From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35531) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aJgpD-0006iG-0p for qemu-devel@nongnu.org; Thu, 14 Jan 2016 07:16:26 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aJgp7-0002Vg-3K for qemu-devel@nongnu.org; Thu, 14 Jan 2016 07:16:22 -0500 Date: Thu, 14 Jan 2016 12:16:04 +0000 From: "Daniel P. Berrange" Message-ID: <20160114121604.GM910@redhat.com> References: <1452624982-19332-1-git-send-email-berrange@redhat.com> <1452624982-19332-6-git-send-email-berrange@redhat.com> <5696E06F.7060906@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <5696E06F.7060906@redhat.com> Subject: Re: [Qemu-devel] [PATCH v1 05/15] crypto: add block encryption framework Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: qemu-devel@nongnu.org, qemu-block@nongnu.org On Wed, Jan 13, 2016 at 04:40:31PM -0700, Eric Blake wrote: > On 01/12/2016 11:56 AM, Daniel P. Berrange wrote: > > Add a generic framework for support different block encryption > > formats. Upon instantiating a QCryptoBlock object, it will read > > the encryption header and extract the encryption keys. It is > > then possible to call methods to encrypt/decrypt data buffers. > > > > There is also a mode whereby it will create/initialize a new > > encryption header on a previously unformatted volume. > > > > The initial framework comes with support for the legacy QCow > > AES based encryption. This enables code in the QCow driver to > > be consolidated later. > > > > Signed-off-by: Daniel P. Berrange > > --- > > > +++ b/qapi/crypto.json > > @@ -94,3 +94,68 @@ > > { 'enum': 'QCryptoIVGenAlgorithm', > > 'prefix': 'QCRYPTO_IVGEN_ALG', > > 'data': ['plain', 'plain64', 'essiv']} > > + > > +## > > +# QCryptoBlockFormat: > > +# > > +# The supported full disk encryption formats > > +# > > +# @qcowaes: QCow/QCow2 built-in AES-CBC encryption. Do not use > > +# > > Well, the only reason to use it would be to read data off an old > insecurely-encrypted qcow2 file; so maybe it should read "Do not use on > new files" Yep > > +# Since: 2.6 > > +## > > +{ 'enum': 'QCryptoBlockFormat', > > +# 'prefix': 'QCRYPTO_BLOCK_FORMAT', > > + 'data': ['qcowaes']} > > Would 'qcow-aes' be any easier to read? Or just shorten to 'qcow' perhaps ? Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|