From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AQUrawGr-xI4 for ; Thu, 1 Sep 2011 12:51:42 +0200 (CEST) Received: from mailout-eu.gmx.com (mailout-eu.gmx.com [213.165.64.43]) by mail.saout.de (Postfix) with SMTP for ; Thu, 1 Sep 2011 12:51:42 +0200 (CEST) Message-ID: <4E5F63BA.2070701@gmx.com> Date: Thu, 01 Sep 2011 13:51:38 +0300 From: Yaron Sheffer MIME-Version: 1.0 References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [dm-crypt] Blog post on FDE and integrity protection List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de Hi Arno, Thank you for reviewing my post. Please see my comments below. Thanks, Yaron > Message: 3 > Date: Wed, 31 Aug 2011 23:29:40 +0200 > From: Arno Wagner > To: dm-crypt@saout.de > Subject: Re: [dm-crypt] Blog post on FDE and integrity protection > Message-ID:<20110831212940.GB25013@tansi.org> > Content-Type: text/plain; charset=us-ascii > > > Commercial, for sure. It combines fragments from well-known > facts and marketing speech. And it has not understood the > problem, advertizing for SAN/cloud services, where storage is > not block-based but file-based. The most commonly used public cloud is Amazon WS. This cloud offers two storage possibilities, S3 which is object ("file") storage, and EBS which is block storage, and is exposed to the application as a disk volume. The post is about EBS, sorry if that wasn't clear. > I should also note to anyone contemplating "solution" 3 > that RAID1 does not read both devices on read access, > and inconsistencies will only show up if you or your > distro does RAID consistency checks. This is correct, thanks. > And of course the whole article does not apply to the > SAN/cloud setting in the first place, as the attack > scenario is for an unmapped encrypted filesystem and > an attacker getting write access to that, i.e. the > encrypted raw (block) view needs to be exported to > the attacker. I do not see how that would be done in the > SAN/Cloud setting. These do their own filesystem > and block encryption must be done below the FS layer, > there is no way around that. The attack scenario is for someone who has access (possibly limited access) to your cloud account to detach your EBS volume from its current virtual server, attach it to a different server, and then modify the (encrypted) storage. This is all completely doable and actually standard procedure on AWS. > > Arno > > > > On Wed, Aug 31, 2011 at 04:25:51PM +0200, Heinz Diehl wrote: >> On 31.08.2011, Yaron Sheffer wrote: >> >> [....] >> >> In what way is this related to LUKS / dmcrypt? >> It's plain advertising, isn't it? Gaah! >> >> >> >> >> _______________________________________________ >> dm-crypt mailing list >> dm-crypt@saout.de >> http://www.saout.de/mailman/listinfo/dm-crypt >>