Re: Basic interface for key management in reiser4 (DRAFT)

[Gregory Maxwell <gmaxwell@gmail.com>]

On 8/19/05, Edward Shishkin <edward@namesys.com> wrote:
> Actually it is critical:
> http://marc.theaimsgroup.com/?l=linux-kernel&m=107719798631935&w=2
> But why random? It is slowly.. I would prefer object-id-based one..

The IV doesn't need to be random, but it should be different for every
instance of a file, different every time a file is deleted and
recreated, not increment in any predictable way between files, and be
impossible to control by a user. It should have a low possibility of
reuse.

Earlier linux DM crypt had a weakness where the IV incremented with
every block in the file system, this lead to some interesting
watermarking attacks. It was possible to form a stream of data with
changes that negated the XORs from the trivially incremented IV, and
thus the first block of each sector could be used to form an
electronic code book. This has since been corrected with a couple of
options (one is to use the cryptographic hash of the block number).

If the user has some way of trivially influencing differences in the
object ID, for example sequential files have sequential object id,
then the object ID should be passed through a hash function so that a
user must know the full object iD in order to predict even a single
bitflip.