linux-kernel - Re: [PATCH 0/4][RFC v2] Introduce the in-kernel hibernation encryption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180719110149.GA4679@amd>
Date:   Thu, 19 Jul 2018 13:01:49 +0200
From:   Pavel Machek <pavel@....cz>
To:     Yu Chen <yu.c.chen@...el.com>
Cc:     "Rafael J . Wysocki" <rafael.j.wysocki@...el.com>,
        Eric Biggers <ebiggers@...gle.com>,
        "Lee, Chun-Yi" <jlee@...e.com>, Theodore Ts o <tytso@....edu>,
        Stephan Mueller <smueller@...onox.de>,
        Denis Kenzior <denkenz@...il.com>, linux-pm@...r.kernel.org,
        linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
        "Gu, Kookoo" <kookoo.gu@...el.com>,
        "Zhang, Rui" <rui.zhang@...el.com>
Subject: Re: [PATCH 0/4][RFC v2] Introduce the in-kernel hibernation
 encryption

On Thu 2018-07-19 07:58:51, Yu Chen wrote:
> Hi,
> On Wed, Jul 18, 2018 at 10:22:35PM +0200, Pavel Machek wrote:
> > On Thu 2018-07-19 00:38:06, Chen Yu wrote:
> > > As security becomes more and more important, we add the in-kernel
> > > encryption support for hibernation.
> > 
> > Sorry, this does not really explain what security benefit it is
> > supposed have to against what attack scenarios.
> > 
> > Which unfortunately means it can not reviewed.
> > 
> > Note that uswsusp already provides encryption. If this is supposed to
> > have advantages over it, please say so.
> > 
> The advantages are described in detail in 
> [PATCH 1/4]'s log, please refer to that.

Are you refering to this?

# Generally the advantage is: Users do not have to
# encrypt the whole swap partition as other tools.
# After all, ideally kernel memory should be encrypted
# by the kernel itself.

Sorry, this does not really explain what security benefit it is
supposed have to against what attack scenarios.

Note that uswsusp already provides encryption. If this is supposed to
have advantages over it, please say so.

Also note that joeyli <jlee@...e.com> has patch series which encrypts
both in-kernel and uswsusp hibernation methods. His motivation is
secure boot. How does this compare to his work?

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)