UBIFS Encryption

UBIFS Encryption

[Stefano Babic]

Hi,

I have the necessity to encrypt UBIFS - I have read that there is some
movement about this, for example here:

	http://lists.infradead.org/pipermail/linux-mtd/2016-March/066277.html

and some years ago there was another attempt:

	https://patchwork.ozlabs.org/patch/150160/

It looks like from patchwork that the above patch was merged, but it is
not. Anyway, this looks as a starting point to add encryption /
decryption routine, for example using crypto hardware, to the compress /
decompress functions. In my understanding (I have a i.MX6 with CAAM
crypto hardware), this can be possible - but I am asking here if there
are some progress and which could be the best long term solution.

Best regards,
Stefano Babic

-- 
=====================================================================
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic@denx.de
=====================================================================

Re: UBIFS Encryption

[Richard Weinberger]

Hi!

Am 14.06.2016 um 11:51 schrieb Stefano Babic:
> Hi,
> 
> I have the necessity to encrypt UBIFS - I have read that there is some
> movement about this, for example here:
> 
> 	http://lists.infradead.org/pipermail/linux-mtd/2016-March/066277.html
> 
> and some years ago there was another attempt:
> 
> 	https://patchwork.ozlabs.org/patch/150160/

File level encryption for UBIFS did not materialize yet because my customer
decided against encryption and the project degraded to a "would be a nice to
have feature I'll do in my spare time when I'm bored" state.

That said, the feature was requested a few times but nobody was willing to do
a proper implementation nor fund it so far.

> It looks like from patchwork that the above patch was merged, but it is
> not. Anyway, this looks as a starting point to add encryption /
> decryption routine, for example using crypto hardware, to the compress /
> decompress functions. In my understanding (I have a i.MX6 with CAAM
> crypto hardware), this can be possible - but I am asking here if there
> are some progress and which could be the best long term solution.

Please use the VFS approach like ext4 and f2fs do. That way a lot of existing
infra structure can re-used. Think of key management.

Thanks,
//richard