On Wed, Jun 3, 2020 at 1:07 PM Simo Sorce <s...@redhat.com> wrote: > > On Tue, 2020-06-02 at 21:58 -0700, John M. Harris Jr wrote: > > On Tuesday, June 2, 2020 9:45:45 PM MST Chris Murphy wrote: > > > On Tue, Jun 2, 2020 at 10:28 PM Samuel Sieb <sam...@sieb.net> wrote: > > > > > > > > > > > I would expect that using an encrypted partition for swap should be > > > > sufficient to allow it though. > > > > > > Unfortunately not. Encryption provides no integrity or authenticity. > > > The original set of patches for signed and authenticated hibernation > > > images called for the use of an HMAC for signing, and upstream > > > considered this insufficient and asked why not use AES-GCM to provide > > > a real AE (authenticated encryption) model. > > > > In what way do you believe it's not sufficient? > > AES GCM Is generally *not* a good algorithm for disk encryption so I am > not sure why this is being brought up, HMAC is sufficient to verify > integrity.
I don't know either. This is the discussion I'm referring to, for full context: https://lkml.org/lkml/2019/1/9/828 -- Chris Murphy _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
