luks-core 0.1.4

Pure-Rust LUKS1/LUKS2 reader and decryptor — parse the on-disk header, derive the master key, and decrypt the payload. Panic-free, no unsafe.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

//! # luks-core — pure-Rust LUKS reader and decryptor
//!
//! Parse a LUKS container's on-disk header, recover the master key from a
//! passphrase, and decrypt the payload. Panic-free and `forbid(unsafe)`: every
//! integer is read bounds-checked, every crypto primitive is an audited
//! RustCrypto crate.
//!
//! ```no_run
//! use std::fs::File;
//! let mut vol = luks::LuksVolume::unlock1_with_passphrase(
//!     File::open("container.luks")?,
//!     b"passphrase",
//! )?;
//! let mut first = [0u8; 512];
//! vol.read_at(0, &mut first)?;
//! # Ok::<(), Box<dyn std::error::Error>>(())
//! ```
//!
//! Correctness is validated against `cryptsetup` on real containers (Tier-2);
//! see `docs/validation.md`.

#![forbid(unsafe_code)]
#![cfg_attr(test, allow(clippy::unwrap_used, clippy::expect_used))]

mod af;
mod bytes;
mod crypto;
mod error;
mod header;
mod header2;
#[cfg(feature = "vfs")]
pub mod vfs;
#[cfg(feature = "vfs")]
pub use vfs::LuksLayer;
mod volume;

pub use error::{LuksError, Result};
pub use header::{Keyslot, Luks1Header};
pub use header2::{Luks2Digest, Luks2Header, Luks2Kdf, Luks2Keyslot, Luks2Segment};
pub use volume::{DecryptedPayload, LuksVolume, VolumeInfo};

/// Fuzz-only re-export (hidden from docs). Kept `pub` so the `core/fuzz` crate
/// can drive the anti-forensic merge over arbitrary bytes directly, alongside
/// the header parsers and the full unlock pipeline.
#[doc(hidden)]
pub use af::merge as af_merge;