Re: [Qemu-devel] QCOW2 cryptography and secure key handling

[Benoît Canet]

> There are two ways I could see it happening. Either integrate directly
> into the qcow2 file format, by mapping LUKS headers & key material
> blocks into the qcow2 header region in some manner.
> 
> Alternatively do it in a completely generic block driver, that qcow2
> (or any other qemu bdrv) calls into instead of the file bdrv. That
> way the entire LUKS format becomes the image file data payload. A
> separate block driver, could also allow LUKS to be layered ontop,
> so that metadata is encrypted too.  eg so you could end up with
> either layering
> 
>    QCow2 bdrv -> LUKS bdrv -> file bdrv
>    LUKS bdrv -> QCow2 bdrv -> file bdrv

I already tried the generic block driver approach on other project. (Quorum)
The problem is that it result in complex issues to make the driver works with
all QEMU features (think snapshots) and that no one has the funding to tackle
the infrastructure work required to solve this: writing BlockBackend and block
filters.

Best regards

Benoît