lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-id: <20070306130524.GG4168@tatooine.rebelbase.local>
Date:	Tue, 06 Mar 2007 14:05:24 +0100
From:	markus reichelt <ml@...eichelt.de>
To:	linux-kernel@...r.kernel.org
Subject: Re: encrypting jffs2 filesystem with DM-crypt or what else?

* emin ak <eminak71@...il.com> wrote:

> I need to encrypt a jffs2/mtd formatted flash filesystem for an
> embedded device, Normally using a loopback interface (cryptoloop,
> DM-crypt or loop-aes) solves this problem but they are not well
> known on journalling file systems (like jffs2) because of cached
> write etc.. Also I could'nt find any guideline for encrypting
> fikesystem on a flash.

device-backed loops are ok, file-based once aren't. The cache issue
you talk about concerns writing caches of HDDs f.e., I haven't seen a
flash device with writing cache. However, in most cases writing cache
can be turned off.

Go with README in the loop-aes package. Don't use cryptoloop, it's
insecure.


> There is an ugly workaround to overcome this problem, I have placed
> an encrypted ext2 filesystem image on an normal jffs2 partition and
> mount this encrypted partition on a loopback, but this is not
> secure, consumes alot for disk space and not reliable (is'nt it?)
> Is there any other way to encrypt an jjffs2 partition, if not, what
> do you think about my ugly workaround?

You shouldn't do that. One more option is, in case you feel lucky and
space is not of great concern, ecryptfs in latest kernels. It's still
experimental but its roadmap looks promising. And they need testers
;-)


-- 
left blank, right bald

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