Re: [dm-devel] Some thoughts about providing data block checksumming for ext4

[Theodore Ts'o <tytso@mit.edu>]

On Wed, Nov 05, 2014 at 10:37:09PM +0100, Milan Broz wrote:
> 
> Also, for encrypted devices (either on file level or block level) I think 
> there are still requests for implementing real crypto authenticated modes (like GCM)
> which obviously need similar space for auth tag. (I think ZFS uses it this way.) 

Yes, although it depends on your threat model.  If you need to worry
about known or chosen plaintext attack modes --- for example, if you
were implementing the chrome browser where the attacker might be able
to play MITM and replace web pages which would then get encrypted in
the browser cache, and where the attacker can continuously read and/or
replace blocks (say, because of some really stupid design where you
are using an unprotected iSCSI connection).  Or if you assume the
attacker can remove the hard drive, twiddle some blocks, and then
surreptitiously replace the hard drive many times, then yes, you need
to worry about data integrity because a system that doesn't include a
MAC --- such as what dm-crypt provides, is simply not enough.

Basically, a dm-crypt style block device encryption is only good if
your threat model is "the attacker steals the laptop and I want to
keep the contents of the storage device safe".

Michael Halcrow discussed this in this years Linux Security Symposium:

	http://kernsec.org/files/lss2014/Halcrow_EXT4_Encryption.pdf

Cheers,

						- Ted