[lkml]   [2004]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Using compression before encryption in device-mapper
    I think that not only compression should be moved to fs layer but 
    possibly encryption also.

    In Reiser4 there are plugins.
    In other fses (as far as I remember e2compr and maybe other posts on
    this list) there is only one bigger problem with compression and only if
    we want to support mmap (I do not remember more details about the problem)
    and the problem is somewhere between current mm and vfs implementation. I
    think that (probably) Linus said once that this problem can be solved by
    changing these implementations. The same probably goes for encryption.
    In order to protect guessing the key from decrypting possibly-well-known
    values in superblock and other metadata (cuch as fs size and signature) we
    could probably place random numbers before them and xor each 4 bytes with
    last 4 bytes before encryption (or use any other hash function).

    Because in dm approach you are encrypting entire blocks at once and in fs
    approach you are encrypting only needed parts. This can even bring more
    security because if fs is merging small files into one block and if it is
    patched to move begining of not full block data into random position in
    that block attacker must crack all fs and its metadata structures to know
    where your data actually is and what key is used to encrypt them (we can
    have several different keys for different parts of fs to make things
    harder). So we can have situation that in one block there is 2 or 3 or
    maybe more files (or parts) encrypted using different keys and hashes and
    that these files reside at different offsets in that block. I think that
    this is easier to implement and protects better.

    What do you think?

    Grzegorz Kulewski

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:02    [W:0.020 / U:2.544 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site