // Find a string match either at start of string or following a space.
   size_t pos = cmdline.find(kKernelCmdlineOption);
   if (pos == std::string::npos || !(pos == 0 || cmdline[pos - 1] == ' ')) {
     return brillo::SecureBlob();
   }

   std::string value = cmdline.substr(pos + strlen(kKernelCmdlineOption));
   value = value.substr(0, value.find(' '));

   brillo::SecureBlob key = Sha256(value);
   return key;
 }

 }  // namespace

 EncryptionKey::EncryptionKey(libstorage::Platform* platform,
                              SystemKeyLoader* loader,
                              const base::FilePath& rootdir,
                              const base::FilePath& stateful_mount)
     : platform_(platform), loader_(loader), rootdir_(rootdir) {
   key_path_ = stateful_mount.Append(paths::kEncryptedKey);
   needs_finalization_path_ = stateful_mount.Append(paths::kNeedsFinalization);
   preservation_request_path_ =
       stateful_mount.Append(paths::kStatefulPreservationRequest);
   preserved_previous_key_path_ =
       stateful_mount.Append(paths::kPreservedPreviousKey);
 }

 bool EncryptionKey::SetTpmSystemKey() {
   bool rc = loader_->Load(&system_key_);
   if (rc) {
     LOG(INFO) << "Using NVRAM as system key; already populated.";
   } else {
     LOG(INFO) << "Using NVRAM as system key; finalization needed.";
   }

   return rc;
 }

 bool EncryptionKey::SetInsecureFallbackSystemKey() {
   system_key_ = GetKeyFromKernelCmdline(platform_, rootdir_);
   if (!system_key_.empty()) {
     LOG(INFO) << "Using kernel command line argument as system key.";
     system_key_status_ = SystemKeyStatus::kKernelCommandLine;
     return true;
   }

   std::string product_uuid;
   if (platform_->ReadFileToString(rootdir_.Append(paths::kProductUUID),
                                   &product_uuid)) {
     system_key_ = Sha256(base::ToUpperASCII(product_uuid));
     LOG(INFO) << "Using UUID as system key.";
     system_key_status_ = SystemKeyStatus::kProductUUID;
     return true;
   }

   LOG(INFO) << "Using default insecure system key.";
   system_key_ = Sha256(kStaticKeyDefault);
   system_key_status_ = SystemKeyStatus::kStaticFallback;
   return true;
 }

 bool EncryptionKey::LoadChromeOSSystemKey(base::FilePath backup) {
   SetTpmSystemKey();

   // Check and handle potential requests to preserve an already existing
   // encryption key in order to retain the existing stateful file system.
   if (system_key_.empty() &&
       platform_->FileExists(preservation_request_path_)) {
     // Move the previous key file to a different path and clear the request
     // before changing TPM state. This makes sure that we're not putting the
     // system into a state where the old key might get picked up accidentally
     // (even by previous versions of mount-encrypted on rollback) if we reboot
     // while the preservation process is not completed yet (for example due to
     // power loss).
     if (!platform_->Rename(key_path_, preserved_previous_key_path_)) {
       platform_->DeleteFile(key_path_);
     }
     platform_->DeleteFile(preservation_request_path_);
   }

   // Note that we must check for presence of a to-be-preserved key
   // unconditionally: If the preservation process doesn't complete on first
   // attempt (e.g. due to crash or power loss) but already took TPM ownership,
   // we might see a situation where there appears to be a valid system key but
   // we still must retry preservation to salvage the previous key.
   if (platform_->FileExists(preserved_previous_key_path_)) {
     RewrapPreviousEncryptionKey();

     // Preservation is done at this point even though it might have bailed or
     // failed. The code below will handle the potentially absent system key.
     platform_->DeleteFile(preserved_previous_key_path_);
   }

   // Attempt to generate a fresh system key if we haven't found one.
   if (system_key_.empty()) {
     LOG(INFO) << "Attempting to generate fresh NVRAM system key.";

     const brillo::SecureBlob key_material =
         hwsec_foundation::CreateSecureRandomBlob(SHA256_DIGEST_LENGTH);
     bool rc = loader_->Initialize(key_material, &system_key_);
     if (!rc) {
       LOG(ERROR) << "Failed to initialize system key NV space contents.";
       return false;
     }

     if (!system_key_.empty() && !loader_->Persist()) {
       LOG(WARNING) << "Unable to persist the key, will retry.";
       system_key_.clear();
     }

     if (!system_key_.empty() && !backup.empty()) {
       if (!platform_->WriteSecureBlobToFile(backup, key_material)) {
         LOG(WARNING)
             << "Unable to save TPM random seed, TPM tast test will fail.";
       }
     }
   }

