Messages in this thread | | | Date | Tue, 23 Dec 2003 12:14:12 +0100 | Subject | Re: loop driver, device-mapper and crypto | From | Fruhwirth Clemens <> |
| |
On Mon, Dec 22, 2003 at 02:03:05PM -0800, Andrew Morton wrote: > Christophe Saout <christophe@saout.de> wrote: > > > > In 2.6 we have a device-mapper which does such things in a much more > > generic way. I've already talked to a bunch of people working on loop > > and cryptoloop (also with Clemens Fruhwirth, the cryptoloop maintainer) > > and they all agreed that device-mapper is probably the most correct way > > to go, and would be happier if the loop driver was used for files only. > > I'm not a crypto-loop user, so I am not in a position to judge whether > using dm for crypto-on-disk is feature-sufficient and adequate from an > operational point of view.
First of all, eventhou I'm the maintainer of cryptoloop, when Christophe posted the first time I immediately recognized that dm-crypt is vastly superior to cryptoloop for a number of reasons:
.) It does not suffer from loop.c bugs (There are a lot, no maintainer) .) dm-crypt does not depend on special user space tool (util-linux) .) dm-crypt uses mempool, which makes it rock stable compared to cryptoloop.
From an operational point of view, patching util-linux has been the most troublesome point. Lot's of incompatible inofficial patches floating around in the net, while the last release of util-linux provides a broken and IMHO insecure why of setting up cryptokeys. Further: To fix the design flaw of unencrypted/unhashed IV vectors one has to add another setup parameter. That's where I really do like the flexible interface dm has.
> However I suspect that there will be a migration issue, and that we should > continue to work to get crypto-loop functioning well, plan to remove it > from 2.8, yes?
We should support cryptoloop. No new features, but working well. At the same time we should declare it 'deprecated' and provide dm-crypt as alternative. I'm happy to provide documentation on how to migrate.
I will review Christophe's patch as well as test compatiblity with cryptoloop. Expect my results in a few days.
Regards, Clemens [unhandled content-type:application/pgp-signature] | |