Richard W.M. JonesandDaniel P. Berrangé e1a6dc91dd crypto: Implement TLS Pre-Shared Keys (PSK). ...

Pre-Shared Keys (PSK) is a simpler mechanism for enabling TLS
connections than using certificates.  It requires only a simple secret
key:

  $ mkdir -m 0700 /tmp/keys
  $ psktool -u rjones -p /tmp/keys/keys.psk
  $ cat /tmp/keys/keys.psk
  rjones:d543770c15ad93d76443fb56f501a31969235f47e999720ae8d2336f6a13fcbc

The key can be secretly shared between clients and servers.  Clients
must specify the directory containing the "keys.psk" file and a
username (defaults to "qemu").  Servers must specify only the
directory.

Example NBD client:

  $ qemu-img info \
    --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=rjones,endpoint=client \
    --image-opts \
    file.driver=nbd,file.host=localhost,file.port=10809,file.tls-creds=tls0,file.export=/

Example NBD server using qemu-nbd:

  $ qemu-nbd -t -x / \
    --object tls-creds-psk,id=tls0,endpoint=server,dir=/tmp/keys \
    --tls-creds tls0 \
    image.qcow2

Example NBD server using nbdkit:

  $ nbdkit -n -e / -fv \
    --tls=on --tls-psk=/tmp/keys/keys.psk \
    file file=disk.img

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

2018-07-03 13:04:38 +01:00

..

aes.c

crypto: Clean up includes

2016-01-29 15:07:22 +00:00

afalg.c

crypto: introduce some common functions for af_alg backend

2017-07-19 10:11:05 +01:00

afalgpriv.h

crypto: hash: add afalg-backend hash support

2017-07-19 10:11:05 +01:00

afsplit.c

qemu-common: stop including qemu/bswap.h from qemu-common.h

2016-05-19 16:42:28 +02:00

block-luks.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

block-luks.h

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

block-qcow.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

block-qcow.h

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

block.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

blockpriv.h

block: convert qcrypto_block_encrypt|decrypt to take bytes offset

2017-10-06 16:30:47 +02:00

cipher-afalg.c

qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)

2017-09-04 13:09:13 +02:00

cipher-builtin.c

qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)

2017-09-04 13:09:13 +02:00

cipher-gcrypt.c

qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)

2017-09-04 13:09:13 +02:00

cipher-nettle.c

qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)

2017-09-04 13:09:13 +02:00

cipher.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

cipherpriv.h

Include less of the generated modular QAPI headers

2018-03-02 13:45:50 -06:00

desrfb.c

crypto: Clean up includes

2016-01-29 15:07:22 +00:00

hash-afalg.c

crypto: hmac: add af_alg-backend hmac support

2017-07-19 10:11:05 +01:00

hash-gcrypt.c

crypto: hash: add hash driver framework

2017-07-19 10:11:04 +01:00

hash-glib.c

glib: bump min required glib library version to 2.40

2018-06-29 12:22:28 +01:00

hash-nettle.c

crypto: hash: add hash driver framework

2017-07-19 10:11:04 +01:00

hash.c

Include qapi/error.h exactly where needed

2018-02-09 13:50:17 +01:00

hashpriv.h

crypto: hash: add afalg-backend hash support

2017-07-19 10:11:05 +01:00

hmac-gcrypt.c

qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)

2017-09-04 13:09:13 +02:00

hmac-glib.c

glib: bump min required glib library version to 2.40

2018-06-29 12:22:28 +01:00

hmac-nettle.c

qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)

2017-09-04 13:09:13 +02:00

hmac.c

Include qapi/error.h exactly where needed

2018-02-09 13:50:17 +01:00

hmacpriv.h

crypto: hmac: add af_alg-backend hmac support

2017-07-19 10:11:05 +01:00

init.c

crypto: qcrypto_random_bytes() now works on windows w/o any other crypto libs

2017-05-09 14:41:47 +01:00

ivgen-essiv.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

ivgen-essiv.h

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

ivgen-plain64.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

ivgen-plain64.h

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

ivgen-plain.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

ivgen-plain.h

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

ivgen.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

ivgenpriv.h

Clean up header guards that don't match their file name

2016-07-12 16:19:16 +02:00

Makefile.objs

crypto: Implement TLS Pre-Shared Keys (PSK).

2018-07-03 13:04:38 +01:00

pbkdf-gcrypt.c

qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)

2017-09-04 13:09:13 +02:00

pbkdf-nettle.c

qapi: Mechanically convert FOO_lookup[...] to FOO_str(...)

2017-09-04 13:09:13 +02:00

pbkdf-stub.c

crypto: use uint64_t for pbkdf iteration count parameters

2016-09-19 16:30:42 +01:00

pbkdf.c

crypto: use correct derived key size when timing pbkdf

2016-09-19 16:30:45 +01:00

random-gcrypt.c

crypto: qcrypto_random_bytes() now works on windows w/o any other crypto libs

2017-05-09 14:41:47 +01:00

random-gnutls.c

Include qapi/error.h exactly where needed

2018-02-09 13:50:17 +01:00

random-platform.c

Include qapi/error.h exactly where needed

2018-02-09 13:50:17 +01:00

secret.c

qapi: Change data type of the FOO_lookup generated for enum FOO

2017-09-04 13:09:13 +02:00

tlscreds.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

tlscredsanon.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

tlscredspriv.h

Clean up header guards that don't match their file name

2016-07-12 16:19:16 +02:00

tlscredspsk.c

crypto: Implement TLS Pre-Shared Keys (PSK).

2018-07-03 13:04:38 +01:00

tlscredsx509.c

crypto: use local path for local headers

2018-06-01 19:20:37 +03:00

tlssession.c

crypto: Implement TLS Pre-Shared Keys (PSK).

2018-07-03 13:04:38 +01:00

trace-events

crypto: Implement TLS Pre-Shared Keys (PSK).

2018-07-03 13:04:38 +01:00

xts.c

crypto: import an implementation of the XTS cipher mode

2016-03-17 14:41:15 +00:00