   // Lock the system key to to prevent subsequent manipulation.
   loader_->Lock();

   // Determine and record the system key status.
   if (system_key_.empty()) {
     system_key_status_ = SystemKeyStatus::kFinalizationPending;
   } else if (loader_->UsingLockboxKey()) {
     system_key_status_ = SystemKeyStatus::kNVRAMLockbox;
   } else {
     system_key_status_ = SystemKeyStatus::kNVRAMEncstateful;
   }

   return true;
 }

 bool EncryptionKey::LoadEncryptionKey() {
   if (!system_key_.empty()) {
     if (ReadKeyFile(platform_, key_path_, &encryption_key_, system_key_)) {
       encryption_key_status_ = EncryptionKeyStatus::kKeyFile;
       return true;
     }
     LOG(INFO) << "Failed to load encryption key from disk.";
   } else {
     LOG(INFO) << "No usable system key found.";
   }

   // Delete any stale encryption key files from disk. This is important because
   // presence of the key file determines whether finalization requests from
   // cryptohome do need to write a key file.
   platform_->DeleteFile(key_path_);
   encryption_key_.clear();

   // Check if there's a to-be-finalized key on disk.
   if (!ReadKeyFile(platform_, needs_finalization_path_, &encryption_key_,
                    GetUselessKey())) {
     // This is a brand new system with no keys, so generate a fresh one.
     LOG(INFO) << "Generating new encryption key.";
     encryption_key_ =
         hwsec_foundation::CreateSecureRandomBlob(SHA256_DIGEST_LENGTH);
     encryption_key_status_ = EncryptionKeyStatus::kFresh;
   } else {
     encryption_key_status_ = EncryptionKeyStatus::kNeedsFinalization;
     LOG(ERROR) << "Finalization unfinished! Encryption key still on disk!";
   }

   // At this point, we have an encryption key but it has not been finalized yet
   // (i.e. encrypted under the system key and stored on disk in the key file).
   //
   // However, when we are creating the encrypted mount for the first time, the
   // TPM might not be in a state where we have a system key. In this case we
   // fall back to writing the obfuscated encryption key to disk (*sigh*).
   //
   // NB: We'd ideally never write an insufficiently protected key to disk. This
   // is already the case for TPM 2.0 devices as they can create system keys as
   // needed, and we can improve the situation for TPM 1.2 devices as well by (1)
   // using an NVRAM space that doesn't get lost on TPM clear and (2) allowing
   // mount-encrypted to take ownership and create the NVRAM space if necessary.
   if (system_key_.empty()) {
     if (is_fresh()) {
       LOG(INFO) << "Writing finalization intent " << needs_finalization_path_;
       if (!WriteKeyFile(platform_, needs_finalization_path_, encryption_key_,
                         GetUselessKey())) {
         LOG(ERROR) << "Failed to write " << needs_finalization_path_;
       }
     }
     return true;
   }

   // We have a system key, so finalize now.
   Finalize();

   return true;
 }

 brillo::SecureBlob EncryptionKey::GetDerivedSystemKey(
     const std::string& label) const {
   if (!system_key_.empty() &&
       system_key_status_ == EncryptionKey::SystemKeyStatus::kNVRAMEncstateful) {
     return hwsec_foundation::HmacSha256(system_key_, brillo::SecureBlob(label));
   }

   return brillo::SecureBlob();
 }

 void EncryptionKey::Finalize() {
   CHECK(!system_key_.empty());
   CHECK(!encryption_key_.empty());

   LOG(INFO) << "Writing keyfile " << key_path_;
   if (!WriteKeyFile(platform_, key_path_, encryption_key_, system_key_)) {
     LOG(ERROR) << "Failed to write " << key_path_;
     return;
   }

   // Finalization is complete at this point.
   did_finalize_ = true;

   // Make a best effort attempt to wipe the obfuscated key file from disk.
   if (platform_->FileExists(needs_finalization_path_)) {
     if (!platform_->DeleteFileSecurely(needs_finalization_path_)) {
       // We are unebale to erase the file properly, just do the minimum.
       LOG(ERROR) << "Failed to secure erase " << needs_finalization_path_
                  << ". Trying simple deletion.";
       platform_->DeleteFileDurable(needs_finalization_path_);
     }
   }
 }

 bool EncryptionKey::RewrapPreviousEncryptionKey() {
   // Key preservation has been requested, but we haven't performed the process
   // of carrying over the encryption key yet, or we have started and didn't
   // finish the last attempt.
   LOG(INFO) << "Attempting to preserve previous encryption key.";

