Linux Encryption Driver Module

This Linux kernel module creates a character device (/dev/encryption_device) that accepts input data, encrypts it using AES in CBC mode, and stores it in memory. It supports basic read/write operations for testing encrypted data flow between kernel space and user space.

---

Features

• AES-128 encryption using the kernel crypto API
• Character device interface
• Simple in-kernel storage buffer
• Module signing support for Secure Boot

---

Prerequisites

• Linux kernel headers
• GCC, make
• Secure Boot enabled (optional, requires MOK enrollment)
• Tools: openssl, mokutil, dd

---

Generate and Enroll a MOK Key (for Secure Boot)

1. Generate a key pair:

openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "/CN=MyModuleKey/"

2. Enroll the public key (MOK.der):

sudo mokutil --import MOK.der

Then reboot and complete enrollment via the MOK Manager menu.

---

Implementation

1. Build the module

Change into the respective directory after cloning and then build the module.

make

2. Sign the module

sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 MOK.priv MOK.der encryption_device.ko

3. Load the module

sudo insmod encryption_device.ko

4. Set permissions

sudo chmod 666 /dev/encryption_device

5. Example Usage

• Write some input data

cat <<EOF > input.txt
 This is a test file for encryption.
It contains multiple lines of text.
The encryption device should securely store and retrieve this data.
Let's see how it works
EOF

• Write to the device (encrypts and stores)

dd if=input.txt of=/dev/encryption_device bs=256

• Read from the device (gets stored, encrypted data)

dd if=/dev/encryption_device of=encrypted.txt bs=256

6. View the Result

cat encrypted.txt

7. Unload the Module

sudo rmmod encryption_device

8. Clean Build Artifacts

make clean

By following these steps, an encrypted.txt file is generated containing the encrypted data. Since the content is encrypted, it appears in a non-human-readable format and can only be properly interpreted by decrypting it using the same kernel module.