Messages in this thread | | | Date | Sat, 25 Mar 2006 14:28:21 -0500 | From | Phillip Susi <> | Subject | Re: eCryptfs Design Document |
| |
Michael Halcrow wrote: > * A mount-wide passphrase is stored in the user session > keyring in the form of an authentication token.
I'm a bit confused because you appear to be contradicting yourself. You say several times that a mount-wide passphrase is used for the master key. If that is the case, then it would be given at mount time and be bound to the super block. You also then say that the master key is stored in the kernel keyring. If that is the case, then you don't have to know the key at mount time, rather the key is associated with a given process or group of processes and will be required when such a process attempts to open a file on that mount point. This would also allow different users to use different keys.
So which is it? Is the master key bound to the superblock, or to the session keyring? Or am I just confused about the meaning of the kernel keyring?
> passphrase into a key follows the S2K process as described in RFC > 2440, in that the passphrase is concatenated with a salt; that data > block is then iteratively MD5-hashed 65,536 times to generate the key > that encrypts the file encryption key.
Are you saying that you salt the passphrase, hash that, then hash the hash, then hash that hash, and so on? What good does repeatedly hashing the hash do? Simply hashing the salted passphrase should be sufficient to obtain a key.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |