lkml.org 
[lkml]   [2004]   [Apr]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Using compression before encryption in device-mapper
    I think that not only compression should be moved to fs layer but 
    possibly encryption also.

    How?
    In Reiser4 there are plugins.
    In other fses (as far as I remember e2compr and maybe other posts on
    this list) there is only one bigger problem with compression and only if
    we want to support mmap (I do not remember more details about the problem)
    and the problem is somewhere between current mm and vfs implementation. I
    think that (probably) Linus said once that this problem can be solved by
    changing these implementations. The same probably goes for encryption.
    In order to protect guessing the key from decrypting possibly-well-known
    values in superblock and other metadata (cuch as fs size and signature) we
    could probably place random numbers before them and xor each 4 bytes with
    last 4 bytes before encryption (or use any other hash function).

    Why?
    Because in dm approach you are encrypting entire blocks at once and in fs
    approach you are encrypting only needed parts. This can even bring more
    security because if fs is merging small files into one block and if it is
    patched to move begining of not full block data into random position in
    that block attacker must crack all fs and its metadata structures to know
    where your data actually is and what key is used to encrypt them (we can
    have several different keys for different parts of fs to make things
    harder). So we can have situation that in one block there is 2 or 3 or
    maybe more files (or parts) encrypted using different keys and hashes and
    that these files reside at different offsets in that block. I think that
    this is easier to implement and protects better.

    What do you think?


    Grzegorz Kulewski

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:02    [W:0.035 / U:0.024 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site