Messages in this thread | | | Date | Mon, 21 Feb 2000 20:39:59 +0100 | Subject | Re: Userland encrypted filesystem that root cannot access. | From | (Grendel) |
| |
** On Feb 21, H. Peter Anvin scribbled: > Grendel wrote: > > > > > > While mounted? No. Root has access to the entire machine and > > Why not? Just never decrypt data on fs read. Feed the client with encrypted > > data and leave it to them to decrypt it. > > > > Then it's not an encrypted **FILESYSTEM**. Application level encryption > is a whole other matter. Even so, root can intercept the client process > and read the data out of its memory. The file system can have two modes of operation: encrypt only, encrypt/decrypt. In the first mode the data written is encrypted but data read is sent as-is to the client which must take care of the decryption process. The first mode eliminates the other possibility you mentioned of intercepting the user's process in case when that process is running on another machine and data is transferred encrypted. It might seem that having a file system that only encrypts written data makes little sense, but I think that it would have its use in situation Mike described - nobody, even root, wouldn't be able to read anything from the FS - it would be like a black hole. Of course, it would require an userland implementation of the FS driver as well to read the FS data or the FS would have to be exported using nbd, for example, and mounted on the other (secure) machine in encrypt/decrypt mode. With the assumption that the workstation mounting the FS is used only by authorized personnel, the entire affair is completely secure.
marek [unhandled content-type:application/pgp-signature] | |