encrypting jffs2 filesystem with DM-crypt or what else?

encrypting jffs2 filesystem with DM-crypt or what else?

[emin ak]

Hi Folks,
I need to encrypt a jffs2/mtd formatted flash filesystem for an
embedded device, Normally using a loopback interface (cryptoloop,
DM-crypt or loop-aes) solves this problem but they are not well known
on journalling file systems (like jffs2) because of cached write etc..
Also I could'nt find any guideline for encrypting fikesystem on a
flash.
There is an ugly workaround to overcome this problem, I have placed an
encrypted ext2 filesystem image on an normal jffs2 partition and mount
this encrypted partition on a loopback, but this is not secure,
consumes alot for disk space and not reliable (is'nt it?)
Is there any other way to encrypt an jjffs2 partition, if not, what do
you think about my ugly workaround?
Thank alot
Emin

Re: encrypting jffs2 filesystem with DM-crypt or what else?

[markus reichelt]

[-- Attachment #1: Type: text/plain, Size: 1361 bytes --]

* emin ak <eminak71@gmail.com> wrote:

> I need to encrypt a jffs2/mtd formatted flash filesystem for an
> embedded device, Normally using a loopback interface (cryptoloop,
> DM-crypt or loop-aes) solves this problem but they are not well
> known on journalling file systems (like jffs2) because of cached
> write etc.. Also I could'nt find any guideline for encrypting
> fikesystem on a flash.

device-backed loops are ok, file-based once aren't. The cache issue
you talk about concerns writing caches of HDDs f.e., I haven't seen a
flash device with writing cache. However, in most cases writing cache
can be turned off.

Go with README in the loop-aes package. Don't use cryptoloop, it's
insecure.


> There is an ugly workaround to overcome this problem, I have placed
> an encrypted ext2 filesystem image on an normal jffs2 partition and
> mount this encrypted partition on a loopback, but this is not
> secure, consumes alot for disk space and not reliable (is'nt it?)
> Is there any other way to encrypt an jjffs2 partition, if not, what
> do you think about my ugly workaround?

You shouldn't do that. One more option is, in case you feel lucky and
space is not of great concern, ecryptfs in latest kernels. It's still
experimental but its roadmap looks promising. And they need testers
;-)


-- 
left blank, right bald

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: encrypting jffs2 filesystem with DM-crypt or what else?

[Jari Ruusu]

markus reichelt wrote:
> * emin ak <eminak71@gmail.com> wrote:
> > I need to encrypt a jffs2/mtd formatted flash filesystem for an
> > embedded device, Normally using a loopback interface (cryptoloop,
> > DM-crypt or loop-aes) solves this problem but they are not well
> > known on journalling file systems (like jffs2) because of cached
> > write etc.. Also I could'nt find any guideline for encrypting
> > fikesystem on a flash.
> 
> device-backed loops are ok, file-based once aren't. The cache issue
> you talk about concerns writing caches of HDDs f.e., I haven't seen a
> flash device with writing cache. However, in most cases writing cache
> can be turned off.

Flash devices behave differently than hard disks. If I remember correcly,
bits can be flipped in one direction (set or reset) without erasing whole
block, but flipping a bit in reverse direction requires that whole block be
erased first.

If jffs2 takes advantage of this one-direction-bit-flipping, then adding
encryption layer between jffs2 and flash device makes it completely
different game that is guaranteed to require lots of flash block erases that
wears down the device much faster than expected.

-- 
Jari Ruusu  1024R/3A220F51 5B 4B F9 BB D3 3F 52 E9  DB 1D EB E3 24 0E A9 DD