lkml.org 
[lkml]   [2003]   [Dec]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: partially encrypted filesystem
    On Thu, 4 December 2003 07:20:21 -0800, Linus Torvalds wrote:
    > On Thu, 4 Dec 2003, Jörn Engel wrote:
    > >
    > > Isn't that a problem already handled by all compressing filesystems?
    > > Or did I miss something really stupid?
    >
    > Yes, compression and encryption are really the same thing from a fs
    > implementation standpoint - they just have different goals. So yes, any
    > compressed filesystem will largely have all the same issues.
    >
    > And compression isn't very easy to tack on later either.

    So - as sick as it sounds - jffs2 may actually be the fs of choice
    when doing encryption, even though working on a hard drive and not
    flash. Cool. :)

    > Encryption does have a few extra problems, simply because of the intent.
    > In a compressed filesystem it is ok to say "this information tends to be
    > small and hard to compress, so let's not" (for example, metadata). While
    > in an encrypted filesystem you shouldn't skip the "hard" pieces..

    Depends on how much security you really care about. If you really
    don't mind the pain involved, some metadata should explicitly *not* be
    encrypted, to avoid known plaintext attacks. To a serious attacker,
    this could be a death stroke for ext[23] over cryptoloop, actually.

    In real life, though, the humans are usually the weakest link, so this
    doesn't matter anyway.

    > (Encrypted filesystems also have the key management issues, further
    > complicating the thing, but that complication tends to be at a higher
    > level).

    Trivial, as long as you can live with a single key for the whole
    filesystem. If that is not acceptable, there may even be problems in
    the vfs already.

    Jörn

    --
    Data dominates. If you've chosen the right data structures and organized
    things well, the algorithms will almost always be self-evident. Data
    structures, not algorithms, are central to programming.
    -- Rob Pike
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:59    [W:2.172 / U:2.768 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site