   // Load the previous system key and set up a fresh system key to re-wrap the
   // encryption key.
   brillo::SecureBlob fresh_system_key;
   brillo::SecureBlob previous_system_key;
   if (!loader_->GenerateForPreservation(&previous_system_key,
                                         &fresh_system_key)) {
     return false;
   }

   brillo::SecureBlob previous_encryption_key;
   if (!ReadKeyFile(platform_, preserved_previous_key_path_,
                    &previous_encryption_key, previous_system_key)) {
     LOG(WARNING) << "Failed to decrypt preserved previous key, aborting.";
     return false;
   }

   // We have the previous encryption key at this point, so we're in business.
   // Re-wrap the encryption key under the new system key and store it to disk.
   platform_->DeleteFile(key_path_);
   if (!WriteKeyFile(platform_, key_path_, previous_encryption_key,
                     fresh_system_key)) {
     return false;
   }

   // Persist the fresh system key. It's important that the fresh system key gets
   // written to the NVRAM space as the last step (in particular, only after the
   // encryption key has been re-wrapped). Otherwise, a crash would lead to a
   // situation where the new system key has already replaced the old one,
   // leaving us with no way to recover the preserved encryption key.
   if (!loader_->Persist()) {
     return false;
   }

   // Success. Put the keys in place for later usage.
   system_key_ = std::move(fresh_system_key);

   LOG(INFO) << "Successfully preserved encryption key.";

   return true;
 }

 }  // namespace encryption
	// Copyright 2018 The ChromiumOS Authors
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "init/tpm_encryption/encryption_key.h"

	#include <fcntl.h>
	#include <sys/stat.h>
	#include <sys/types.h>

	#include <utility>

	#include <base/check.h>
	#include <base/files/file_util.h>
	#include <base/logging.h>
	#include <base/strings/string_number_conversions.h>
	#include <base/strings/string_util.h>
	#include <brillo/file_utils.h>
	#include <brillo/files/file_util.h>
	#include <libhwsec-foundation/crypto/aes.h>
	#include <libhwsec-foundation/crypto/hmac.h>
	#include <libhwsec-foundation/crypto/secure_blob_util.h>
	#include <libhwsec-foundation/crypto/sha.h>
	#include <libstorage/platform/platform.h>
	#include <openssl/sha.h>

	#include "init/tpm_encryption/tpm.h"

	namespace encryption {
	namespace paths {
	const char kKernelCmdline[] = "proc/cmdline";
	const char kProductUUID[] = "sys/class/dmi/id/product_uuid";
	// Using stateful partition mount point as base.
	const char kEncryptedKey[] = "encrypted.key";
	const char kNeedsFinalization[] = "encrypted.needs-finalization";
	const char kStatefulPreservationRequest[] = "preservation_request";
	const char kPreservedPreviousKey[] = "encrypted.key.preserved";
	} // namespace paths

	namespace {

	const char kKernelCmdlineOption[] = "encrypted-stateful-key=";
	const char kStaticKeyDefault[] = "default unsafe static key";
	const char kStaticKeyFinalizationNeeded[] = "needs finalization";

	const size_t kMaxReadSize = 4 * 1024;

	bool ReadKeyFile(libstorage::Platform* platform,
	const base::FilePath& path,
	brillo::SecureBlob* plaintext,
	const brillo::SecureBlob& encryption_key) {
	brillo::Blob ciphertext;

	// Check the file size: we expect to be really small. In case of filesystem
	// corruption ignore files that are way too big.
	int64_t size;
	if (!platform->GetFileSize(path, &size)) {
	LOG(ERROR) << "Unable to get file size for " << path;
	return false;
	}
	if (size > kMaxReadSize) {
	LOG(ERROR) << "File " << path << " too large: " << size;
	return false;
	}

	if (!platform->ReadFile(path, &ciphertext)) {
	LOG(ERROR) << "Data read failed from " << path;
	return false;
	}

	if (!hwsec_foundation::AesDecryptSpecifyBlockMode(
	ciphertext, 0, ciphertext.size(), encryption_key,
	brillo::Blob(hwsec_foundation::kAesBlockSize),
	hwsec_foundation::PaddingScheme::kPaddingStandard,
	hwsec_foundation::BlockMode::kCbc, plaintext)) {
	LOG(ERROR) << "Decryption failed for data from " << path;
	return false;
	}

	// The decryption is succeed when the plaintext size is correct.
	if (plaintext->size() != SHA256_DIGEST_LENGTH) {
	LOG(ERROR) << "Decryption result size mismatch for data from " << path
	<< ", expected size:" << SHA256_DIGEST_LENGTH
	<< ", actual size:" << plaintext->size();
	return false;
	}
	return true;
	}

	bool WriteKeyFile(libstorage::Platform* platform,
	const base::FilePath& path,
	const brillo::SecureBlob& plaintext,
	const brillo::SecureBlob& encryption_key) {
	if (platform->FileExists(path)) {
	LOG(ERROR) << path << " already exists.";
	return false;
	}

	// Note that we pass an all-zeros IV. In general, this is dangerous since
	// identical plaintext will lead to identical ciphertext, revealing the fact
	// that the same message has been encrypted. This can potentially be used in
	// chosen plaintext attacks to determine the plaintext for a given ciphertext.
	// In the case at hand, we only ever encrypt a single message using the system
	// key and don't allow attackers to inject plaintext, so we are good.
	//
	// Ideally, we'd generate a random IV and stored it to disk as well, but
	// switching over to the safer scheme would have to be done in a
	// backwards-compatible way, so for now it isn't worth it.
	brillo::Blob ciphertext;
	if (!hwsec_foundation::AesEncryptSpecifyBlockMode(
	plaintext, 0, plaintext.size(), encryption_key,
	brillo::Blob(hwsec_foundation::kAesBlockSize),
	hwsec_foundation::PaddingScheme::kPaddingStandard,
	hwsec_foundation::BlockMode::kCbc, &ciphertext)) {
	LOG(ERROR) << "Encryption failed for " << path;
	return false;
	}

	if (!platform->WriteFileAtomicDurable(path, ciphertext, 0600)) {
	PLOG(ERROR) << "Unable to write " << path;
	return false;
	}

	return true;
	}

	brillo::SecureBlob Sha256(const std::string& str) {
	brillo::SecureBlob blob(str);
	return hwsec_foundation::Sha256(blob);
	}

	brillo::SecureBlob GetUselessKey() {
	return Sha256(kStaticKeyFinalizationNeeded);
	}

	// Extract the desired system key from the kernel's boot command line.
	brillo::SecureBlob GetKeyFromKernelCmdline(libstorage::Platform* platform,
	const base::FilePath rootdir) {
	std::string cmdline;
	if (!platform->ReadFileToString(rootdir.Append(paths::kKernelCmdline),
	&cmdline)) {
	PLOG(ERROR) << "Failed to read kernel command line";
	return brillo::SecureBlob();
	}

	// Find a string match either at start of string or following a space.
	size_t pos = cmdline.find(kKernelCmdlineOption);
	if (pos == std::string::npos \|\| !(pos == 0 \|\| cmdline[pos - 1] == ' ')) {
	return brillo::SecureBlob();
	}

	std::string value = cmdline.substr(pos + strlen(kKernelCmdlineOption));
	value = value.substr(0, value.find(' '));

	brillo::SecureBlob key = Sha256(value);
	return key;
	}

	} // namespace

	EncryptionKey::EncryptionKey(libstorage::Platform* platform,
	SystemKeyLoader* loader,
	const base::FilePath& rootdir,
	const base::FilePath& stateful_mount)
	: platform_(platform), loader_(loader), rootdir_(rootdir) {
	key_path_ = stateful_mount.Append(paths::kEncryptedKey);
	needs_finalization_path_ = stateful_mount.Append(paths::kNeedsFinalization);
	preservation_request_path_ =
	stateful_mount.Append(paths::kStatefulPreservationRequest);
	preserved_previous_key_path_ =
	stateful_mount.Append(paths::kPreservedPreviousKey);
	}

	bool EncryptionKey::SetTpmSystemKey() {
	bool rc = loader_->Load(&system_key_);
	if (rc) {
	LOG(INFO) << "Using NVRAM as system key; already populated.";
	} else {
	LOG(INFO) << "Using NVRAM as system key; finalization needed.";
	}

	return rc;
	}

	bool EncryptionKey::SetInsecureFallbackSystemKey() {
	system_key_ = GetKeyFromKernelCmdline(platform_, rootdir_);
	if (!system_key_.empty()) {
	LOG(INFO) << "Using kernel command line argument as system key.";
	system_key_status_ = SystemKeyStatus::kKernelCommandLine;
	return true;
	}

	std::string product_uuid;
	if (platform_->ReadFileToString(rootdir_.Append(paths::kProductUUID),
	&product_uuid)) {
	system_key_ = Sha256(base::ToUpperASCII(product_uuid));
	LOG(INFO) << "Using UUID as system key.";
	system_key_status_ = SystemKeyStatus::kProductUUID;
	return true;
	}

