qemu/qapi/crypto.json

1 # -*- Mode: Python -*-
30 # @raw: raw bytes.  When encoded in JSON only valid UTF-8 sequences
47 # @sha1: SHA-1.  Should not be used in any new code, legacy compat only
49 # @sha224: SHA-224.  (since 2.7)
51 # @sha256: SHA-256.  Current recommended strong hash.
53 # @sha384: SHA-384.  (since 2.7)
55 # @sha512: SHA-512.  (since 2.7)
57 # @ripemd160: RIPEMD-160.  (since 2.7)
71 # @aes-128: AES with 128 bit / 16 byte keys
73 # @aes-192: AES with 192 bit / 24 byte keys
75 # @aes-256: AES with 256 bit / 32 byte keys
82 # @cast5-128: Cast5 with 128 bit / 16 byte keys
84 # @serpent-128: Serpent with 128 bit / 16 byte keys
86 # @serpent-192: Serpent with 192 bit / 24 byte keys
88 # @serpent-256: Serpent with 256 bit / 32 byte keys
90 # @twofish-128: Twofish with 128 bit / 16 byte keys
92 # @twofish-192: Twofish with 192 bit / 24 byte keys
94 # @twofish-256: Twofish with 256 bit / 32 byte keys
101   'data': ['aes-128', 'aes-192', 'aes-256',
103            'cast5-128',
104            'serpent-128', 'serpent-192', 'serpent-256',
105            'twofish-128', 'twofish-192', 'twofish-256',
132 # compatibility with pre-existing Linux dm-crypt volumes is required.
134 # @plain: 64-bit sector number truncated to 32-bits
136 # @plain64: 64-bit sector number
138 # @essiv: 64-bit sector number encrypted with a hash of the encryption
151 # @qcow: QCow/QCow2 built-in AES-CBC encryption.  Use only for
176 # The options that apply to QCow/QCow2 AES-CBC encryption format
178 # @key-secret: the ID of a QCryptoSecret object providing the
185   'data': { '*key-secret': 'str' }}
192 # @key-secret: the ID of a QCryptoSecret object providing the
199   'data': { '*key-secret': 'str' }}
206 # @cipher-alg: the cipher algorithm for data encryption.  Currently
207 #     defaults to 'aes-256'.
209 # @cipher-mode: the cipher mode for data encryption.  Currently
212 # @ivgen-alg: the initialization vector generator.  Currently defaults
215 # @ivgen-hash-alg: the initialization vector generator hash.
218 # @hash-alg: the master key hash algorithm.  Currently defaults to
221 # @iter-time: number of milliseconds to spend in PBKDF passphrase
222 #     processing.  Currently defaults to 2000.  (since 2.8)
228   'data': { '*cipher-alg': 'QCryptoCipherAlgo',
229             '*cipher-mode': 'QCryptoCipherMode',
230             '*ivgen-alg': 'QCryptoIVGenAlgo',
231             '*ivgen-hash-alg': 'QCryptoHashAlgo',
232             '*hash-alg': 'QCryptoHashAlgo',
233             '*iter-time': 'int' }}
283 # @key-offset: offset to the key material in bytes
295            'key-offset': 'int' } }
302 # @cipher-alg: the cipher algorithm for data encryption
304 # @cipher-mode: the cipher mode for data encryption
306 # @ivgen-alg: the initialization vector generator
308 # @ivgen-hash-alg: the initialization vector generator hash
310 # @hash-alg: the master key hash algorithm
312 # @detached-header: whether the LUKS header is detached (Since 9.0)
314 # @payload-offset: offset to the payload data in bytes
316 # @master-key-iters: number of PBKDF2 iterations for key material
325   'data': {'cipher-alg': 'QCryptoCipherAlgo',
326            'cipher-mode': 'QCryptoCipherMode',
327            'ivgen-alg': 'QCryptoIVGenAlgo',
328            '*ivgen-hash-alg': 'QCryptoHashAlgo',
329            'hash-alg': 'QCryptoHashAlgo',
330            'detached-header': 'bool',
331            'payload-offset': 'int',
332            'master-key-iters': 'int',
366 # This struct defines the update parameters that activate/de-activate
371 # @new-secret: The ID of a QCryptoSecret object providing the password
374 # @old-secret: Optional (for deactivation only).  If given will
378 # @iter-time: Optional (for activation only).  Number of milliseconds to
379 #     spend in PBKDF passphrase processing for the newly activated
399             '*new-secret': 'str',
400             '*old-secret': 'str',
402             '*iter-time': 'int',
422 # Properties for objects of classes derived from secret-common.
433 #     16-byte IV.  Mandatory if @keyid is given.  Ignored if @keyid is
478 # Properties for objects of classes derived from tls-creds.
480 # @verify-peer: if true the peer credentials will be verified once the
481 #     handshake is completed.  This is a no-op for anonymous
491 #     https://gnutls.org/manual/html_node/Priority-Strings.html
496   'data': { '*verify-peer': 'bool',
504 # Properties for tls-creds-anon objects.
515 # Properties for tls-creds-psk objects.
530 # Properties for tls-creds-x509 objects.
532 # @sanity-check: if true, perform some sanity checks before using the
535 # @passwordid: For the server-key.pem and client-key.pem files which
545   'data': { '*sanity-check': 'bool',
592 # @hash-alg: QCryptoHashAlgo
594 # @padding-alg: QCryptoRSAPaddingAlgo
599   'data': { 'hash-alg':'QCryptoHashAlgo',
600             'padding-alg': 'QCryptoRSAPaddingAlgo'}}