Re: GELI - disk encryption GEOM class committed.
From: Pawel Jakub Dawidek (pjd_at_FreeBSD.org)
Date: 07/29/05
- Previous message: Suleiman Souhlal: "Re: PMC (performance counters) problems - kernel panic in 6-beta1"
- In reply to: Benjamin Lutz: "Re: GELI - disk encryption GEOM class committed."
- Next in thread: Niki Denev: "Re: GELI - disk encryption GEOM class committed."
- Reply: Niki Denev: "Re: GELI - disk encryption GEOM class committed."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Fri, 29 Jul 2005 12:36:55 +0200 To: Benjamin Lutz <benlutz@datacomm.ch>
On Fri, Jul 29, 2005 at 03:09:13AM +0200, Benjamin Lutz wrote:
+> > GELI is different than GBDE. It offers different features, but it also
+> > use different scheme for doing crypto work.
+>
+>
+> I tried to find out what exactly the differences are. Please correct me
+> where I'm wrong:
+>
+> Encryption Strength:
+> GELI - Supports AES, Blowfish, 3DES for data encryption, with a
+> different key per sector. Access key is PKCS #5 protected.
+> (What does this mean regarding a brute force attack?)
No. The encryption key is the same. Every data block is encrypted using
choosen encryption algorithm in CBC mode and with per-block unique IVs.
PKCS#5v2 basically takes your passphrase and makes huge number of
HMAC/SHA512 rounds with it. The result is used as a key.
When brute forcing, you need to take a passphrase, do the same HMAC/SHA512
work and result use as a key to try.
It works really great as passphrase protection. On my laptop it takes
about 1 second to make 2^16 HMAC/SHA512 operations.
+> Speed:
+> GBDE - Runs in software.
+> GELI - Support for crypto(9) hardware. Blowfish is faster than AES.
This was one of the main GELI goals, that's why simple sector-to-sector
encryption is used, so geli doesn't add disk overhead.
+> Booting from Encrypted Root:
+> GELI - Works. How'd one load the kernel from an encrypted root though?
Kernel has to be loaded from a USB Pen-Drive or a CD-ROM.
You need to put /boot/ directory in there. GELI will ask for the passphrase
before root file system is mounted. After that you can remove
Pen-Drive/CD-ROM.
+> The GBDE manpage warns that the on-disk format might be changed in the
+> future. What about GELI? It'd be unpleasant to upgrade the OS and then
+> find out that the encrypted volume is no longer accessible.
It will be changed only in case of security flaw.
+> How much throughput can one expect in practice, say, compared to the
+> numbers in "openssl speed"?
Depends on your disk speed, but you should just try it.
-- Pawel Jakub Dawidek http://www.wheel.pl pjd@FreeBSD.org http://www.FreeBSD.org FreeBSD committer Am I Evil? Yes, I Am!
- application/pgp-signature attachment: stored
- Previous message: Suleiman Souhlal: "Re: PMC (performance counters) problems - kernel panic in 6-beta1"
- In reply to: Benjamin Lutz: "Re: GELI - disk encryption GEOM class committed."
- Next in thread: Niki Denev: "Re: GELI - disk encryption GEOM class committed."
- Reply: Niki Denev: "Re: GELI - disk encryption GEOM class committed."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
