From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49158) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W7nrs-0000T4-Bg for qemu-devel@nongnu.org; Mon, 27 Jan 2014 10:13:01 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1W7nrm-00064l-1u for qemu-devel@nongnu.org; Mon, 27 Jan 2014 10:12:56 -0500 Received: from mail-we0-x22a.google.com ([2a00:1450:400c:c03::22a]:44163) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W7nrl-00064V-RI for qemu-devel@nongnu.org; Mon, 27 Jan 2014 10:12:49 -0500 Received: by mail-we0-f170.google.com with SMTP id u57so5451697wes.15 for ; Mon, 27 Jan 2014 07:12:49 -0800 (PST) Date: Mon, 27 Jan 2014 16:12:44 +0100 From: Stefan Hajnoczi Message-ID: <20140127151244.GA23248@stefanha-thinkpad.redhat.com> References: <1390405630-4288-1-git-send-email-berrange@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1390405630-4288-1-git-send-email-berrange@redhat.com> Subject: Re: [Qemu-devel] [PATCH v3] Describe flaws in qcow/qcow2 encryption in the docs List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" Cc: Kevin Wolf , Peter Maydell , qemu-devel@nongnu.org, Markus Armbruster , Stefan Hajnoczi , Paolo Bonzini On Wed, Jan 22, 2014 at 03:47:10PM +0000, Daniel P. Berrange wrote: > The qemu-img.texi / qemu-doc.texi files currently describe the > qcow2/qcow2 encryption thus > > "Encryption uses the AES format which is very secure (128 bit > keys). Use a long password (16 characters) to get maximum > protection." > > While AES is indeed a strong encryption system, the way that > QCow/QCow2 use it results in a poor/weak encryption system. > Due to the use of predictable IVs, based on the sector number > extended to 128 bits, it is vulnerable to chosen plaintext > attacks which can reveal the existence of encrypted data. > > The direct use of the user passphrase as the encryption key > also leads to an inability to change the passphrase of an > image. If passphrase is ever compromised the image data will > all be vulnerable, since it cannot be re-encrypted. The admin > has to clone the image files with a new passphrase and then > use a program like shred to secure erase all the old files. > > Recommend against any use of QCow/QCow2 encryption, directing > users to dm-crypt / LUKS which can meet modern cryptography > best practices. > > Signed-off-by: Daniel P. Berrange > Reviewed-by: Markus Armbruster > --- > qemu-doc.texi | 23 ++++++++++++++++++++--- > qemu-img.texi | 23 ++++++++++++++++++++--- > 2 files changed, 40 insertions(+), 6 deletions(-) > > Changed in v3: > > - Addressed feedback/typos from Eric & Markus > > In v2: > > - Addressed typos reported by Peter > > Still welcome info about any other flaws qcow2 has in this > area that should be documented. Changed "Qcow" to "qcow" for consistency. Thanks, applied to my block tree: https://github.com/stefanha/qemu/commits/block Stefan