Re: Idea behind EXT4_IOC_GET_ENCRYPTION_PWSALT?
Richard, Our current design for fscrypt (tentative name for the userspace filesystem encryption manager) does not use the global filesystem salt (EXT4_IOC_GET_ENCRYPTION_PWSALT), we are planning on having a different salt for each password used in the system. We are using planning on using Argon2id as the password stretching algorithm, so we'll have costs for memory, time, and parallelism stored for each password as well as a salt. I can't speak to other uses of the ioctl. Joe On Tue, Nov 29, 2016 at 1:30 PM, Richard Weinberger wrote: > Hi! > > As the subject states, I'm a bit confused wrt. EXT4_IOC_GET_ENCRYPTION_PWSALT. > Will common fscrypt userspace depend on it? > > IIUC you want to store some salt to seed the user password. > But what if /home/rw and /home/dags have different keys? Is it okay > to use the same salt for both keys? > Or is it an ad-hoc solution to allow an encrypted filesystem root > because you need a way to store the seed on the same filesystem but not as > file since all files are encrypted? > Wouldn't a xattr stored in the filesystem root directory also do it? > > Long story short, I'm not sure whether we really need this ioctl command > in UBIFS and what the designated semantics are. :-) > > Thanks, > //richard > -- > To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in > the body of a message to majord...@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html smime.p7s Description: S/MIME Cryptographic Signature
Re: [RFD] Common userspace tool for fscypto
Hi Richard, I'm Joe Richey, and I work on Mike's team. We've been playing around with a few design ideas regarding a tool for managing filesystem encryption. After going though some iterations with Ted, we have a fairly good idea about where to head design wise, and I'm working on a design document for it. It's a bit preliminary at this point, but I can share it if you want. Our goal is to have a finished doc by end of Q4 and then get your and Jaegeuk's feedback. Thanks, Joe On Tue, Nov 29, 2016 at 12:48 PM, Richard Weinberger wrote: > > Michael, > > On 19.10.2016 19:36, Michael Halcrow wrote: > >> That said, what about implementing such a tool as part of util-linux to > >> control > >> fscrypto? We (David and I) would volunteer. > > > > While discussing several changes we have staged for release (we're > > trying to minimize churn by batching a large set of format changes all > > at once), we've recently recognized this need on my team and were > > planning on starting work on exactly what you propose. > > Did this plan already materialize? :-) > > Thanks, > //richard > > -- > To unsubscribe from this list: send the line "unsubscribe linux-ext4" in > the body of a message to majord...@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html smime.p7s Description: S/MIME Cryptographic Signature
