From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39238) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W5yit-0003FO-Da for qemu-devel@nongnu.org; Wed, 22 Jan 2014 09:24:12 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1W5yio-0006BZ-Au for qemu-devel@nongnu.org; Wed, 22 Jan 2014 09:24:07 -0500 Received: from mx1.redhat.com ([209.132.183.28]:52334) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W5yio-0006BE-3m for qemu-devel@nongnu.org; Wed, 22 Jan 2014 09:24:02 -0500 Received: from int-mx12.intmail.prod.int.phx2.redhat.com (int-mx12.intmail.prod.int.phx2.redhat.com [10.5.11.25]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s0MDLP56010762 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Wed, 22 Jan 2014 08:21:26 -0500 Message-ID: <52DFC5D4.5060109@redhat.com> Date: Wed, 22 Jan 2014 06:21:24 -0700 From: Eric Blake MIME-Version: 1.0 References: <1390390561-14901-1-git-send-email-berrange@redhat.com> In-Reply-To: <1390390561-14901-1-git-send-email-berrange@redhat.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="FL5mqMmqeXchawT1rk2X93rNR6SKsfttV" Subject: Re: [Qemu-devel] [PATCH] Describe flaws in qcow/qcow2 encryption in the docs List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" , qemu-devel@nongnu.org Cc: Kevin Wolf , Paolo Bonzini , Stefan Hajnoczi This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --FL5mqMmqeXchawT1rk2X93rNR6SKsfttV Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 01/22/2014 04:36 AM, Daniel P. Berrange wrote: > The qemu-img.texi / qemu-doc.texi files currently describe the > qcow2/qcow2 encryption thus >=20 > "Encryption uses the AES format which is very secure (128 bit > keys). Use a long password (16 characters) to get maximum > protection." >=20 > While AES is indeed a strong encryption system, the way that > QCow/QCow2 use it results in a poor/weak encryption system. > Due to the use of predictable IVs it is vulnerable to chosen > plaintext attacks which can reveal the existance of encrypted s/existance/existence/ > data. >=20 > The direct use of the user passphrase as the encryption key > also leads to an inability to change the passphrase of an > image. If passphrase is ever compromised the image data will > all be vulnerable, since it cannot be re-encrypted. The admin > has to clone the image files with a new passphrase and then > use a program like shred to secure erase all the old files. >=20 > Recommend against any use of QCow/QCow2 encryption, directing > users to dm-crypt / LUKS which can meet modern cryptography > best practices. >=20 > Signed-off-by: Daniel P. Berrange > --- > qemu-doc.texi | 23 ++++++++++++++++++++--- > qemu-img.texi | 23 ++++++++++++++++++++--- > 2 files changed, 40 insertions(+), 6 deletions(-) >=20 > + > +The use of encryption in QCow and QCow2 images is considered to flawed= by modern > +cryptography standards, suffering from a number of design problems s/$/:/ > + > +@itemize @minus > +@item The AES-CBC cipher is used with predictable initialization vecto= rs based > +on the sector number. This makes it vulnerable to chosen plaintext att= acks > +which can reveal the existence of encrypted data. > +@item The user passphrase is directly used as the encryption key. A po= orly > +choosen / short passphrase will compromise the security of the encrypt= ion. s/choosen/chosen/ > +In the event of the passphrase being compromised there is no way to ch= ange Maybe s/^/@item / ? After all, the need to clone/shred after compromise is there whether the passphrase was poorly chosen or maximally chosen, it's just that poorly chosen is more likely to be easily compromised. > +++ b/qemu-img.texi > +@item The user passphrase is directly used as the encryption key. A po= orly > +choosen / short passphrase will compromise the security of the encrypt= ion. Copy and paste the fixes above here, too. --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --FL5mqMmqeXchawT1rk2X93rNR6SKsfttV Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJS38XUAAoJEKeha0olJ0NqF9kH/ioYy8ARRw7LTfB3bTprRu5f miqsqDYGGMane1KC2opbGEtzY/8AxihaARqgXWFEoyGF4YR6cCSXKMv0NxinVxes eGJKZKXEALeq29eM1Ujm55C57H0ThyaCJ7ha9bRme0pXFr63BGBDH55PVhVLnEBD +MAYKaphwBoazTWBgum4+YeHf3wdzjNsHwNNS0sy/ZKjBtYFrOu0Tp286gv87ptw pcFg8R6CZOvkFlkWz+pcVrnmrUwNDum6iFc5Bz5e489OEFAoUO7Cj0pT2NTRrVYc WywYnNwd6QYR2XFCwEYyUhNZm5pM7igR1udSSENwPOLTPWzpa5zZra5Vl8Zw1ag= =n8FD -----END PGP SIGNATURE----- --FL5mqMmqeXchawT1rk2X93rNR6SKsfttV--