	LOG(INFO) << "Using default insecure system key.";
	system_key_ = Sha256(kStaticKeyDefault);
	system_key_status_ = SystemKeyStatus::kStaticFallback;
	return true;
	}

	bool EncryptionKey::LoadChromeOSSystemKey(base::FilePath backup) {
	SetTpmSystemKey();

	// Check and handle potential requests to preserve an already existing
	// encryption key in order to retain the existing stateful file system.
	if (system_key_.empty() &&
	platform_->FileExists(preservation_request_path_)) {
	// Move the previous key file to a different path and clear the request
	// before changing TPM state. This makes sure that we're not putting the
	// system into a state where the old key might get picked up accidentally
	// (even by previous versions of mount-encrypted on rollback) if we reboot
	// while the preservation process is not completed yet (for example due to
	// power loss).
	if (!platform_->Rename(key_path_, preserved_previous_key_path_)) {
	platform_->DeleteFile(key_path_);
	}
	platform_->DeleteFile(preservation_request_path_);
	}

	// Note that we must check for presence of a to-be-preserved key
	// unconditionally: If the preservation process doesn't complete on first
	// attempt (e.g. due to crash or power loss) but already took TPM ownership,
	// we might see a situation where there appears to be a valid system key but
	// we still must retry preservation to salvage the previous key.
	if (platform_->FileExists(preserved_previous_key_path_)) {
	RewrapPreviousEncryptionKey();

	// Preservation is done at this point even though it might have bailed or
	// failed. The code below will handle the potentially absent system key.
	platform_->DeleteFile(preserved_previous_key_path_);
	}

	// Attempt to generate a fresh system key if we haven't found one.
	if (system_key_.empty()) {
	LOG(INFO) << "Attempting to generate fresh NVRAM system key.";

	const brillo::SecureBlob key_material =
	hwsec_foundation::CreateSecureRandomBlob(SHA256_DIGEST_LENGTH);
	bool rc = loader_->Initialize(key_material, &system_key_);
	if (!rc) {
	LOG(ERROR) << "Failed to initialize system key NV space contents.";
	return false;
	}

	if (!system_key_.empty() && !loader_->Persist()) {
	LOG(WARNING) << "Unable to persist the key, will retry.";
	system_key_.clear();
	}

	if (!system_key_.empty() && !backup.empty()) {
	if (!platform_->WriteSecureBlobToFile(backup, key_material)) {
	LOG(WARNING)
	<< "Unable to save TPM random seed, TPM tast test will fail.";
	}
	}
	}

	// Lock the system key to to prevent subsequent manipulation.
	loader_->Lock();

	// Determine and record the system key status.
	if (system_key_.empty()) {
	system_key_status_ = SystemKeyStatus::kFinalizationPending;
	} else if (loader_->UsingLockboxKey()) {
	system_key_status_ = SystemKeyStatus::kNVRAMLockbox;
	} else {
	system_key_status_ = SystemKeyStatus::kNVRAMEncstateful;
	}

	return true;
	}

	bool EncryptionKey::LoadEncryptionKey() {
	if (!system_key_.empty()) {
	if (ReadKeyFile(platform_, key_path_, &encryption_key_, system_key_)) {
	encryption_key_status_ = EncryptionKeyStatus::kKeyFile;
	return true;
	}
	LOG(INFO) << "Failed to load encryption key from disk.";
	} else {
	LOG(INFO) << "No usable system key found.";
	}

	// Delete any stale encryption key files from disk. This is important because
	// presence of the key file determines whether finalization requests from
	// cryptohome do need to write a key file.
	platform_->DeleteFile(key_path_);
	encryption_key_.clear();

	// Check if there's a to-be-finalized key on disk.
	if (!ReadKeyFile(platform_, needs_finalization_path_, &encryption_key_,
	GetUselessKey())) {
	// This is a brand new system with no keys, so generate a fresh one.
	LOG(INFO) << "Generating new encryption key.";
	encryption_key_ =
	hwsec_foundation::CreateSecureRandomBlob(SHA256_DIGEST_LENGTH);
	encryption_key_status_ = EncryptionKeyStatus::kFresh;
	} else {
	encryption_key_status_ = EncryptionKeyStatus::kNeedsFinalization;
	LOG(ERROR) << "Finalization unfinished! Encryption key still on disk!";
	}

