Messages in this thread | | | Date | Tue, 26 Jul 2022 19:45:38 +0200 | From | David Sterba <> | Subject | Re: [PATCH RFC 4/4] fscrypt: Add new encryption policy for btrfs. |
| |
On Mon, Jul 25, 2022 at 10:16:07PM -0400, Sweet Tea Dorminy wrote: > On 7/25/22 19:32, Eric Biggers wrote: > > On Sat, Jul 23, 2022 at 08:52:28PM -0400, Sweet Tea Dorminy wrote:
> > Given that this new proposal uses per-block metadata, has > > support for authenticated encryption been considered? Has space been reserved > > in the per-block metadata for authentication tags so that authenticated > > encryption support could be added later even if it's not in the initial version? > > I don't know sufficiently much about authenticated encryption to have > considered it. As currently drafted, btrfs encrypts before checksumming > if checksums are enabled, and checks against checksums before > decrypting. Although at present we haven't discussed authentication > tags, btrfs could store them in a separate itemtype which could be added > at any time, much as we currently store fsverity data. We do have > sufficient room saved for adding other encryption types, if necessary; > we could use some of that to indicate the existence of authentication > tags for the extents' data.
The AEAD tag can be used in place of checksum (also stored in the checksum item).
| |