Messages in this thread | | | Date | Thu, 4 Dec 2003 18:26:53 +0100 | From | Jörn Engel <> | Subject | Re: partially encrypted filesystem |
| |
On Thu, 4 December 2003 07:20:21 -0800, Linus Torvalds wrote: > On Thu, 4 Dec 2003, Jörn Engel wrote: > > > > Isn't that a problem already handled by all compressing filesystems? > > Or did I miss something really stupid? > > Yes, compression and encryption are really the same thing from a fs > implementation standpoint - they just have different goals. So yes, any > compressed filesystem will largely have all the same issues. > > And compression isn't very easy to tack on later either.
So - as sick as it sounds - jffs2 may actually be the fs of choice when doing encryption, even though working on a hard drive and not flash. Cool. :)
> Encryption does have a few extra problems, simply because of the intent. > In a compressed filesystem it is ok to say "this information tends to be > small and hard to compress, so let's not" (for example, metadata). While > in an encrypted filesystem you shouldn't skip the "hard" pieces..
Depends on how much security you really care about. If you really don't mind the pain involved, some metadata should explicitly *not* be encrypted, to avoid known plaintext attacks. To a serious attacker, this could be a death stroke for ext[23] over cryptoloop, actually.
In real life, though, the humans are usually the weakest link, so this doesn't matter anyway.
> (Encrypted filesystems also have the key management issues, further > complicating the thing, but that complication tends to be at a higher > level).
Trivial, as long as you can live with a single key for the whole filesystem. If that is not acceptable, there may even be problems in the vfs already.
Jörn
-- Data dominates. If you've chosen the right data structures and organized things well, the algorithms will almost always be self-evident. Data structures, not algorithms, are central to programming. -- Rob Pike - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |