On 26.01.2017 11:18, Daniel P. Berrange wrote: > This adds support for using LUKS as an encryption format > with the qcow2 file. The use of the existing 'encryption=on' > parameter is replaced by a new parameter 'encryption-format' > which takes the values 'aes' or 'luks'. e.g. > > # qemu-img create --object secret,data=123456,id=sec0 \ > -f qcow2 -o encryption-format=luks,luks-key-secret=sec0 \ > test.qcow2 10G > > results in the creation of an image using the LUKS format. > Use of the legacy 'encryption=on' parameter still results > in creation of the old qcow2 AES format, and is equivalent > to the new 'encryption-format=aes'. e.g. the following are > equivalent: > > # qemu-img create --object secret,data=123456,id=sec0 \ > -f qcow2 -o encryption=on,aes-key-secret=sec0 \ > test.qcow2 10G > > # qemu-img create --object secret,data=123456,id=sec0 \ > -f qcow2 -o encryption-format=aes,aes-key-secret=sec0 \ > test.qcow2 10G > > With the LUKS format it is necessary to store the LUKS > partition header and key material in the QCow2 file. This > data can be many MB in size, so cannot go into the QCow2 > header region directly. Thus the spec defines a FDE > (Full Disk Encryption) header extension that specifies > the offset of a set of clusters to hold the FDE headers, > as well as the length of that region. The LUKS header is > thus stored in these extra allocated clusters before the > main image payload. > > Aside from all the cryptographic differences implied by > use of the LUKS format, there is one further key difference > between the use of legacy AES and LUKS encryption in qcow2. > For LUKS, the initialiazation vectors are generated using > the host physical sector as the input, rather than the > guest virtual sector. This guarantees unique initialization > vectors for all sectors when qcow2 internal snapshots are > used, thus giving stronger protection against watermarking > attacks. > > Signed-off-by: Daniel P. Berrange <berra...@redhat.com> > --- > block/qcow2-cluster.c | 4 +- > block/qcow2-refcount.c | 10 ++ > block/qcow2.c | 284 > +++++++++++++++++++++++++++++++++++++++------ > block/qcow2.h | 9 ++ > include/block/block_int.h | 1 + > qapi/block-core.json | 11 +- > qemu-img.c | 4 +- > tests/qemu-iotests/082.out | 270 +++++++++++++++++++++++++++++++++++++----- > 8 files changed, 527 insertions(+), 66 deletions(-) >
[...] > diff --git a/qapi/block-core.json b/qapi/block-core.json > index 4943942..d15c6a9 100644 > --- a/qapi/block-core.json > +++ b/qapi/block-core.json > @@ -2327,9 +2327,15 @@ > # caches. The interval is in seconds. The default > value > # is 0 and it disables this feature (since 2.5) > # @aes-key-secret: #optional the ID of a QCryptoSecret object > providing > -# the AES decryption key (since 2.9). Mandatory for > +# the AES decryption key (since 2.9). Mandatory for > AES > # encrypted images, except when doing a metadata-only > # probe of the image. > +# the AES decryption key (since 2.9) Mandatory except > +# when doing a metadata-only probe of the image. I think these two lines should be omitted (rebase artifact?). With that fixed: Reviewed-by: Max Reitz <mre...@redhat.com> > +# @luks-key-secret: #optional the ID of a QCryptoSecret object > providing > +# the LUKS keyslot passphrase (since 2.9). Mandatory > for > +# LUKS encrypted images, except when doing a > metadata- > +# only probe of the image. > # > # Since: 1.7 > ## [...]
signature.asc
Description: OpenPGP digital signature
