public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* dm-crypt, new IV and standards
@ 2004-02-19 22:06 Carl-Daniel Hailfinger
  2004-02-19 22:20 ` Christophe Saout
  0 siblings, 1 reply; 27+ messages in thread
From: Carl-Daniel Hailfinger @ 2004-02-19 22:06 UTC (permalink / raw)
  To: christophe; +Cc: Linux Kernel Mailing List, Andrew Morton

Hi,

after having read what I believe to be all dm-crypt related mails on lkml,
I have a question which I could not find an answer for:
(and I noticed Andrew Morton worrying about backwards compatibility)

Would it be sensible (AFAICS there is not technical limitation) to reserve
512/1024/2048/whatever bytes at the beginning of every backing device for
dm-crypt so that the dm-crypt device could get some info about the used
methods automatically?

So this meta-information superblock could contain the following:
- A magic string like CRYPTSPACE (like SWAPSPACE2)
- The key used to encrypt the device (the key would be encrypted with the
password)
- The IV algorithm used
- The cipher used
- The way the password was hashed
- If some conversion was underway last time the dm-crypt device was accessed

This way, the following benefits would appear:
- New dm-crypt devices can be differentiated from old cryptoloop ones
- Since the password is independent of the key, you can change the
password without reencrypting the entire device.
- Since the key is independent of the password, you can change the key,
reencrypt the entire device and still keep your old password.
- You can change the default IV to something more secure than the current
default one without having to fear userland breakage.
- There are multiple ways to hash a password and with the current scheme
we have to try all of them if we do not know which version of the tools
was used to create the file.
- If the device is currently being reencrypted and is halfway through and
the power fails, we would know that some part of the device is old
encryption and some part is new encryption.
- New (more secure) crypto algorithms/ IV generation schemes/ passphrase
hashing schemes could be added (or even made default) without violating
the principle of least surprise.

I am not an expert in crypto, so if you tell me this would reduce security
or cause other problems, I will accept that. I am aware that the more
information an attacker has, the easier it is for him to break the encryption.


Regards,
Carl-Daniel


^ permalink raw reply	[flat|nested] 27+ messages in thread
* Re: dm-crypt, new IV and standards
@ 2004-02-22 19:20 Adam J. Richter
  2004-02-22 20:53 ` Christophe Saout
  0 siblings, 1 reply; 27+ messages in thread
From: Adam J. Richter @ 2004-02-22 19:20 UTC (permalink / raw)
  To: christophe; +Cc: linux-kernel

At 2004-02-19 22:20:37, Christophe Saout wrote:
>I've started to write a userspace program for reencryption. I don't know
>if this is very clever because I have to lock the part that is currently
>beeing reencrypted (deadlocks & co). Perhaps as another dm target like
>dm-mirror for pvmove? We'd have to keep a log or something because we
>don't *exactly* know what has been successfully written. This would mean
>a lot of seeks. It's complicated if it has to be safe against crashes
>and power outages.

	Device-mapper already has support for different regions of a
device being mapped differently (for example a single disk where
0-100GB is mapped to disk A, 100GB-200GB is mapped to disk B), and
I believe it has some support for changing this mapping while the
device is opened or mounted.  So, if you wanted to add support for
rekeying an encrypted block device while it is active, you could
probably do it in fewer lines of code with an approach based on
device-mapper than one based on a device.

	One scheme for reencryption with minimal extra seeks and
data transfers would be to configure a gap of, say, 128kB, at the
front (or back) of a block device.  During rekeying, this gap would
incrementally be moved forward (or backward).  The area before the
gap would be encrypted with key A, and the area after
the gap would be encrypted with key B.  Before you move the gap,
you arrange so that the old location of the gap has the same
contents as the new location of the gap, except that the old location
was encrypted with the old key, and the new location was encrypted with
the new key.  I can detail this more if my description is unclear,
but I suspect you get the picture.

Adam J. Richter     __     ______________   575 Oroville Road
adam@yggdrasil.com     \ /                  Milpitas, California 95035
+1 408 309-6081         | g g d r a s i l   United States of America

^ permalink raw reply	[flat|nested] 27+ messages in thread
end of thread, other threads:[~2004-03-08 20:13 UTC | newest]

Thread overview: 27+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-02-19 22:06 dm-crypt, new IV and standards Carl-Daniel Hailfinger
2004-02-19 22:20 ` Christophe Saout
2004-02-20 17:22   ` Jean-Luc Cooke
2004-02-20 21:26     ` James Morris
2004-02-20 21:52       ` 2.6.3 adaptec I2O will not compile David Lang
2004-02-25 16:25         ` Adrian Bunk
2004-02-26  8:02           ` Jaco Kroon
2004-02-26  8:08             ` David Lang
2004-02-26  9:28               ` Jaco Kroon
2004-02-26 10:24                 ` David Lang
2004-02-21  0:31       ` dm-crypt, new IV and standards Carl-Daniel Hailfinger
2004-02-21 16:48       ` Jean-Luc Cooke
2004-02-21 17:36         ` Jean-Luc Cooke
2004-02-21 19:01         ` Andreas Jellinghaus
2004-03-03  8:35         ` dean gaudet
2004-03-03 15:06           ` Jean-Luc Cooke
2004-03-03 21:40             ` David Wagner
2004-03-08 19:58               ` Jean-Luc Cooke
2004-03-04  1:48             ` dean gaudet
2004-03-04 13:24               ` Jean-Luc Cooke
2004-03-04 17:44                 ` David Wagner
2004-03-05  1:19                 ` dean gaudet
2004-03-05  2:14                   ` Jean-Luc Cooke
2004-03-04 15:08             ` Pavel Machek
2004-03-07  4:14               ` DM for detecting bad disks was: " Mike Fedyk
  -- strict thread matches above, loose matches on Subject: below --
2004-02-22 19:20 Adam J. Richter
2004-02-22 20:53 ` Christophe Saout

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox