linux-kernel - Re: [PATCH 6/9] dm crypt: support diskcipher

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190821072109.GA22686@gondor.apana.org.au>
Date:   Wed, 21 Aug 2019 17:21:09 +1000
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     Milan Broz <gmazyland@...il.com>
Cc:     "boojin.kim" <boojin.kim@...sung.com>,
        'Alasdair Kergon' <agk@...hat.com>,
        'Mike Snitzer' <snitzer@...hat.com>, dm-devel@...hat.com,
        linux-kernel@...r.kernel.org,
        "'David S. Miller'" <davem@...emloft.net>,
        'Eric Biggers' <ebiggers@...nel.org>,
        "'Theodore Y. Ts'o'" <tytso@....edu>, 'Chao Yu' <chao@...nel.org>,
        'Jaegeuk Kim' <jaegeuk@...nel.org>,
        'Andreas Dilger' <adilger.kernel@...ger.ca>,
        'Jens Axboe' <axboe@...nel.dk>,
        'Krzysztof Kozlowski' <krzk@...nel.org>,
        'Kukjin Kim' <kgene@...nel.org>,
        'Jaehoon Chung' <jh80.chung@...sung.com>,
        'Ulf Hansson' <ulf.hansson@...aro.org>,
        linux-crypto@...r.kernel.org, linux-fscrypt@...r.kernel.org,
        linux-mmc@...r.kernel.org
Subject: Re: [PATCH 6/9] dm crypt: support diskcipher

On Wed, Aug 21, 2019 at 09:13:36AM +0200, Milan Broz wrote:
>
> NACK.
> 
> The whole principle of dm-crypt target is that it NEVER EVER submits
> plaintext data down the stack in bio.
> 
> If you want to do some lower/higher layer encryption, use key management
> on a different layer.
> So here, just setup encryption for fs, do not stack it with dm-crypt.
> 
> Also, dm-crypt is software-independent solution
> (software-based full disk encryption), it must not depend on
> any underlying hardware.
> Hardware can be of course used used for acceleration, but then
> just implement proper crypto API module that accelerates particular cipher.

I agree.  Please take a look at the recent ESSIV patches on
linux-crypto and build multi-block operations on top of them
which can then be implemented by the hardware.

Cheers,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt