[lkml]   [2004]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Using compression before encryption in device-mapper
I think that not only compression should be moved to fs layer but 
possibly encryption also.

In Reiser4 there are plugins.
In other fses (as far as I remember e2compr and maybe other posts on
this list) there is only one bigger problem with compression and only if
we want to support mmap (I do not remember more details about the problem)
and the problem is somewhere between current mm and vfs implementation. I
think that (probably) Linus said once that this problem can be solved by
changing these implementations. The same probably goes for encryption.
In order to protect guessing the key from decrypting possibly-well-known
values in superblock and other metadata (cuch as fs size and signature) we
could probably place random numbers before them and xor each 4 bytes with
last 4 bytes before encryption (or use any other hash function).

Because in dm approach you are encrypting entire blocks at once and in fs
approach you are encrypting only needed parts. This can even bring more
security because if fs is merging small files into one block and if it is
patched to move begining of not full block data into random position in
that block attacker must crack all fs and its metadata structures to know
where your data actually is and what key is used to encrypt them (we can
have several different keys for different parts of fs to make things
harder). So we can have situation that in one block there is 2 or 3 or
maybe more files (or parts) encrypted using different keys and hashes and
that these files reside at different offsets in that block. I think that
this is easier to implement and protects better.

What do you think?

Grzegorz Kulewski

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:02    [W:0.070 / U:1.312 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site