	// At this point, we have an encryption key but it has not been finalized yet
	// (i.e. encrypted under the system key and stored on disk in the key file).
	//
	// However, when we are creating the encrypted mount for the first time, the
	// TPM might not be in a state where we have a system key. In this case we
	// fall back to writing the obfuscated encryption key to disk (sigh).
	//
	// NB: We'd ideally never write an insufficiently protected key to disk. This
	// is already the case for TPM 2.0 devices as they can create system keys as
	// needed, and we can improve the situation for TPM 1.2 devices as well by (1)
	// using an NVRAM space that doesn't get lost on TPM clear and (2) allowing
	// mount-encrypted to take ownership and create the NVRAM space if necessary.
	if (system_key_.empty()) {
	if (is_fresh()) {
	LOG(INFO) << "Writing finalization intent " << needs_finalization_path_;
	if (!WriteKeyFile(platform_, needs_finalization_path_, encryption_key_,
	GetUselessKey())) {
	LOG(ERROR) << "Failed to write " << needs_finalization_path_;
	}
	}
	return true;
	}

	// We have a system key, so finalize now.
	Finalize();

	return true;
	}

	brillo::SecureBlob EncryptionKey::GetDerivedSystemKey(
	const std::string& label) const {
	if (!system_key_.empty() &&
	system_key_status_ == EncryptionKey::SystemKeyStatus::kNVRAMEncstateful) {
	return hwsec_foundation::HmacSha256(system_key_, brillo::SecureBlob(label));
	}

	return brillo::SecureBlob();
	}

	void EncryptionKey::Finalize() {
	CHECK(!system_key_.empty());
	CHECK(!encryption_key_.empty());

	LOG(INFO) << "Writing keyfile " << key_path_;
	if (!WriteKeyFile(platform_, key_path_, encryption_key_, system_key_)) {
	LOG(ERROR) << "Failed to write " << key_path_;
	return;
	}

	// Finalization is complete at this point.
	did_finalize_ = true;

	// Make a best effort attempt to wipe the obfuscated key file from disk.
	if (platform_->FileExists(needs_finalization_path_)) {
	if (!platform_->DeleteFileSecurely(needs_finalization_path_)) {
	// We are unebale to erase the file properly, just do the minimum.
	LOG(ERROR) << "Failed to secure erase " << needs_finalization_path_
	<< ". Trying simple deletion.";
	platform_->DeleteFileDurable(needs_finalization_path_);
	}
	}
	}

	bool EncryptionKey::RewrapPreviousEncryptionKey() {
	// Key preservation has been requested, but we haven't performed the process
	// of carrying over the encryption key yet, or we have started and didn't
	// finish the last attempt.
	LOG(INFO) << "Attempting to preserve previous encryption key.";

	// Load the previous system key and set up a fresh system key to re-wrap the
	// encryption key.
	brillo::SecureBlob fresh_system_key;
	brillo::SecureBlob previous_system_key;
	if (!loader_->GenerateForPreservation(&previous_system_key,
	&fresh_system_key)) {
	return false;
	}

	brillo::SecureBlob previous_encryption_key;
	if (!ReadKeyFile(platform_, preserved_previous_key_path_,
	&previous_encryption_key, previous_system_key)) {
	LOG(WARNING) << "Failed to decrypt preserved previous key, aborting.";
	return false;
	}

	// We have the previous encryption key at this point, so we're in business.
	// Re-wrap the encryption key under the new system key and store it to disk.
	platform_->DeleteFile(key_path_);
	if (!WriteKeyFile(platform_, key_path_, previous_encryption_key,
	fresh_system_key)) {
	return false;
	}

	// Persist the fresh system key. It's important that the fresh system key gets
	// written to the NVRAM space as the last step (in particular, only after the
	// encryption key has been re-wrapped). Otherwise, a crash would lead to a
	// situation where the new system key has already replaced the old one,
	// leaving us with no way to recover the preserved encryption key.
	if (!loader_->Persist()) {
	return false;
	}

	// Success. Put the keys in place for later usage.
	system_key_ = std::move(fresh_system_key);

	LOG(INFO) << "Successfully preserved encryption key.";

	return true;
	}

	} // namespace encryption