From: Darren J Moffat <Darren.Moffat@Oracle.COM>
To: The development of GNU GRUB <grub-devel@gnu.org>
Cc: "Vladimir 'φ-coder/phcoder' Serbinenko" <phcoder@gmail.com>
Subject: Re: Keyfile Support for GRUBs LUKS
Date: Mon, 25 Nov 2013 10:38:40 +0000 [thread overview]
Message-ID: <529328B0.8000904@Oracle.COM> (raw)
In-Reply-To: <528C6688.5010806@gmail.com>
On 11/20/13 07:36, Vladimir 'φ-coder/phcoder' Serbinenko wrote:
> It's not that easy. Trouble is that you need to also prevent
> inconsistent rollback and for this you need to have a hash tree. Then
> since power failure is a possibility you need this tree to be consistent
> at every moment. Those issues are a bit easier to handle on FS level.
> ZFS supports HMACs. BtrFS perhaps will one day.
Minor terminology nit: ZFS has a MAC not an HMAC. HMAC implies a hash
based MAC such as HMAC-SHA256.
ZFS uses AES-CCM or AES-GCM modes which are AEAD modes that produce an
Auth/MAC tag. You could do an equivalent thing with AES-CBC or AES-XTS
plus HMAC-SHA256 (the original ZFS crypto prototype was AES-CBC with
HMAC-SHA256 but I switched to AES-CCM/GCM).
--
Darren J Moffat
next prev parent reply other threads:[~2013-11-25 10:39 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-11-19 23:43 Keyfile Support for GRUBs LUKS Ralf Ramsauer
2013-11-20 1:31 ` Glenn Washburn
2013-11-20 1:55 ` Elliott Mitchell
2013-11-20 5:43 ` Glenn Washburn
2013-11-20 5:48 ` Vladimir 'φ-coder/phcoder' Serbinenko
2013-11-20 7:02 ` Glenn Washburn
2013-11-20 7:36 ` Vladimir 'φ-coder/phcoder' Serbinenko
2013-11-21 5:57 ` Glenn Washburn
2013-11-25 10:38 ` Darren J Moffat [this message]
2013-11-20 6:42 ` Elliott Mitchell
2013-11-20 6:52 ` Vladimir 'φ-coder/phcoder' Serbinenko
2013-11-20 21:08 ` Glenn Washburn
2013-11-21 15:31 ` Vladimir 'phcoder' Serbinenko
2013-11-21 19:34 ` Ralf Ramsauer
2013-11-22 3:01 ` Vladimir 'φ-coder/phcoder' Serbinenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=529328B0.8000904@Oracle.COM \
--to=darren.moffat@oracle.com \
--cc=grub-devel@gnu.org \
--cc=phcoder@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.