From: Christoph Hellwig <hch@infradead.org>
To: Adrian Vovk <adrianvovk@gmail.com>
Cc: Christoph Hellwig <hch@infradead.org>,
Eric Biggers <ebiggers@kernel.org>,
Md Sadre Alam <quic_mdalam@quicinc.com>,
axboe@kernel.dk, song@kernel.org, yukuai3@huawei.com,
agk@redhat.com, snitzer@kernel.org,
Mikulas Patocka <mpatocka@redhat.com>,
adrian.hunter@intel.com, quic_asutoshd@quicinc.com,
ritesh.list@gmail.com, ulf.hansson@linaro.org,
andersson@kernel.org, konradybcio@kernel.org, kees@kernel.org,
gustavoars@kernel.org, linux-block@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-raid@vger.kernel.org,
dm-devel@lists.linux.dev, linux-mmc@vger.kernel.org,
linux-arm-msm@vger.kernel.org, linux-hardening@vger.kernel.org,
quic_srichara@quicinc.com, quic_varada@quicinc.com
Subject: Re: [PATCH v2 1/3] dm-inlinecrypt: Add inline encryption support
Date: Tue, 22 Oct 2024 23:57:40 -0700 [thread overview]
Message-ID: <ZxieZPlH-S9pakYW@infradead.org> (raw)
In-Reply-To: <D96294E2-F17A-4E58-90FB-1D17747048E5@gmail.com>
On Fri, Oct 18, 2024 at 11:03:50AM -0400, Adrian Vovk wrote:
> Sure, but then this way you're encrypting each partition twice. Once by the dm-crypt inside of the partition, and again by the dm-crypt that's under the partition table. This double encryption is ruinous for performance, so it's just not a feasible solution and thus people don't do this. Would be nice if we had the flexibility though.
Why do you assume the encryption would happen twice?
> >Because you are now bypassing encryption for certainl LBA ranges in
> >the file system based on hints/flags for something sitting way above
> >in the stack.
> >
>
> Well the data is still encrypted. It's just encrypted with a different key. If the attacker has a FDE dump of the disk, the data is still just as inaccessible to them.
No one knows that it actually is encryped. The lower layer just knows
the skip encryption flag was set, but it has zero assurance data
actually was encrypted.
next prev parent reply other threads:[~2024-10-23 6:57 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-16 8:57 [PATCH v2 0/3] Add inline encryption support Md Sadre Alam
2024-09-16 8:57 ` [PATCH v2 1/3] dm-inlinecrypt: " Md Sadre Alam
2024-09-17 5:05 ` kernel test robot
2024-09-17 6:38 ` kernel test robot
2024-09-18 5:08 ` kernel test robot
2024-09-21 18:55 ` Eric Biggers
2024-09-24 7:44 ` Christoph Hellwig
2024-09-24 22:04 ` Eric Biggers
2024-10-01 8:37 ` Christoph Hellwig
2024-10-18 3:26 ` Adrian Vovk
2024-10-18 5:22 ` Christoph Hellwig
[not found] ` <CAAdYy_mVy3uXPqWbjPzK_i8w7Okq73wKBQyc95TbnonE36rPgQ@mail.gmail.com>
2024-10-18 5:56 ` Christoph Hellwig
2024-10-18 15:03 ` Adrian Vovk
2024-10-23 6:57 ` Christoph Hellwig [this message]
2024-10-24 2:52 ` Adrian Vovk
2024-10-24 3:17 ` Adrian Vovk
2024-10-24 6:14 ` Christoph Hellwig
2024-10-24 7:52 ` Adrian Vovk
2024-10-24 9:04 ` Christoph Hellwig
2024-10-24 15:32 ` Adrian Vovk
2024-10-24 15:59 ` Christoph Hellwig
2024-10-24 16:23 ` Adrian Vovk
2024-10-29 11:08 ` Mikulas Patocka
2024-10-24 8:11 ` Geoff Back
2024-10-24 15:28 ` Adrian Vovk
2024-10-24 19:21 ` John Stoffel
2024-10-24 20:45 ` Adrian Vovk
2024-10-15 10:59 ` Mikulas Patocka
2024-09-16 8:57 ` [PATCH v2 2/3] mmc: cqhci: Add additional algo mode for inline encryption Md Sadre Alam
2024-09-16 8:57 ` [PATCH v2 3/3] mmc: sdhci-msm: " Md Sadre Alam
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZxieZPlH-S9pakYW@infradead.org \
--to=hch@infradead.org \
--cc=adrian.hunter@intel.com \
--cc=adrianvovk@gmail.com \
--cc=agk@redhat.com \
--cc=andersson@kernel.org \
--cc=axboe@kernel.dk \
--cc=dm-devel@lists.linux.dev \
--cc=ebiggers@kernel.org \
--cc=gustavoars@kernel.org \
--cc=kees@kernel.org \
--cc=konradybcio@kernel.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mmc@vger.kernel.org \
--cc=linux-raid@vger.kernel.org \
--cc=mpatocka@redhat.com \
--cc=quic_asutoshd@quicinc.com \
--cc=quic_mdalam@quicinc.com \
--cc=quic_srichara@quicinc.com \
--cc=quic_varada@quicinc.com \
--cc=ritesh.list@gmail.com \
--cc=snitzer@kernel.org \
--cc=song@kernel.org \
--cc=ulf.hansson@linaro.org \
--cc=yukuai3@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox