From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44901) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WQcHo-0003sm-LM for qemu-devel@nongnu.org; Thu, 20 Mar 2014 08:41:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WQcHk-00021H-R9 for qemu-devel@nongnu.org; Thu, 20 Mar 2014 08:41:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:15564) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WQcHk-00020Y-Im for qemu-devel@nongnu.org; Thu, 20 Mar 2014 08:41:24 -0400 Date: Thu, 20 Mar 2014 12:41:12 +0000 From: "Daniel P. Berrange" Message-ID: <20140320124112.GG18271@redhat.com> References: <20140318130819.GB7136@stefanha-thinkpad.redhat.com> <20140318133044.GF29054@redhat.com> <20140320082314.GD28673@stefanha-thinkpad.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20140320082314.GD28673@stefanha-thinkpad.redhat.com> Subject: Re: [Qemu-devel] Adding dmcrypt to QEMU block drivers Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Hajnoczi Cc: Kevin Wolf , =?utf-8?Q?Beno=C3=AEt?= Canet , "Hamilton, Peter A." , Markus Armbruster , "qemu-devel@nongnu.org" , "Coffman, Joel M." On Thu, Mar 20, 2014 at 09:23:14AM +0100, Stefan Hajnoczi wrote: > On Tue, Mar 18, 2014 at 01:30:44PM +0000, Daniel P. Berrange wrote: > > On Tue, Mar 18, 2014 at 02:08:19PM +0100, Stefan Hajnoczi wrote: > > > On Mon, Mar 17, 2014 at 08:48:08PM -0400, Hamilton, Peter A. wrote: > > > I guess the filter would be deployed below the image format: > > > qcow2 -> luks -> file > > > > I could see it being either above or below the image format at > > mgmt app's choice. Having it above the image format means only > > the payload is encrypted, so you can still query the basic > > metadata (like logic disk size, backing files) without decrypting, > > which is a nice aspect of the way qcow2 encryption historically > > worked. I could see though that people might want even the header > > encrypted to prevent anyone seeing anything about the image format > > without keys. > > The difference is that if you encrypt just the payload then dmcrypt > compatibility is much less useful since the data is now intermingled > with image format metadata. You do get some crazy apps which format a block device with qcow2 though - eg oVirt. So conceptually even doing qcow2 inside a dmcrypt block could make some sense if apps like that setup! Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|